crowdsecurity/crowdsec · error

while creating default client: %w

Error message

while creating default client: %w

What it means

UpdateAllowlists wraps failures from apiclient.NewDefaultClient, which builds a plain HTTP client (no JWT auth) used to fetch allowlists from CAPI. The constructor fails mainly when the BaseURL cannot be parsed into a valid http.Request (url.Parse failure). It is a setup-stage error, not a network call failure.

Source

Thrown at pkg/apiserver/apic.go:799

		err = a.dbClient.UpdateAllowlistMeta(ctx, *link.ID, *link.Name, description)
		if err != nil {
			return fmt.Errorf("while updating allowlist meta %s: %s", *link.Name, err)
		}
	}

	log.Infof("Allowlist %s updated", *link.Name)

	return nil
}

func (a *apic) UpdateAllowlists(ctx context.Context, allowlistsLinks []*modelscapi.AllowlistLink, forcePull bool) error {
	if len(allowlistsLinks) == 0 {
		return nil
	}

	client, err := apiclient.NewDefaultClient(a.apiClient.BaseURL, "", "", nil)
	if err != nil {
		return fmt.Errorf("while creating default client: %w", err)
	}

	for _, link := range allowlistsLinks {
		if err := a.updateOneAllowlist(ctx, client, link); err != nil {
			log.Errorf("updating allowlists from CAPI: %s", err)
		}
	}

	return nil
}

// if decisions is whitelisted: return representation of the whitelist ip or cidr
// if not whitelisted: empty string
func (a *apic) whitelistedBy(decision *models.Decision, additionalIPs []netip.Addr, additionalRanges []netip.Prefix) string {
	if decision.Value == nil {
		return ""
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Check `cscli capi status` and the api_url/api.client settings in your crowdsec.yaml; fix the BaseURL value.
2. Validate the URL parses: run `url.Parse` equivalent or simply open the URL in curl to confirm format.
3. If behind a proxy, verify HTTP_PROXY/HTTPS_PROXY do not corrupt the configured URL.
4. If the error persists, restart with the default config to isolate a bad override.

Example fix

// before (bad config)
api_url: "capi .crowdsec.net"
// after
api_url: "https://api.crowdsec.net/"

if u, err := url.Parse(baseURL); err != nil || u.Scheme == "" || u.Host == "" {
    return fmt.Errorf("invalid base URL %q: %w", baseURL, err)
}

When it happens

Trigger: PullTop or PullAllowlist runs after CAPI pull and returns allowlistsLinks; a.apiClient.BaseURL is malformed/unparseable (e.g. wrong --api-url or CAPI url config) so NewDefaultClient errors when constructing the request URL.

Common situations: Misconfigured api_url / capi_url in crowdsec.yaml (typo, missing scheme, trailing junk), proxy env or custom config overriding BaseURL, or template/flag substitution producing an empty or invalid URL.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• missing lapi client credentials
• no appsec_config provided
• missing TLS key file
• missing TLS cert file
• group_name is mandatory for CloudwatchSource

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/729402fc7f59cbb6. Report an issue: GitHub.