{"record":{"id":"d52c88cb6b128703","repo":"crowdsecurity/crowdsec","slug":"failed-to-force-pull-operation-w","errorCode":null,"errorMessage":"failed to force pull operation: %w","messagePattern":"failed to force pull operation: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/papi_cmd.go","lineNumber":243,"sourceCode":"\t\tp.apiClient.GetClient().Transport.(*apiclient.JWTTransport).ResetToken()\n\tcase \"force_pull\":\n\t\tdata, err := json.Marshal(message.Data)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tforcePullMsg := forcePull{}\n\n\t\tif err := json.Unmarshal(data, &forcePullMsg); err != nil {\n\t\t\treturn fmt.Errorf(\"message for '%s' contains bad data format: %w\", message.Header.OperationType, err)\n\t\t}\n\n\t\tif forcePullMsg.Blocklist == nil && forcePullMsg.Allowlist == nil {\n\t\t\tp.Logger.Infof(\"Received force_pull command from PAPI, pulling community, 3rd-party blocklists and allowlists\")\n\n\t\t\terr = p.apic.PullTop(ctx, true)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to force pull operation: %w\", err)\n\t\t\t}\n\t\t} else if forcePullMsg.Blocklist != nil {\n\t\t\terr = forcePullMsg.Blocklist.Validate(strfmt.Default)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"message for '%s' contains bad data format: %w\", message.Header.OperationType, err)\n\t\t\t}\n\n\t\t\tp.Logger.Infof(\"Received blocklist force_pull command from PAPI, pulling blocklist %s\", *forcePullMsg.Blocklist.Name)\n\n\t\t\terr = p.apic.PullBlocklist(ctx, &modelscapi.BlocklistLink{\n\t\t\t\tName:        forcePullMsg.Blocklist.Name,\n\t\t\t\tURL:         forcePullMsg.Blocklist.URL,\n\t\t\t\tRemediation: forcePullMsg.Blocklist.Remediation,\n\t\t\t\tScope:       forcePullMsg.Blocklist.Scope,\n\t\t\t\tDuration:    forcePullMsg.Blocklist.Duration,\n\t\t\t}, true)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to force pull operation: %w\", err)","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/papi_cmd.go#L225-L261","documentation":"When a force_pull command has neither blocklist nor allowlist set, ManagementCmd performs a full pull of community/3rd-party blocklists and allowlists via apic.PullTop. This error wraps any failure from that pull — typically CAPI connectivity issues, authentication failures, or errors fetching/validating the list files.","triggerScenarios":"Generic force_pull (empty payload) triggers apic.PullTop(ctx, true) which returns an error — CAPI unreachable, HTTP error, invalid API credentials, or failed download of blocklist files.","commonSituations":"Firewall or DNS blocking api.crowdsec.net; expired/invalid CAPI credentials needing re-enrollment; transient CAPI outage; TLS interception by corporate proxies.","solutions":["Check the wrapped cause: network errors point at connectivity, 4xx at credentials","Test connectivity: curl https://api.crowdsec.net from the host","Re-enroll with 'cscli console enroll <token>' if authentication is failing","Retry later if CAPI is having an outage; the pull happens again on the next force_pull or scheduled pull"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-check CAPI reachability before triggering pulls\nresp, err := http.Head(\"https://api.crowdsec.net\")\nif err != nil {\n    return fmt.Errorf(\"CAPI unreachable: %w\", err)\n}\nresp.Body.Close()","typeGuard":null,"tryCatchPattern":"if err := ManagementCmd(ctx, msg, p, false); err != nil {\n    if strings.Contains(err.Error(), \"failed to force pull\") {\n        log.Warnf(\"force pull failed, scheduling retry: %v\", err)\n        return schedulePullRetry(err)\n    }\n    return err\n}","preventionTips":["Allowlist api.crowdsec.net in egress firewalls/DNS filters","Keep the console enrollment current; re-enroll if credentials expire","Rely on scheduled pulls so a single failed force_pull is not fatal"],"tags":["crowdsec","capi","network","blocklists"],"backgroundTag":"upstream-api-error","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}