{"record":{"id":"29b0b30dbdfda70d","repo":"n8n-io/n8n","slug":"invalid-resume-payload-parseresult-error","errorCode":null,"errorMessage":"Invalid resume payload: ${parseResult.error}","messagePattern":"Invalid resume payload: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/@n8n/agents/src/runtime/loop/agent-runtime.ts","lineNumber":386,"sourceCode":"\t\tconst list = AgentMessageList.deserialize(state.messageList);\n\t\tthis.context.hydrateDeferredToolsFromList(list);\n\t\tawait hydrateFileParts(list.messages(), this.config.fileStore, {\n\t\t\tthreadId: state.persistence?.threadId,\n\t\t});\n\n\t\tconst tool = this.context\n\t\t\t.getCurrentTools(state.persistence)\n\t\t\t.find((t) => t.name === toolCall.toolName);\n\t\tif (!tool) throw new Error(`Tool ${toolCall.toolName} not found`);\n\n\t\tlet resumeData: unknown = data;\n\t\tlet abortScope: AgentAbortScope | undefined;\n\n\t\tconst resumeSchema = toolCall.suspended ? toolCall.resumeSchema : tool.resumeSchema;\n\t\tif (!isCancellation(resumeData) && resumeSchema) {\n\t\t\tconst parseResult = await parseWithSchema(resumeSchema, data, { stripUnknown: true });\n\t\t\tif (!parseResult.success) {\n\t\t\t\tthrow new Error(`Invalid resume payload: ${parseResult.error}`);\n\t\t\t}\n\t\t\tresumeData = parseResult.data as JSONValue;\n\t\t}\n\n\t\ttry {\n\t\t\t// Merge persisted execution options with fresh caller options\n\t\t\tconst {\n\t\t\t\trunId: _rid,\n\t\t\t\ttoolCallId: _tcid,\n\t\t\t\tonResumeClaimed: _onResumeClaimed,\n\t\t\t\t...callerExecOptions\n\t\t\t} = options;\n\t\t\tconst persisted = state.executionOptions ?? {};\n\t\t\tconst persistedMaxIterations = persisted.maxIterations;\n\t\t\tconst callerMaxIterations = callerExecOptions.maxIterations;\n\t\t\tif (\n\t\t\t\tcallerMaxIterations !== undefined &&\n\t\t\t\tpersistedMaxIterations !== undefined &&","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/agents/src/runtime/loop/agent-runtime.ts#L368-L404","documentation":"Thrown when a query parameter whose name looks credential-like (matches api_key, access_token, auth_token, bearer_token, secret_key, private_key, client_secret, password, credentials, or exactly token/secret/auth) is set to a hardcoded literal value. The validator wants query-string secrets routed through the credential system, typically httpQueryAuth.","triggerScenarios":"A queryParameters.parameters[] entry where isCredentialFieldName(param.name) is true, param.value is truthy, and the value string does not start with '=' and does not contain '={{'.","commonSituations":"Pasting '?api_key=...' from vendor docs into queryParameters; an AI builder inlining the token in the URL; testing with a live key left as a literal.","solutions":["Create an httpQueryAuth credential and reference it from the node (authentication='genericCredentialType', genericAuthType='httpQueryAuth').","If reusing templated auth, use httpTemplatedCustomAuth with a {\"query\":{...}} template.","Wrap the value in an expression so it is not flagged as a hardcoded literal, though a credential is strongly preferred for any persisted secret."],"exampleFix":"// before\nhttpRequest({\n  name: 'Search',\n  queryParameters: { parameters: [{ name: 'api_key', value: 'live_key_xyz' }] },\n});\n\n// after\nhttpRequest({\n  name: 'Search',\n  authentication: 'genericCredentialType',\n  genericAuthType: 'httpQueryAuth',\n  credentials: { httpQueryAuth: { id: 'EXISTING_CRED_ID' } },\n});","handlingStrategy":"validation","validationCode":"import { isCredentialFieldName, containsExpression } from './validation-helpers';\n\nfunction findHardcodedCredQueryParams(queryParameters: { parameters?: Array<{ name?: string; value?: unknown }> } | undefined): string[] {\n  const offenders: string[] = [];\n  for (const p of queryParameters?.parameters ?? []) {\n    const valueStr = typeof p.value === 'string' ? p.value : JSON.stringify(p.value);\n    if (p.name && isCredentialFieldName(p.name) && p.value && !containsExpression(valueStr)) {\n      offenders.push(p.name);\n    }\n  }\n  return offenders;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Route query-string secrets through an httpQueryAuth credential.","Avoid naming non-secret query params with credential-like words (api_key, token).","Fail CI on any HARDCODED_CREDENTIALS issue in generated workflows."],"tags":["security","credentials","http-request","query-parameters"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}