{"record":{"id":"370a78a4f6abd818","repo":"crowdsecurity/crowdsec","slug":"failed-to-get-response-w","errorCode":null,"errorMessage":"failed to get response: %w","messagePattern":"failed to get response: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/papi.go","lineNumber":174,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"'%s %s failed: %w\", message.Header.OperationType, message.Header.OperationCmd, err)\n\t}\n\n\treturn nil\n}\n\nfunc (p *Papi) GetPermissions(ctx context.Context) (PapiPermCheckSuccess, error) {\n\thttpClient := p.apiClient.GetClient()\n\tpapiCheckURL := fmt.Sprintf(\"%s%s%s\", p.URL, PAPIVersion, PAPIPermissionsURL)\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, papiCheckURL, http.NoBody)\n\tif err != nil {\n\t\treturn PapiPermCheckSuccess{}, fmt.Errorf(\"failed to create request: %w\", err)\n\t}\n\n\tresp, err := httpClient.Do(req)\n\tif err != nil {\n\t\treturn PapiPermCheckSuccess{}, fmt.Errorf(\"failed to get response: %w\", err)\n\t}\n\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\terrResp := PapiPermCheckError{}\n\n\t\terr = json.NewDecoder(resp.Body).Decode(&errResp)\n\t\tif err != nil {\n\t\t\treturn PapiPermCheckSuccess{}, fmt.Errorf(\"failed to decode response: %w\", err)\n\t\t}\n\n\t\treturn PapiPermCheckSuccess{}, fmt.Errorf(\"unable to query PAPI : %s (%d)\", errResp.Error, resp.StatusCode)\n\t}\n\n\trespBody := PapiPermCheckSuccess{}\n\n\terr = json.NewDecoder(resp.Body).Decode(&respBody)","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/papi.go#L156-L192","documentation":"GetPermissions attempted the HTTP GET against the PAPI /permissions endpoint and the request itself failed at the transport level (httpClient.Do returned an error) — no HTTP response was received at all. This wraps the underlying net/http error, which distinguishes DNS failures, connection refused, TLS handshake errors, and timeouts. The permission-check flow cannot proceed without a response.","triggerScenarios":"Called during PAPI permission querying when the machine cannot reach api.crowdsec.net (or the configured papi host): DNS resolution failure, blocked egress on 443, TLS trust issues (missing CA cert / clock skew), or proxy requirements not honored.","commonSituations":"Firewall or corporate proxy blocking outbound HTTPS to api.crowdsec.net; missing https_proxy env in containerized deployments; system clock skew breaking TLS; IPv6 breakage resolving the CAPI host.","solutions":["Read the wrapped error: it names DNS vs connection vs TLS vs timeout.","Test connectivity: `curl -v https://api.crowdsec.net/v1/permissions` from the same host.","Set proxy env vars (https_proxy/HTTPS_PROXY) if egress requires a proxy, then restart crowdsec.","Fix DNS or time sync (`timedatectl status`, resolv.conf) as indicated by the error.","Check config api.client.ca_cert_path / insecure_skip_verify if the wrapped error is a TLS x509 error."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight reachability check before startup:\nconn, err := net.DialTimeout(\"tcp\", \"api.crowdsec.net:443\", 5*time.Second)\nif err != nil { /* warn: CAPI unreachable, egress/proxy/DNS problem */ }","typeGuard":null,"tryCatchPattern":"perms, err := papi.GetPermissions(ctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to get response\") {\n        var netErr net.Error\n        if errors.As(err, &netErr) && netErr.Timeout() {\n            // retry with backoff; transient network issue\n        }\n    }\n}","preventionTips":["Allow outbound TCP 443 to api.crowdsec.net in firewall/egress rules.","Set https_proxy env vars wherever the host requires a proxy.","Monitor NTP/clock sync — skew breaks TLS handshakes.","Add a startup connectivity check and alert on CAPI unreachability."],"tags":["network","papi","http","connectivity"],"backgroundTag":"network-request-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}