{"record":{"id":"3c1cc64e19799961","repo":"microsoft/aspire","slug":"adc-request-method-path-failed-with-http-int-response","errorCode":null,"errorMessage":"ADC request '{method} {path}' failed with HTTP {(int)response.StatusCode} ({response.ReasonPhrase}). {message}{permissionHint}","messagePattern":"ADC request '(.+?) (.+?)' failed with HTTP (.+?) \\((.+?)\\)\\. (.+?)(.+?)","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Sandboxes/Internal/Adc/AzureDevComputeClient.cs","lineNumber":465,"sourceCode":"            return _accessToken.Token;\n        }\n\n        _accessToken = await credential.GetTokenAsync(new TokenRequestContext(s_authorizationScopes), cancellationToken).ConfigureAwait(false);\n        return _accessToken.Token;\n    }\n\n    private static async Task EnsureSuccessAsync(HttpResponseMessage response, HttpMethod method, string path, CancellationToken cancellationToken)\n    {\n        if (response.IsSuccessStatusCode)\n        {\n            return;\n        }\n\n        var message = await GetErrorMessageAsync(response, cancellationToken).ConfigureAwait(false);\n        var permissionHint = response.StatusCode == HttpStatusCode.Forbidden\n            ? \" Verify that the calling principal has the Container Apps SandboxGroup Data Owner role on the sandbox group; newly-created role assignments can take a short time to propagate.\"\n            : string.Empty;\n        throw new InvalidOperationException($\"ADC request '{method} {path}' failed with HTTP {(int)response.StatusCode} ({response.ReasonPhrase}). {message}{permissionHint}\");\n    }\n\n    private static Task<string> GetErrorMessageAsync(HttpResponseMessage response, CancellationToken cancellationToken)\n    {\n        cancellationToken.ThrowIfCancellationRequested();\n        if (response.Content.Headers.ContentLength == 0)\n        {\n            return Task.FromResult(string.Empty);\n        }\n\n        return Task.FromResult(\"The service returned an error response whose details were redacted.\");\n    }\n\n    private static string GetSandboxGroupPath(AzureDevComputeResourceScope scope)\n    {\n        return $\"subscriptions/{Escape(scope.SubscriptionId)}/resourceGroups/{Escape(scope.ResourceGroupName)}/sandboxGroups/{Escape(scope.SandboxGroupName)}\";\n    }\n","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Sandboxes/Internal/Adc/AzureDevComputeClient.cs#L447-L483","documentation":"EnsureSuccessAsync is the ADC client's non-success HTTP handler: for any non-success status it reads an error message from the response body and throws InvalidOperationException including the method, path, numeric status code, reason phrase, body message, and — for 403 — a hint to verify the caller has the Container Apps SandboxGroup Data Owner role on the sandbox group. It is raised by every SendAsync/SendCreateAsync call that gets an error status.","triggerScenarios":"Any ADC HTTP request (via SendAsync or SendCreateAsync) that returns 4xx/5xx; most specifically an HTTP 403 Forbidden when the calling principal lacks the Container Apps SandboxGroup Data Owner role assignment.","commonSituations":"RBAC role assignment not yet propagated right after granting access (the hint notes propagation delay); wrong tenant/subscription; expired or insufficient credentials; sandbox group not found (404); service outage (5xx).","solutions":["If status is 403, assign the Container Apps SandboxGroup Data Owner role to the calling principal on the sandbox group and wait a few minutes for propagation, then retry.","Read the embedded message from the exception to identify the specific status (401 vs 404 vs 429 vs 5xx) and address accordingly.","Verify your Azure credentials (az login, managed identity, or service principal) target the correct tenant and subscription.","Retry transient failures (429/5xx) with backoff; check Azure status for ADC outages.","Confirm the sandbox group name/path used in the request is correct."],"exampleFix":"// before: no RBAC role on principal\n// HTTP 403 thrown by EnsureSuccessAsync\n// after (Azure CLI)\naz role assignment create --assignee <principalId> --role \"Container Apps SandboxGroup Data Owner\" --scope <sandboxGroupId>","handlingStrategy":"retry","validationCode":"// Pre-flight: verify the principal's RBAC role before calling ADC\naz role assignment list --assignee <principalId> --scope <sandboxGroupId>\n// Expect \"Container Apps SandboxGroup Data Owner\" in results","typeGuard":null,"tryCatchPattern":"try\n{\n    await client.SendAsync(request, ct);\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"HTTP 403\"))\n{\n    // grant SandboxGroup Data Owner role, wait for propagation, retry with backoff\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"HTTP 429\") || ex.Message.Contains(\"HTTP 5\"))\n{\n    // transient: retry with exponential backoff\n}","preventionTips":["Assign Container Apps SandboxGroup Data Owner to your principal before first use; allow propagation time.","Include a short startup retry with backoff for 403/429/5xx on ADC calls.","Verify credentials (tenant/subscription) before running AppHosts that use ADC.","Surface the exception's embedded status code and message in your diagnostics."],"tags":["azure","http","authorization","rbac"],"backgroundTag":"http-error-response","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}