{"record":{"id":"729402fc7f59cbb6","repo":"crowdsecurity/crowdsec","slug":"while-creating-default-client-w","errorCode":null,"errorMessage":"while creating default client: %w","messagePattern":"while creating default client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apic.go","lineNumber":799,"sourceCode":"\t\terr = a.dbClient.UpdateAllowlistMeta(ctx, *link.ID, *link.Name, description)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"while updating allowlist meta %s: %s\", *link.Name, err)\n\t\t}\n\t}\n\n\tlog.Infof(\"Allowlist %s updated\", *link.Name)\n\n\treturn nil\n}\n\nfunc (a *apic) UpdateAllowlists(ctx context.Context, allowlistsLinks []*modelscapi.AllowlistLink, forcePull bool) error {\n\tif len(allowlistsLinks) == 0 {\n\t\treturn nil\n\t}\n\n\tclient, err := apiclient.NewDefaultClient(a.apiClient.BaseURL, \"\", \"\", nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating default client: %w\", err)\n\t}\n\n\tfor _, link := range allowlistsLinks {\n\t\tif err := a.updateOneAllowlist(ctx, client, link); err != nil {\n\t\t\tlog.Errorf(\"updating allowlists from CAPI: %s\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// if decisions is whitelisted: return representation of the whitelist ip or cidr\n// if not whitelisted: empty string\nfunc (a *apic) whitelistedBy(decision *models.Decision, additionalIPs []netip.Addr, additionalRanges []netip.Prefix) string {\n\tif decision.Value == nil {\n\t\treturn \"\"\n\t}\n","sourceCodeStart":781,"sourceCodeEnd":817,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apic.go#L781-L817","documentation":"UpdateAllowlists wraps failures from apiclient.NewDefaultClient, which builds a plain HTTP client (no JWT auth) used to fetch allowlists from CAPI. The constructor fails mainly when the BaseURL cannot be parsed into a valid http.Request (url.Parse failure). It is a setup-stage error, not a network call failure.","triggerScenarios":"PullTop or PullAllowlist runs after CAPI pull and returns allowlistsLinks; a.apiClient.BaseURL is malformed/unparseable (e.g. wrong --api-url or CAPI url config) so NewDefaultClient errors when constructing the request URL.","commonSituations":"Misconfigured api_url / capi_url in crowdsec.yaml (typo, missing scheme, trailing junk), proxy env or custom config overriding BaseURL, or template/flag substitution producing an empty or invalid URL.","solutions":["Check `cscli capi status` and the api_url/api.client settings in your crowdsec.yaml; fix the BaseURL value.","Validate the URL parses: run `url.Parse` equivalent or simply open the URL in curl to confirm format.","If behind a proxy, verify HTTP_PROXY/HTTPS_PROXY do not corrupt the configured URL.","If the error persists, restart with the default config to isolate a bad override."],"exampleFix":"// before (bad config)\napi_url: \"capi .crowdsec.net\"\n// after\napi_url: \"https://api.crowdsec.net/\"","handlingStrategy":"validation","validationCode":"if u, err := url.Parse(baseURL); err != nil || u.Scheme == \"\" || u.Host == \"\" {\n    return fmt.Errorf(\"invalid base URL %q: %w\", baseURL, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate api_url with `cscli capi status` after any config change.","Always include scheme and host in configured URLs.","Check `cscli config show` for effective URL values when overrides are in play."],"tags":["http-client","url-parsing","capi","configuration"],"backgroundTag":"invalid-url-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}