hashicorp/nomad · error

errMissingACLBindingRuleID

errMissingACLBindingRuleID

Error message

missing ACL binding rule ID

What it means

errMissingACLBindingRuleID is a shared sentinel error used by ACLBindingRules.Update, Delete, and Get when the required binding rule ID is an empty string. Binding rule IDs are used in the request path (/v1/acl/binding-rule/<id>), so the client rejects empty values locally before any HTTP request.

Source

Thrown at api/acl.go:253

	}
	if resp == nil {
		return nil, nil, errors.New("no ACL token returned")
	}
	return resp.Token, wm, nil
}

var (
	// errMissingACLRoleID is the generic errors to use when a call is missing
	// the required ACL Role ID parameter.
	errMissingACLRoleID = errors.New("missing ACL role ID")

	// errMissingACLAuthMethodName is the generic error to use when a call is
	// missing the required ACL auth-method name parameter.
	errMissingACLAuthMethodName = errors.New("missing ACL auth-method name")

	// errMissingACLBindingRuleID is the generic error to use when a call is
	// missing the required ACL binding rule ID parameter.
	errMissingACLBindingRuleID = errors.New("missing ACL binding rule ID")
)

// ACLRoles is used to query the ACL Role endpoints.
type ACLRoles struct {
	client *Client
}

// ACLRoles returns a new handle on the ACL roles API client.
func (c *Client) ACLRoles() *ACLRoles {
	return &ACLRoles{client: c}
}

// List is used to detail all the ACL roles currently stored within state.
func (a *ACLRoles) List(q *QueryOptions) ([]*ACLRoleListStub, *QueryMeta, error) {
	var resp []*ACLRoleListStub
	qm, err := a.client.query("/v1/acl/roles", &resp, q)
	if err != nil {
		return nil, nil, err

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set bindingRule.ID to the rule's UUID before calling Update (list rules via ACLBindingRules.List and match by selector/method to find it).
2. Pass the actual rule UUID, not the auth-method name, to Delete/Get.
3. Validate the ID is non-empty in your caller before invoking these methods.

Example fix

// before
rule := &api.ACLBindingRule{AuthMethod: "kubernetes", BindType: "service", BindName: "web"}
_, _, err := client.ACL().BindingRules().Update(rule, nil)
// after
rules, _, err := client.ACL().BindingRules().List(nil)
// find the rule, set its ID
for _, r := range rules {
    if r.AuthMethod == "kubernetes" {
        rule.ID = r.ID
        break
    }
}
_, _, err = client.ACL().BindingRules().Update(rule, nil)

if rule == nil || rule.ID == "" {
    return fmt.Errorf("ACL binding rule ID is required for update/delete/get")
}

func hasBindingRuleID(r *api.ACLBindingRule) bool { return r != nil && r.ID != "" }

When it happens

Trigger: ACLBindingRules.Update(rule) with rule.ID == ""; ACLBindingRules.Delete(""); ACLBindingRules.Get("") — any binding-rule call with an empty ID.

Common situations: Creating an ACLBindingRule struct (only AuthMethod/Selector/BindType set) and then passing it to Update without an ID; copying code from a Create path to an Update path; reading the rule ID from an empty config value.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• errMissingACLRoleID
• errMissingACLAuthMethodName
• cannot specify ACL role ID
• missing ACL role name
• bind name should be empty

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c87d0c039ace7ea2. Report an issue: GitHub.