{"id":"69b67bb264034efd","repo":"mongodb/node-mongodb-native","slug":"status-code-response-status-returned-from-the-g","errorCode":null,"errorMessage":"Status code ${response.status} returned from the GCP endpoint. Response body: ${response.body}","messagePattern":"Status code (.+?) returned from the GCP endpoint\\. Response body: (.+?)","errorType":"exception","errorClass":"MongoGCPError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts","lineNumber":41,"sourceCode":"): Promise<OIDCResponse> => {\n  const tokenAudience = params.tokenAudience;\n  if (!tokenAudience) {\n    throw new MongoGCPError(TOKEN_RESOURCE_MISSING_ERROR);\n  }\n  return await getGcpTokenData(tokenAudience);\n};\n\n/**\n * Hit the GCP endpoint to get the token data.\n */\nasync function getGcpTokenData(tokenAudience: string): Promise<OIDCResponse> {\n  const url = new URL(GCP_BASE_URL);\n  url.searchParams.append('audience', tokenAudience);\n  const response = await get(url, {\n    headers: GCP_HEADERS\n  });\n  if (response.status !== 200) {\n    throw new MongoGCPError(\n      `Status code ${response.status} returned from the GCP endpoint. Response body: ${response.body}`\n    );\n  }\n  return { accessToken: response.body };\n}\n","sourceCodeStart":23,"sourceCodeEnd":47,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts#L23-L47","documentation":"Thrown by the GCP machine workflow when the GCP metadata service returns an HTTP status other than 200 (src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts:40). The error includes the status code and response body. The driver requests http://metadata/computeMetadata/v1/instance/service-accounts/default/identity?audience=<TOKEN_RESOURCE> with the Metadata-Flavor: Google header. Surfaced as a MongoGCPError.","triggerScenarios":"The GCP metadata request returns non-200 - e.g. 403/404 when no service account is attached, 400 for an invalid audience, or any error when the workload is not running on GCE/GKE.","commonSituations":"The compute instance has no default service account, the service account lacks permission to mint tokens for the requested audience, the workload runs outside GCP (so 'metadata' does not resolve), or a network policy blocks the metadata endpoint.","solutions":["Read the response body in the error to see GCP's explanation.","Ensure the GCE instance or GKE node has a service account attached with the appropriate scopes (cloud-platform).","Confirm the TOKEN_RESOURCE audience is valid and permitted for the service account.","If not on GCP, switch ENVIRONMENT to the correct provider."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoGCPError && /Status code \\d+ returned from the GCP endpoint/.test(e.message)) {\n    // Inspect e.message for the GCP response body, verify service account and audience\n    log.error('GCP metadata token error', e.message);\n  }\n  throw e;\n}","preventionTips":["Ensure the GCE/GKE node has a service account with the cloud-platform scope.","Pre-flight: curl the metadata token endpoint with the configured audience.","Confirm the TOKEN_RESOURCE audience matches the MongoDB server configuration."],"tags":["auth","oidc","gcp","service-account","http-error"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}