appsmithorg/appsmith · error · Error

The ${path} path must start with 'https://'.

Error message

The ${path} path must start with 'https://'.

What it means

Thrown by validateApiPath() in @appsmith/utils. The function is a strict guard: it returns the path only if it starts with the literal 'https://', otherwise it throws naming the offending path. It exists to force API/redirect paths onto a secure HTTPS origin.

Source

Thrown at app/client/packages/utils/src/validateApiPath/validateApiPath.ts:13

/**
 * Validates if the given path starts with "https://".
 * Throws an error if the path does not start with "https://".
 *
 * @param path - The path to validate.
 * @returns path if the path starts with "https://".
 * @throws Error if the path does not start with "https://".
 */
export const validateApiPath = (path: string): string => {
  if (path.startsWith("https://")) {
    return path;
  } else {
    throw new Error(`The ${path} path must start with 'https://'.`);
  }
};

View on GitHub (pinned to 8cd9021c24)

Solutions

1. Prefix the path with 'https://', e.g. 'https://api.example.com/v1'.
2. If a dev http origin is genuinely required, that is unsupported by this validator — coordinate with the API to expose HTTPS, or route through an HTTPS proxy.
3. Normalize the value upstream so it always carries the scheme before reaching validateApiPath().
4. Trim leading whitespace/newlines from the input before validating, since a leading space breaks startsWith.

Example fix

// before
validateApiPath('api.example.com/users')   // throws
validateApiPath('http://api.example.com/users') // throws

// after
validateApiPath('https://api.example.com/users') // returns the path

function ensureHttps(p: string): string {
  if (!p.startsWith('https://')) throw new Error(`Path must start with https://: ${p}`);
  return p;
}

const isHttpsUrl = (p: string): p is `https://${string}` =>
  typeof p === 'string' && p.startsWith('https://');

try { validateApiPath(path); } catch (e) {
  if (/must start with 'https:\/\//i.test(e.message)) path = `https://${path.replace(/^https?:?\/\/, '')}`;
  else throw e;
}

When it happens

Trigger: Passing a path that begins with 'http://', a protocol-relative '//host', a root-relative '/api', or a bare 'host/path' to validateApiPath(). Any value whose first 8 chars are not 'https://' throws.

Common situations: Configuring an API datasource or redirect with an HTTP URL; building a URL from a dynamic/env base that omitted the scheme; copying a URL that lost its protocol in editing; using a localhost dev URL over http.

Related errors

• error
• Please enter a target origin URL.
• resetWidget expected STRING for 'widgetName' argument but re
• PE-DSE-5003
• The certificate "${crtFile}" is invalid.\n${err.message}

AI-assisted analysis of appsmithorg/appsmith@8cd9021c24 (2026-08-12). Data as JSON: /api/errors/b774b0a5ab390a77. Report an issue: GitHub.