cloudflare/cloudflared · error

ErrBadRequest

ErrBadRequest

Error message

incorrect request parameters

What it means

ErrBadRequest is a sentinel error returned by statusCodeToError when the Cloudflare API responds with HTTP 400 (Bad Request), meaning the request parameters were malformed or invalid. The REST client maps that status to this error instead of the raw response body.

Source

Thrown at cfapi/base_client.go:25

	"io"
	"net/http"
	"net/url"
	"strings"
	"time"

	"github.com/pkg/errors"
	"github.com/rs/zerolog"
	"golang.org/x/net/http2"
)

const (
	defaultTimeout  = 15 * time.Second
	jsonContentType = "application/json"
)

var (
	ErrUnauthorized = errors.New("unauthorized")
	ErrBadRequest   = errors.New("incorrect request parameters")
	ErrNotFound     = errors.New("not found")
	ErrAPINoSuccess = errors.New("API call failed")
)

type RESTClient struct {
	baseEndpoints *baseEndpoints
	authToken     string
	userAgent     string
	client        http.Client
	log           *zerolog.Logger
}

type baseEndpoints struct {
	accountLevel  url.URL
	zoneLevel     url.URL
	accountRoutes url.URL
	accountVnets  url.URL
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Log/inspect the full API response body to get the specific Cloudflare error code (e.g. 1003, 7003).
2. Validate the identifiers being sent (tunnel ID format, account ID) before the call.
3. Upgrade cloudflared to the latest version so request payloads match the current API schema.
4. Fix the originating flags/config values that produced the malformed request.

Example fix

// before
tunnelID := cfg.TunnelID // "abc" (truncated)
// after
tunnelID := cfg.TunnelID // full 36-char UUID, validated with uuid.Parse before calling the API

_, err := uuid.Parse(tunnelID)
if err != nil {
    return fmt.Errorf("invalid tunnel ID %q: %w", tunnelID, err)
}

import "errors"

func IsBadRequest(err error) bool {
    return errors.Is(err, ErrBadRequest)
}

resp, err := client.GetTunnelConfiguration(ctx, accountID, connID)
if err != nil {
    if errors.Is(err, ErrBadRequest) {
        return fmt.Errorf("invalid request parameters, check IDs and payload: %w", err)
    }
    return err
}

When it happens

Trigger: Any cfapi REST call with invalid or missing query/body parameters: malformed tunnel IDs, invalid hostname configurations, bad JSON payloads, unknown route parameters, or values outside API-accepted ranges (HTTP 400 from api.cloudflare.com).

Common situations: Outdated cloudflared sending deprecated request fields the API now rejects, mistyped tunnel IDs in flags/config, invalid remote-managed configuration JSON, or version drift between the client's request schema and the API.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• ErrUnauthorized
• Create Tunnel API call failed
• failed to get checksums: {0}
• failed to upload checksum: {0}
• ErrAPINoSuccess

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/7358814e5d60cd58. Report an issue: GitHub.