crowdsecurity/crowdsec · warning

cti is disabled

Error message

cti is disabled

What it means

ErrDisabled signals that CTI enrichment is disabled because no API key was configured (or the client is nil). InitCrowdsecCTI returns it when the key is absent/empty, and the CTI expr helpers return it for every lookup when CTIApiEnabled is false.

Source

Thrown at pkg/cticlient/client.go:26

	"io"
	"net/http"
	"strings"

	"github.com/crowdsecurity/crowdsec/pkg/apiclient/useragent"
	log "github.com/sirupsen/logrus"
)

const (
	CTIBaseUrl    = "https://cti.api.crowdsec.net/v2"
	smokeEndpoint = "/smoke"
	fireEndpoint  = "/fire"
)

var (
	ErrUnauthorized  = errors.New("unauthorized")
	ErrLimit         = errors.New("request quota exceeded, please reduce your request rate")
	ErrNotFound      = errors.New("ip not found")
	ErrDisabled      = errors.New("cti is disabled")
	ErrUnknown       = errors.New("unknown error")
	defaultUserAgent = useragent.Default()
)

type CrowdsecCTIClient struct {
	httpClient *http.Client
	apiKey     string
	Logger     *log.Entry
	UserAgent  string
}

func (c *CrowdsecCTIClient) doRequest(ctx context.Context, method string, endpoint string, params map[string]string) ([]byte, error) {
	url := CTIBaseUrl + endpoint
	if len(params) > 0 {
		url += "?"
		for k, v := range params {
			url += fmt.Sprintf("%s=%s&", k, v)
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Set a valid CTI API key in the crowdsec configuration (api.cti.api_key) or CTI_API_KEY env to enable CTI
2. Remove CTI functions (IpCTI etc.) from profiles/alert workflows if you don't use CTI
3. Handle errors.Is(err, cticlient.ErrDisabled) gracefully and skip enrichment

Example fix

// config.yaml before (CTI referenced but no key)
// after
api:
  cti:
    enabled: true
    key: <your-cti-api-key>

if cfg.CTI == nil || cfg.CTI.APIKey == "" { log.Warning("CTI disabled: no API key configured") }

func ctiEnabled(key *string) bool { return key != nil && *key != "" }

resp, err := cticlient.CrowdsecCTI(...)
if errors.Is(err, cticlient.ErrDisabled) {
    return &cticlient.SmokeItem{}, nil // skip enrichment silently
}

When it happens

Trigger: ctiexpr registration with an empty/missing api_key config; IpCTI/CTI expr function called while CTIApiEnabled is false (nil client).

Common situations: Deployments without a CrowdSec CTI subscription where profiles/alerts still reference CTI expr functions; CTI_API_KEY env var not set on the LAPI.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

• empty cti key
• unknown error
• compilation of '%s' failed: %w
• compilation of '%s' context value failed: %w
• loading CTI configuration: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c0355916a487adff. Report an issue: GitHub.