{"record":{"id":"4e459cdd9c9d942e","repo":"nats-io/nats-server","slug":"10052-4e459c","errorCode":"10052","errorMessage":"stream configuration for create can not be sealed","messagePattern":"stream configuration for create can not be sealed","errorType":"error_code","errorClass":"JSStreamInvalidConfigError","httpStatus":500,"severity":"error","filePath":"server/jetstream_cluster.go","lineNumber":10086,"sourceCode":"\t\t\tcurrentIName[s.iname] = struct{}{}\n\t\t}\n\t\tfor _, s := range cfg.Sources {\n\t\t\ts.setIndexName()\n\t\t\tif _, ok := currentIName[s.iname]; !ok {\n\t\t\t\ts.iname = _EMPTY_\n\t\t\t}\n\t\t}\n\t\tif !reflect.DeepEqual(osa.Config, cfg) {\n\t\t\tresp.Error = NewJSStreamNameExistError()\n\t\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(rmsg), s.jsonResponse(&resp))\n\t\t\treturn\n\t\t}\n\t\t// This is an equal assignment.\n\t\tself, rg, syncSubject = osa, osa.Group, osa.Sync\n\t}\n\n\tif cfg.Sealed {\n\t\tresp.Error = NewJSStreamInvalidConfigError(fmt.Errorf(\"stream configuration for create can not be sealed\"))\n\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(rmsg), s.jsonResponse(&resp))\n\t\treturn\n\t}\n\n\t// Check for subject collisions here.\n\tif js.subjectsOverlap(acc.Name, cfg.Subjects, self) {\n\t\tresp.Error = NewJSStreamSubjectOverlapError()\n\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(rmsg), s.jsonResponse(&resp))\n\t\treturn\n\t}\n\n\tapiErr = js.jsClusteredStreamLimitsCheck(acc, cfg)\n\t// Check for stream limits here before proposing. These need to be tracked from meta layer, not jsa.\n\tif apiErr != nil {\n\t\tresp.Error = apiErr\n\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(rmsg), s.jsonResponse(&resp))\n\t\treturn\n\t}","sourceCodeStart":10068,"sourceCodeEnd":10104,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jetstream_cluster.go#L10068-L10104","documentation":"This is JSStreamInvalidConfigError (API error 10052) returned by the stream CREATE API handler when the submitted stream configuration has Sealed set to true. Sealed is a terminal state that can only be reached by updating an existing stream (sealing it after it has data); a brand-new stream cannot be created already sealed, so creation is rejected.","triggerScenarios":"Calling the `$JS.API.STREAM.CREATE.*` subject or `jetstream.CreateStream`/`js.AddStream` with `Config.Sealed: true`, or via `nats stream add --seal` equivalent on a new stream.","commonSituations":"Scripts that snapshot a stream's config (including Sealed=true from a `StreamInfo`) and feed that config back into a create call when recreating or migrating streams.","solutions":["Remove `Sealed: true` from the stream config passed to the create call (leave it false/unset).","If the goal is a sealed copy, first create the stream unsealed, then issue an update with Sealed set to true.","When cloning a stream from StreamInfo, explicitly reset lifecycle fields (Sealed) before creating."],"exampleFix":"// before\ncfg := si.Config // Sealed==true copied from existing stream\njs.CreateStream(nc, cfg)\n// after\ncfg := si.Config\ncfg.Sealed = false\njs.CreateStream(nc, cfg)","handlingStrategy":"validation","validationCode":"// Go client: sanitize config before create\nif cfg.Sealed {\n    cfg.Sealed = false // sealed streams cannot be created; seal after creation\n}\njs.CreateStream(nc, cfg)","typeGuard":"func isValidCreateConfig(cfg *nats.StreamConfig) bool {\n    return cfg != nil && !cfg.Sealed\n}","tryCatchPattern":"_, err := js.CreateStream(nc, cfg)\nvar apiErr *nats.APIError\nif errors.As(err, &apiErr) && apiErr.ErrorCode == 10052 {\n    cfg.Sealed = false\n    _, err = js.CreateStream(nc, cfg)\n}","preventionTips":["Never copy Sealed from StreamInfo back into a create call.","Seal streams via a separate update step after creation.","Centralize stream creation in one helper that resets lifecycle fields.","Document that Sealed is terminal and update-only."],"tags":["jetstream","stream","config-validation","api-error"],"backgroundTag":"invalid-stream-config","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}