{"record":{"id":"f4b24c919dfc4966","repo":"nats-io/nats-server","slug":"10052","errorCode":"10052","errorMessage":"stream configuration for create can not be sealed","messagePattern":"stream configuration for create can not be sealed","errorType":"error_code","errorClass":"JSStreamInvalidConfigError","httpStatus":500,"severity":"error","filePath":"server/jetstream_api.go","lineNumber":1515,"sourceCode":"\tsetStaticStreamMetadata(&cfg.StreamConfig)\n\n\tstreamName := streamNameFromSubject(subject)\n\tif streamName != cfg.Name {\n\t\tresp.Error = NewJSStreamMismatchError()\n\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(msg), s.jsonResponse(&resp))\n\t\treturn\n\t}\n\n\t// Check for path like separators in the name.\n\tif strings.ContainsAny(streamName, `\\/`) {\n\t\tresp.Error = NewJSStreamNameContainsPathSeparatorsError()\n\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(msg), s.jsonResponse(&resp))\n\t\treturn\n\t}\n\n\t// Can't create a stream with a sealed state.\n\tif cfg.Sealed {\n\t\tresp.Error = NewJSStreamInvalidConfigError(fmt.Errorf(\"stream configuration for create can not be sealed\"))\n\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(msg), s.jsonResponse(&resp))\n\t\treturn\n\t}\n\n\t// If we are told to do mirror direct but are not mirroring, error.\n\tif cfg.MirrorDirect && cfg.Mirror == nil {\n\t\tresp.Error = NewJSStreamInvalidConfigError(fmt.Errorf(\"stream has no mirror but does have mirror direct\"))\n\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(msg), s.jsonResponse(&resp))\n\t\treturn\n\t}\n\n\t// Hand off to cluster for processing.\n\tif s.JetStreamIsClustered() {\n\t\ts.jsClusteredStreamRequest(ci, acc, subject, reply, rmsg, &cfg)\n\t\treturn\n\t}\n\n\tif err := acc.jsNonClusteredStreamLimitsCheck(&cfg.StreamConfig); err != nil {","sourceCodeStart":1497,"sourceCodeEnd":1533,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jetstream_api.go#L1497-L1533","documentation":"Sealed is a terminal stream state: once sealed, a stream is immutable and can never accept new data or configuration. Creating a new stream with Sealed already set in the configuration is contradictory, so the JetStream API rejects it with JSStreamInvalidConfigError (API error code 10052) rather than creating a permanently write-blocked stream.","triggerScenarios":"Sending STREAM CREATE ($JS.API.STREAM.CREATE.<name>) with a config JSON where \"sealed\": true.","commonSituations":"Restoring/backing up scripts that dump full stream state (including sealed) and replay it as a create request; template code that serializes a sealed source stream's config to clone it.","solutions":["Remove `sealed: true` from the create request config; seal the stream later with an update after creation.","If cloning an existing sealed stream, strip the Sealed field before serializing the config.","Use the stream restore API ($JS.API.STREAM.RESTORE) rather than create when reconstructing archived streams."],"exampleFix":"// before\njson.Marshal(&StreamConfig{Name: \"x\", Sealed: true}) // create rejected\n// after\njson.Marshal(&StreamConfig{Name: \"x\"}) // create, then seal via update if needed","handlingStrategy":"validation","validationCode":"if cfg.Sealed {\n    return errors.New(\"cannot create a stream with sealed=true; seal after creation via update\")\n}","typeGuard":null,"tryCatchPattern":"// handle API error code 10052\nif jserr != nil && jserr.ErrorCode == 10052 {\n    // strip Sealed from config and retry create\n}","preventionTips":["Strip the Sealed field when cloning or restoring stream configs.","Seal streams with an update request after creation, never at create time.","Use STREAM.RESTORE for replaying archived stream state."],"tags":["jetstream","stream","api-error","sealed-stream"],"backgroundTag":"invalid-stream-config","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}