{"record":{"id":"d956bc74346f0a33","repo":"nats-io/nats-server","slug":"could-not-fetch-q-v","errorCode":null,"errorMessage":"could not fetch <%q>: %v","messagePattern":"could not fetch <%q>: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4249,"sourceCode":"\t// We create our own transport to amortize TLS.\n\ttr := &http.Transport{\n\t\tMaxIdleConns:    10,\n\t\tIdleConnTimeout: 30 * time.Second,\n\t}\n\tur := &URLAccResolver{\n\t\turl: url,\n\t\tc:   &http.Client{Timeout: DEFAULT_ACCOUNT_FETCH_TIMEOUT, Transport: tr},\n\t}\n\treturn ur, nil\n}\n\n// Fetch will fetch the account jwt claims from the base url, appending the\n// account name onto the end.\nfunc (ur *URLAccResolver) Fetch(name string) (string, error) {\n\turl := ur.url + name\n\tresp, err := ur.c.Get(url)\n\tif err != nil {\n\t\treturn _EMPTY_, fmt.Errorf(\"could not fetch <%q>: %v\", redactURLString(url), err)\n\t} else if resp == nil {\n\t\treturn _EMPTY_, fmt.Errorf(\"could not fetch <%q>: no response\", redactURLString(url))\n\t}\n\tdefer resp.Body.Close()\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn _EMPTY_, fmt.Errorf(\"could not fetch <%q>: %v\", redactURLString(url), resp.Status)\n\t}\n\tbody, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn _EMPTY_, err\n\t}\n\treturn string(body), nil\n}\n\n// Resolver based on nats for synchronization and backing directory for storage.\ntype DirAccResolver struct {\n\t*DirJWTStore\n\t*Server","sourceCodeStart":4231,"sourceCodeEnd":4267,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4231-L4267","documentation":"URLAccResolver.Fetch performs an HTTP GET against the resolver URL plus the account nkey. If the HTTP client's Get returns a transport-level error (DNS failure, connection refused, TLS error, timeout), the resolver returns this error with the redacted URL and underlying cause.","triggerScenarios":"Calling Fetch (directly or via fetchAccount) when the resolver HTTP endpoint is down, unreachable, misconfigured (wrong host/port/scheme), or the network path is broken (firewall, DNS).","commonSituations":"Resolver URL points to a JWT downloader service that is not running; wrong 'resolver: URL(...)' in server config; TLS certificate issues; network partition between nats-server and the account JWT server.","solutions":["Verify the resolver URL is correct and the HTTP service is up (curl the URL + account key)","Fix DNS/firewall/TLS issues indicated by the wrapped underlying error","Check nats-server resolver config matches the actual endpoint"],"exampleFix":"// before\nresolver: URL(http://jwt-service:9090/) // service down\n// after\n# ensure service is running and reachable\ncurl http://jwt-service:9090/AB25...KEY\nresolver: URL(http://jwt-service:9090/)","handlingStrategy":"retry","validationCode":"resp, err := http.Get(resolverURL + accountKey)\nif err != nil {\n    return fmt.Errorf(\"account server unreachable before fetch: %w\", err)\n}\nresp.Body.Close()\n","typeGuard":null,"tryCatchPattern":"jwt, err := fetchAccount(resolver, key)\nif err != nil && strings.Contains(err.Error(), \"could not fetch\") {\n    // retry with backoff; check endpoint health\n}\n","preventionTips":["Health-check the JWT HTTP endpoint before starting the server","Use stable DNS/service discovery for the resolver URL","Monitor connectivity and TLS between server and account service"],"tags":["nats-server","http","account-resolver","network"],"backgroundTag":"http-request-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}