{"record":{"id":"8dae5680384d16a5","repo":"hashicorp/nomad","slug":"failed-to-create-http-request-for-vault-api-url-q","errorCode":null,"errorMessage":"failed to create HTTP request for Vault API URL=%q: %w","messagePattern":"failed to create HTTP request for Vault API URL=%q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/operator_debug.go","lineNumber":1381,"sourceCode":"// collectVault calls the Vault API directly to collect data\nfunc (c *OperatorDebugCommand) collectVault(dir, vault string) error {\n\tvaultAddr := c.vault.addr(vault)\n\tif vaultAddr == \"\" {\n\t\treturn nil\n\t}\n\n\tc.Ui.Info(fmt.Sprintf(\"Vault - Collecting Vault API data from: %s\", vaultAddr))\n\tclient := defaultHttpClient()\n\tif c.vault.ssl {\n\t\terr := api.ConfigureTLS(client, c.vault.tls)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to configure TLS: %w\", err)\n\t\t}\n\t}\n\n\treq, err := http.NewRequest(http.MethodGet, vaultAddr+\"/v1/sys/health\", nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create HTTP request for Vault API URL=%q: %w\", vaultAddr, err)\n\t}\n\n\treq.Header.Add(\"X-Vault-Token\", c.vault.token())\n\treq.Header.Add(\"User-Agent\", userAgent)\n\tresp, err := client.Do(req)\n\tc.writeBody(dir, \"vault-sys-health.json\", resp, err)\n\n\treturn nil\n}\n\n// writeBytes writes a file to the archive, recording it in the manifest\nfunc (c *OperatorDebugCommand) writeBytes(dir, file string, data []byte) error {\n\t// Replace invalid characters in filename\n\tfilename := helper.CleanFilename(file, \"_\")\n\n\trelativePath := filepath.Join(dir, filename)\n\tc.manifest = append(c.manifest, relativePath)\n\tdirPath := filepath.Join(c.collectDir, dir)","sourceCodeStart":1363,"sourceCodeEnd":1399,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/operator_debug.go#L1363-L1399","documentation":"This error is thrown by the `collectVault` step of `nomad operator debug` when constructing the HTTP GET request to the Vault health endpoint (`/v1/sys/health`) fails inside http.NewRequest. Because the URL string and method are fixed, this almost always means the Vault address string itself is malformed (e.g. contains control characters or an unparseable URL). Nomad wraps the underlying net/url error so you can see both the offending address and the parse failure.","triggerScenarios":"Running `nomad operator debug` with a `-vault-address` (or VAULT_ADDR environment variable) that cannot be parsed as a URL — e.g. contains spaces, a newline, an invalid scheme, or control characters. Any http.NewRequest failure on vaultAddr+\"/v1/sys/health\".","commonSituations":"VAULT_ADDR set with a trailing newline or stray whitespace from a config file or secret manager; address copied with spaces; VAULT_ADDR left empty/unset in a way that produces an invalid URL; typo like 'http:/vault:8200' (single slash).","solutions":["Check the Vault address passed via -vault-address or VAULT_ADDR for stray whitespace, newlines, or invalid characters and correct it.","Verify the address has a valid scheme, e.g. `http://127.0.0.1:8200` or `https://vault.service.consul:8200`.","Test the URL parses: run `url.Parse` on it in a snippet or simply open the address + `/v1/sys/health` in curl.","Re-run `nomad operator debug` after fixing the address; note the debug bundle will be missing vault-sys-health.json until then."],"exampleFix":"// before\nexport VAULT_ADDR=\"http://vault:8200\\n\"\n// after\nexport VAULT_ADDR=\"http://vault:8200\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(os.Getenv(\"VAULT_ADDR\"))\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n    return fmt.Errorf(\"invalid VAULT_ADDR %q: %w\", os.Getenv(\"VAULT_ADDR\"), err)\n}\nif strings.TrimSpace(u.String()) != u.String() {\n    return fmt.Errorf(\"VAULT_ADDR contains whitespace\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set VAULT_ADDR with an explicit scheme and no trailing whitespace/newline.","Trim address strings loaded from files or secret managers before use.","Validate addresses with url.Parse in configuration tooling before invoking debug commands."],"tags":["vault","http","url-parsing","debug"],"backgroundTag":"malformed-url","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}