{"record":{"id":"d646941ff30a2ad3","repo":"crowdsecurity/crowdsec","slug":"failed-to-create-router-for-schema-ref-s-w","errorCode":null,"errorMessage":"failed to create router for schema ref %s: %w","messagePattern":"failed to create router for schema ref (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":340,"sourceCode":"\tloader := openapi3.NewLoader()\n\trv.loaders[ref] = loader\n\n\tdoc, err := loader.LoadFromData([]byte(schema))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to load schema %s: %w\", ref, err)\n\t}\n\n\t// Is it a valid OpenAPI schema?\n\t// TODO: look into opts, should we expose some of them to the user ?\n\tif err := doc.Validate(loader.Context, openapi3.DisableExamplesValidation()); err != nil {\n\t\treturn fmt.Errorf(\"failed to validate schema %s: %w\", ref, err)\n\t}\n\n\trv.warnUnsupportedSecuritySchemes(ref, doc, options.OnUnsupportedSecurityScheme)\n\n\trouter, err := legacyrouter.NewRouter(doc)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create router for schema ref %s: %w\", ref, err)\n\t}\n\n\trv.openAPISchemas[ref] = SchemaData{\n\t\tSchema:  doc,\n\t\tRouter:  router,\n\t\tOptions: options,\n\t}\n\n\trv.logger.Infof(\"loaded schema for ref %s\", ref)\n\treturn nil\n}\n\nfunc (rv *RequestValidator) ValidateRequest(ctx context.Context, ref string, r *http.Request) error {\n\tschemaData, exists := rv.openAPISchemas[ref]\n\tif !exists {\n\t\treturn fmt.Errorf(\"%w: no schema loaded for ref %s\", ErrInvalidSchemaName, ref)\n\t}\n","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L322-L358","documentation":"After the schema validates, LoadSchema builds a route-matching router from the document (openapi3 legacyrouter.NewRouter). If the router cannot be constructed — typically duplicate or conflicting path templates that make routing ambiguous — the error is wrapped as \"failed to create router for schema ref <ref>: ...\" and the schema is not registered.","triggerScenarios":"Loading a spec whose paths contain duplicate route patterns (e.g. '/items/{id}' and '/items/{name}' — same shape, different parameter names), which legacyrouter rejects as ambiguous.","commonSituations":"Merged/auto-generated specs where two path entries differ only in parameter name; generated clients emitting conflicting routes; concatenating specs from multiple services into one document.","solutions":["Read the wrapped router error: it names the conflicting paths — rename parameters so identical-shaped paths use the same parameter name.","Remove or merge duplicate path entries that differ only by parameter name.","Restructure genuinely distinct routes so their templates don't collide (e.g. '/items/by-name/{name}').","If the spec is generated, fix the generator's path naming instead of patching the output."],"exampleFix":"// before\npaths:\n  /items/{id}:\n    get: ...\n  /items/{name}:\n    get: ...   # conflicts with /items/{id}\n\n// after\npaths:\n  /items/{id}:\n    get: ...","handlingStrategy":"try-catch","validationCode":"// detect ambiguous duplicate path shapes before LoadSchema\nseen := map[string]string{}\nfor path := range doc.Paths {\n    key := normalizeParams(path) // e.g. /items/{id} and /items/{name} -> /items/{}\n    if prev, dup := seen[key]; dup {\n        return fmt.Errorf(\"conflicting paths %q and %q\", prev, path)\n    }\n    seen[key] = path\n}","typeGuard":null,"tryCatchPattern":"if err := rv.LoadSchema(ref, schema, opts); err != nil {\n    if strings.Contains(err.Error(), \"failed to create router\") {\n        log.Errorf(\"fix conflicting path templates in %s: %v\", ref, err)\n    }\n    return err\n}","preventionTips":["Use the same parameter name for paths with identical shapes","Don't merge multiple services' paths into a single spec blindly","Build the router in a test (legacyrouter.NewRouter) as part of CI"],"tags":["openapi","router","appsec","conflict"],"backgroundTag":"invalid-argument-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}