crowdsecurity/crowdsec · error

failed to get response: %w

Error message

failed to get response: %w

What it means

GetPermissions attempted the HTTP GET against the PAPI /permissions endpoint and the request itself failed at the transport level (httpClient.Do returned an error) — no HTTP response was received at all. This wraps the underlying net/http error, which distinguishes DNS failures, connection refused, TLS handshake errors, and timeouts. The permission-check flow cannot proceed without a response.

Source

Thrown at pkg/apiserver/papi.go:174

	if err != nil {
		return fmt.Errorf("'%s %s failed: %w", message.Header.OperationType, message.Header.OperationCmd, err)
	}

	return nil
}

func (p *Papi) GetPermissions(ctx context.Context) (PapiPermCheckSuccess, error) {
	httpClient := p.apiClient.GetClient()
	papiCheckURL := fmt.Sprintf("%s%s%s", p.URL, PAPIVersion, PAPIPermissionsURL)

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, papiCheckURL, http.NoBody)
	if err != nil {
		return PapiPermCheckSuccess{}, fmt.Errorf("failed to create request: %w", err)
	}

	resp, err := httpClient.Do(req)
	if err != nil {
		return PapiPermCheckSuccess{}, fmt.Errorf("failed to get response: %w", err)
	}

	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		errResp := PapiPermCheckError{}

		err = json.NewDecoder(resp.Body).Decode(&errResp)
		if err != nil {
			return PapiPermCheckSuccess{}, fmt.Errorf("failed to decode response: %w", err)
		}

		return PapiPermCheckSuccess{}, fmt.Errorf("unable to query PAPI : %s (%d)", errResp.Error, resp.StatusCode)
	}

	respBody := PapiPermCheckSuccess{}

	err = json.NewDecoder(resp.Body).Decode(&respBody)

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped error: it names DNS vs connection vs TLS vs timeout.
2. Test connectivity: `curl -v https://api.crowdsec.net/v1/permissions` from the same host.
3. Set proxy env vars (https_proxy/HTTPS_PROXY) if egress requires a proxy, then restart crowdsec.
4. Fix DNS or time sync (`timedatectl status`, resolv.conf) as indicated by the error.
5. Check config api.client.ca_cert_path / insecure_skip_verify if the wrapped error is a TLS x509 error.

// preflight reachability check before startup:
conn, err := net.DialTimeout("tcp", "api.crowdsec.net:443", 5*time.Second)
if err != nil { /* warn: CAPI unreachable, egress/proxy/DNS problem */ }

perms, err := papi.GetPermissions(ctx)
if err != nil {
    if strings.Contains(err.Error(), "failed to get response") {
        var netErr net.Error
        if errors.As(err, &netErr) && netErr.Timeout() {
            // retry with backoff; transient network issue
        }
    }
}

When it happens

Trigger: Called during PAPI permission querying when the machine cannot reach api.crowdsec.net (or the configured papi host): DNS resolution failure, blocked egress on 443, TLS trust issues (missing CA cert / clock skew), or proxy requirements not honored.

Common situations: Firewall or corporate proxy blocking outbound HTTPS to api.crowdsec.net; missing https_proxy env in containerized deployments; system clock skew breaking TLS; IPv6 breakage resolving the CAPI host.

Related errors

• errUnauthorized
• error querying range: %w
• querying range: %w
• error tailing logs: %w
• while performing request: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/370a78a4f6abd818. Report an issue: GitHub.