{"record":{"id":"6f098c36bca42b9d","repo":"hashicorp/nomad","slug":"mismatched-request-namespace-in-request-q-q","errorCode":null,"errorMessage":"mismatched request namespace in request: %q, %q","messagePattern":"mismatched request namespace in request: %q, %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/job_endpoint.go","lineNumber":128,"sourceCode":"\treturn j.doRegister(aclObj, allowedPermissions, args, reply)\n}\n\n// doRegister does the actual job registration, including any additional\n// permission checks, and after metrics have begun recording\nfunc (j *Job) doRegister(aclObj *acl.ACL, additionalAllowedPermissions []string, args *structs.JobRegisterRequest, reply *structs.JobRegisterResponse) error {\n\tif ok, err := registrationsAreAllowed(aclObj, j.srv.State()); !ok || err != nil {\n\t\tj.logger.Warn(\"job registration is currently disabled for non-management ACL\")\n\t\treturn structs.ErrJobRegistrationDisabled\n\t}\n\n\t// Validate the arguments\n\tif args.Job == nil {\n\t\treturn fmt.Errorf(\"missing job for registration\")\n\t}\n\n\t// defensive check; http layer and RPC requester should ensure namespaces are set consistently\n\tif args.RequestNamespace() != args.Job.Namespace {\n\t\treturn fmt.Errorf(\"mismatched request namespace in request: %q, %q\", args.RequestNamespace(), args.Job.Namespace)\n\t}\n\n\t// Run admission controllers\n\tjob, warnings, err := j.admissionControllers(args.Job)\n\tif err != nil {\n\t\treturn err\n\t}\n\targs.Job = job\n\n\t// Run the submission controller\n\twarnings = append(warnings, j.submissionController(args))\n\n\t// Attach the user token's accessor ID so that deploymentwatcher can\n\t// reference the token later in multiregion deployments. We can't auth once\n\t// and then use the leader ACL because the leader ACLs aren't shared across\n\t// regions. Note this implies WIs can't be used to register multi-region\n\t// jobs b/c their identities are only valid in a single region.\n\tif args.GetIdentity().ACLToken != nil &&","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/job_endpoint.go#L110-L146","documentation":"In Nomad's job registration path (nomad/job_endpoint.go:128), the request-level namespace (args.RequestNamespace()) must match args.Job.Namespace. This is a defensive consistency check: the HTTP layer and RPC requester are expected to set both identically, and a mismatch indicates an inconsistent or forged request.","triggerScenarios":"Sending a JobRegister request where the WriteRequest.Namespace (or query parameter ?namespace=) differs from the Namespace field set inside the Job object being registered.","commonSituations":"Templates or scripts that set the namespace only on the job spec while the API call defaults to the 'default' namespace (or vice versa); passing ?namespace=prod in the URL while the HCL job contains namespace = \"dev\"; wrappers that mutate one but not the other.","solutions":["Make the Job.Namespace field match the request namespace: either remove the namespace stanza from the job (inherits the request namespace) or set both to the same value.","If using the HTTP API, ensure the ?namespace= query parameter matches the job's namespace stanza.","Fix automation/tooling that injects the namespace into only one of the two places.","Prefer the CLI (`nomad job run -namespace=X`) which sets both consistently."],"exampleFix":"// before (HCL with URL namespace=default)\nnomad job run -namespace=default app.nomad  # job HCL contains: namespace = \"prod\"\n\n// after\nnomad job run -namespace=prod app.nomad  // or drop 'namespace' from the HCL","handlingStrategy":"validation","validationCode":"if job.Namespace != nil && req.Namespace != \"\" && *job.Namespace != req.Namespace {\n\treturn fmt.Errorf(\"request namespace %q != job namespace %q\", req.Namespace, *job.Namespace)\n}","typeGuard":"func namespacesMatch(reqNS string, jobNS *string) bool {\n\tif jobNS == nil || *jobNS == \"\" {\n\t\treturn reqNS == \"\" || reqNS == structs.DefaultNamespace\n\t}\n\treturn reqNS == \"\" || reqNS == *jobNS\n}","tryCatchPattern":"_, _, err := client.Jobs().RegisterInNamespace(job, ns)\nif err != nil && strings.Contains(err.Error(), \"mismatched request namespace\") {\n\treturn fmt.Errorf(\"job stanza namespace must equal ?namespace= query param: %w\", err)\n}","preventionTips":["Omit the `namespace` stanza from job HCL and rely on -namespace/URL parameter.","In CI, template the namespace into one place only (the request).","Add a pre-submit lint that asserts job.Namespace == target namespace.","Use `nomad job run` instead of raw HTTP so both are set consistently."],"tags":["nomad","namespace","job-registration","validation"],"backgroundTag":"namespace-mismatch","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}