crowdsecurity/crowdsec · error

failed to force pull operation: %w

Error message

failed to force pull operation: %w

What it means

When a force_pull command has neither blocklist nor allowlist set, ManagementCmd performs a full pull of community/3rd-party blocklists and allowlists via apic.PullTop. This error wraps any failure from that pull — typically CAPI connectivity issues, authentication failures, or errors fetching/validating the list files.

Source

Thrown at pkg/apiserver/papi_cmd.go:243

		p.apiClient.GetClient().Transport.(*apiclient.JWTTransport).ResetToken()
	case "force_pull":
		data, err := json.Marshal(message.Data)
		if err != nil {
			return err
		}

		forcePullMsg := forcePull{}

		if err := json.Unmarshal(data, &forcePullMsg); err != nil {
			return fmt.Errorf("message for '%s' contains bad data format: %w", message.Header.OperationType, err)
		}

		if forcePullMsg.Blocklist == nil && forcePullMsg.Allowlist == nil {
			p.Logger.Infof("Received force_pull command from PAPI, pulling community, 3rd-party blocklists and allowlists")

			err = p.apic.PullTop(ctx, true)
			if err != nil {
				return fmt.Errorf("failed to force pull operation: %w", err)
			}
		} else if forcePullMsg.Blocklist != nil {
			err = forcePullMsg.Blocklist.Validate(strfmt.Default)
			if err != nil {
				return fmt.Errorf("message for '%s' contains bad data format: %w", message.Header.OperationType, err)
			}

			p.Logger.Infof("Received blocklist force_pull command from PAPI, pulling blocklist %s", *forcePullMsg.Blocklist.Name)

			err = p.apic.PullBlocklist(ctx, &modelscapi.BlocklistLink{
				Name:        forcePullMsg.Blocklist.Name,
				URL:         forcePullMsg.Blocklist.URL,
				Remediation: forcePullMsg.Blocklist.Remediation,
				Scope:       forcePullMsg.Blocklist.Scope,
				Duration:    forcePullMsg.Blocklist.Duration,
			}, true)
			if err != nil {
				return fmt.Errorf("failed to force pull operation: %w", err)

View on GitHub (pinned to 909b515798)

Solutions

1. Check the wrapped cause: network errors point at connectivity, 4xx at credentials
2. Test connectivity: curl https://api.crowdsec.net from the host
3. Re-enroll with 'cscli console enroll <token>' if authentication is failing
4. Retry later if CAPI is having an outage; the pull happens again on the next force_pull or scheduled pull

// pre-check CAPI reachability before triggering pulls
resp, err := http.Head("https://api.crowdsec.net")
if err != nil {
    return fmt.Errorf("CAPI unreachable: %w", err)
}
resp.Body.Close()

if err := ManagementCmd(ctx, msg, p, false); err != nil {
    if strings.Contains(err.Error(), "failed to force pull") {
        log.Warnf("force pull failed, scheduling retry: %v", err)
        return schedulePullRetry(err)
    }
    return err
}

When it happens

Trigger: Generic force_pull (empty payload) triggers apic.PullTop(ctx, true) which returns an error — CAPI unreachable, HTTP error, invalid API credentials, or failed download of blocklist files.

Common situations: Firewall or DNS blocking api.crowdsec.net; expired/invalid CAPI credentials needing re-enrollment; transient CAPI outage; TLS interception by corporate proxies.

Related errors

• token not found in DB
• unable to parse token
• token missing required claim
• token expired
• while performing request: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d52c88cb6b128703. Report an issue: GitHub.