{"record":{"id":"8d88fe0880d43ce3","repo":"getsops/sops","slug":"missing-scheme-in-vault-url-should-be-like-this","errorCode":null,"errorMessage":"missing scheme in Vault URL (should be like this: +https://vault.example.com:8200/v1/transit/keys/keyName), got: %v","messagePattern":"missing scheme in Vault URL \\(should be like this: \\+https://vault\\.example\\.com:8200/v1/transit/keys/keyName\\), got: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hcvault/keysource.go","lineNumber":178,"sourceCode":"\t\t}\n\t\tkeys = append(keys, key)\n\t}\n\treturn keys, nil\n}\n\n// NewMasterKeyFromURI obtains the Vault address, Transit backend path and the\n// key name from the full URI of the key.\nfunc NewMasterKeyFromURI(uri string) (*MasterKey, error) {\n\tvar key *MasterKey\n\tif uri == \"\" {\n\t\treturn key, nil\n\t}\n\tu, err := url.Parse(uri)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif u.Scheme == \"\" {\n\t\treturn nil, fmt.Errorf(\"missing scheme in Vault URL (should be like this: +\"+\n\t\t\t\"https://vault.example.com:8200/v1/transit/keys/keyName), got: %v\", uri)\n\t}\n\tenginePath, keyName, err := engineAndKeyFromPath(u.RequestURI())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tu.Path = \"\"\n\treturn NewMasterKey(u.String(), enginePath, keyName), nil\n\n}\n\n// NewMasterKey creates a new MasterKey from a Vault address, Transit backend\n// path and a key name.\nfunc NewMasterKey(address, enginePath, keyName string) *MasterKey {\n\tkey := &MasterKey{\n\t\tVaultAddress: address,\n\t\tEnginePath:   enginePath,\n\t\tKeyName:      keyName,","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/hcvault/keysource.go#L160-L196","documentation":"NewMasterKeyFromURI parses a Vault key URI and requires a URL scheme such as https:// (hcvault/keysource.go:178). If the scheme is missing, the URI cannot be turned into a Vault address and this error is returned showing the original string.","triggerScenarios":"Calling NewMasterKeyFromURI / NewMasterKeysFromURIs (or sops parsing hc_vault entries in .sops.yaml / SOPS_VAULT_*) with a URI lacking 'https://' or 'http://', e.g. 'vault.example.com:8200/v1/transit/keys/keyname'.","commonSituations":"Writing the Vault address in .sops.yaml without the protocol prefix; stripping the scheme when templating configs; assuming the port suffix makes the scheme implicit.","solutions":["Prefix the URI with the scheme, normally https:// (or http:// for plaintext dev Vault)","Check the hc_vault entries in .sops.yaml and any SOPS_HC_VAULT_* env values for missing schemes","If the value comes from a template/variable, ensure the scheme is part of the substituted value, not appended around it"],"exampleFix":"// before (.sops.yaml)\n- hc_vault: vault.example.com:8200/v1/transit/keys/sops\n// after\n- hc_vault: https://vault.example.com:8200/v1/transit/keys/sops","handlingStrategy":"validation","validationCode":"// Go: ensure scheme before constructing the key\nu, err := url.Parse(raw)\nif err != nil || u.Scheme == \"\" {\n    return nil, fmt.Errorf(\"vault URI %q must start with https://\", raw)\n}\nkey, err := hcvault.NewMasterKeyFromURI(raw)","typeGuard":"func hasScheme(raw string) bool {\n    u, err := url.Parse(raw)\n    return err == nil && u.Scheme != \"\"\n}","tryCatchPattern":"key, err := hcvault.NewMasterKeyFromURI(uri)\nif err != nil && strings.Contains(err.Error(), \"missing scheme in Vault URL\") {\n    return fmt.Errorf(\"prefix %q with https://\", uri)\n}","preventionTips":["Always store full https:// URIs in .sops.yaml hc_vault entries","Validate vault URIs with url.Parse in config linting","Include the scheme in templates/variables, not around them","Match the format shown in the error: https://vault.example.com:8200/v1/transit/keys/keyName"],"tags":["vault","url-parsing","configuration"],"backgroundTag":"missing-url-scheme","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}