crowdsecurity/crowdsec · error

query parameter %s not found

Error message

query parameter %s not found

What it means

During security-scheme validation of an apiKey defined in the query string, the request's URL query is inspected for the scheme's parameter name. If no values are present, this error is returned because the required API key is missing from the request.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:254

				values := input.RequestValidationInput.Request.Header["Authorization"]
				if len(values) == 0 {
					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Bearer ") {
					return errors.New("authorization header does not start with 'Bearer '")
				}
				authTokenValue = values[0][7:]
			}
		case "apiKey":
			switch input.SecurityScheme.In {
			case "query":
				//Because we are checking for the presence of the API key, it probably does not matter if go drops parameters using ; as a separator
				values := input.RequestValidationInput.Request.URL.Query()[input.SecurityScheme.Name]
				if len(values) == 0 {
					return fmt.Errorf("query parameter %s not found", input.SecurityScheme.Name)
				}
				if len(values) > 1 {
					return fmt.Errorf("multiple query parameters with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "header":
				canonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)
				values := input.RequestValidationInput.Request.Header[canonicalHeaderName]
				if len(values) == 0 {
					return fmt.Errorf("header %s not found", input.SecurityScheme.Name)
				}
				if len(values) > 1 {
					return fmt.Errorf("multiple headers with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "cookie":
				cookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)
				if len(cookieValues) == 0 {

View on GitHub (pinned to 909b515798)

Solutions

1. Include the required query parameter (the API key) in the request URL.
2. Confirm the securityScheme Name in the OpenAPI spec matches the parameter name clients actually send.
3. Check for URL encoding issues that strip or mangle the query parameter.

Example fix

// before
defaultQuery := "/resource"
// after
defaultQuery := "/resource?api_key=<key>"

u, _ := url.Parse(target); if u.Query().Get("api_key") == "" { return errors.New("api_key query parameter required") }

err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), "query parameter") && strings.Contains(err.Error(), "not found") { return ErrMissingAPIKey } return err }

When it happens

Trigger: A request validated against an OpenAPI securityScheme with In: "query" lacks the named query parameter — URL.Query()[name] returns zero values at pkg/appsec/api_validation/api_validation.go:254.

Common situations: Client omits the API key query parameter; parameter name in the spec differs from what the client sends; URL parsing dropped the parameter.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

• auth token is required but not provided
• multiple query parameters with name %s found
• header %s not found
• cookie %s not found
• authorization header not found

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8b421637edf99285. Report an issue: GitHub.