{"record":{"id":"3bf09f172ad4f206","repo":"hasura/graphql-engine","slug":"exporting-metadata-from-server-w-3bf09f","errorCode":null,"errorMessage":"exporting metadata from server: %w","messagePattern":"exporting metadata from server: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/pkg/metadata/mode_handlers.go","lineNumber":281,"sourceCode":"\t})\n\tif err != nil {\n\t\treturn nil, errors.E(op, fmt.Errorf(\"applying metadata: %w\", err))\n\t}\n\n\tb := new(bytes.Buffer)\n\tif err := json.NewEncoder(b).Encode(r); err != nil {\n\t\treturn nil, errors.E(op, fmt.Errorf(\"encoding json response from server: %w\", err))\n\t}\n\n\treturn b, nil\n}\n\nfunc export(p *ProjectMetadata, mode cli.MetadataMode) (io.Reader, error) {\n\tvar op errors.Op = \"metadata.export\"\n\n\tmetadata, err := p.ec.APIClient.V1Metadata.ExportMetadata()\n\tif err != nil {\n\t\treturn nil, errors.E(op, fmt.Errorf(\"exporting metadata from server: %w\", err))\n\t}\n\n\tvar metadataBytes []byte\n\n\tmetadataBytes, err = io.ReadAll(metadata)\n\tif err != nil {\n\t\treturn nil, errors.E(op, fmt.Errorf(\"reading metadata from response: %w\", err))\n\t}\n\n\tif mode == cli.MetadataModeYAML {\n\t\tmetadataBytes, err = metadatautil.JSONToYAML(metadataBytes)\n\t\tif err != nil {\n\t\t\treturn nil, errors.E(op, fmt.Errorf(\"parsing metadata to yaml: %w\", err))\n\t\t}\n\t}\n\n\treturn bytes.NewReader(metadataBytes), nil\n}","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/cli/pkg/metadata/mode_handlers.go#L263-L299","documentation":"Thrown by metadata export when the call to the Hasura server's ExportMetadata API fails before any metadata is read. This is a transport/API-level failure: unreachable server, authentication failure, or the server rejecting the export request. The wrapped error carries the HTTP/GraphQL details.","triggerScenarios":"Calling Export (hasura metadata export) with an incorrect endpoint, an unreachable Hasura instance, a missing/wrong admin secret (401), or a server whose metadata API errors out. Any network error or non-2xx response from /v1metadata surfaces here.","commonSituations":"Server not running or wrong --endpoint; HASURA_GRAPHQL_ADMIN_SECRET not set or wrong value in env/config; on-prem server behind a VPN/firewall from where the CLI runs; SSL/TLS certificate verification failures against self-signed endpoints.","solutions":["Check the wrapped error: connection refused means wrong endpoint/server down; 401 means fix the admin secret","Verify connectivity: curl $ENDPOINT/healthz from the same machine/CI runner","Set the correct --endpoint and --admin-secret (or env vars) and retry","For TLS failures with self-signed certs, use the appropriate flag/env to trust the CA or fix certificates"],"exampleFix":"# before\nhasura metadata export  # exporting metadata from server: connection refused\n# after\nhasura metadata export --endpoint https://hasura.example.com --admin-secret $SECRET","handlingStrategy":"retry","validationCode":"resp, err := http.Get(endpoint + \"/healthz\")\nif err != nil || resp.StatusCode != 200 {\n    return fmt.Errorf(\"Hasura server not reachable at %s\", endpoint)\n}","typeGuard":null,"tryCatchPattern":"if _, err := pm.Export(ctx, mode); err != nil {\n    if strings.Contains(err.Error(), \"exporting metadata from server\") {\n        // check connectivity/auth: wrapped error distinguishes refused vs 401\n    }\n}","preventionTips":["Run a health check against the endpoint before metadata operations","Set endpoint and admin secret via env vars validated at job start","Add retry with backoff for transient network failures in CI"],"tags":["network","auth","metadata","graphql-api","hasura-cli"],"backgroundTag":"api-request-failed","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}