crowdsecurity/crowdsec · error

no listen_uri or listen_socket specified

Error message

no listen_uri or listen_socket specified

What it means

LoadAPIServer configures the local API server but only when the DisableAPI flag is false. If the server is enabled yet defines neither api.server.listen_uri nor api.server.listen_socket, there is nothing to bind, so config loading fails with this error.

Source

Thrown at pkg/csconfig/api.go:369

	}

	if c.API.Server.Enable == nil {
		// if the option is not present, it is enabled by default
		c.API.Server.Enable = new(true)
	}

	if !*c.API.Server.Enable {
		log.Warning("crowdsec local API is disabled because 'enable' is set to false")

		c.DisableAPI = true
	}

	if c.DisableAPI {
		return nil
	}

	if c.API.Server.ListenURI == "" && c.API.Server.ListenSocket == "" {
		return errors.New("no listen_uri or listen_socket specified")
	}

	if c.API.Server.OnlineClient != nil && c.API.Server.OnlineClient.CredentialsFilePath != "" && !skipOnlineCreds {
		if err := c.API.Server.OnlineClient.Load(); err != nil {
			return fmt.Errorf("loading online client credentials: %w", err)
		}
	}

	if (c.API.Server.OnlineClient == nil || c.API.Server.OnlineClient.Credentials == nil) && !inCli {
		log.Info("push and pull to Central API disabled")
	}

	// Set default values for CAPI push/pull
	if c.API.Server.OnlineClient != nil {
		if c.API.Server.OnlineClient.PullConfig.Community == nil {
			c.API.Server.OnlineClient.PullConfig.Community = new(true)
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Set api.server.listen_uri (e.g. 127.0.0.1:8080) or api.server.listen_socket (e.g. /run/crowdsec/lapi.sock)
2. If the API is not wanted, set api.server.disable_api: true (or enable only the client side)
3. Restore the default config.yaml from the distribution package if it was accidentally emptied

Example fix

// before
api:
  server:
    listen_uri: ""
// after
api:
  server:
    listen_uri: 127.0.0.1:8080

if !cfg.API.Server.DisableAPI && cfg.API.Server.ListenURI == "" && cfg.API.Server.ListenSocket == "" {
    cfg.API.Server.ListenURI = "127.0.0.1:8080" // or fail fast before LoadAPIServer
}
if err := cfg.LoadAPIServer(false); err != nil { ... }

if err := cfg.LoadAPIServer(skipOnlineCreds); err != nil {
    return fmt.Errorf("api server config: %w", err)
}

When it happens

Trigger: Running the LAPI (e.g. via _lapi / crowdsec with api.server enabled) where config.yaml has api.server with empty listen_uri and no listen_socket; explicitly setting api.server.listen_uri: '' while disabling the socket.

Common situations: Hand-edited config that removed the default listen_uri 127.0.0.1:8080; container images where the default config was partially stripped; users intending to disable the API by blanking the listen address instead of using disable_api: true.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• empty cti key
• no API client section in configuration
• missing token value for api.server.auto_register
• missing allowed_ranges value for api.server.auto_register
• while parsing agents cert auto-delete duration: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f4e92690c07928bf. Report an issue: GitHub.