hashicorp/nomad · error

failed to create HTTP request for Vault API URL=%q: %w

Error message

failed to create HTTP request for Vault API URL=%q: %w

What it means

This error is thrown by the `collectVault` step of `nomad operator debug` when constructing the HTTP GET request to the Vault health endpoint (`/v1/sys/health`) fails inside http.NewRequest. Because the URL string and method are fixed, this almost always means the Vault address string itself is malformed (e.g. contains control characters or an unparseable URL). Nomad wraps the underlying net/url error so you can see both the offending address and the parse failure.

Source

Thrown at command/operator_debug.go:1381

// collectVault calls the Vault API directly to collect data
func (c *OperatorDebugCommand) collectVault(dir, vault string) error {
	vaultAddr := c.vault.addr(vault)
	if vaultAddr == "" {
		return nil
	}

	c.Ui.Info(fmt.Sprintf("Vault - Collecting Vault API data from: %s", vaultAddr))
	client := defaultHttpClient()
	if c.vault.ssl {
		err := api.ConfigureTLS(client, c.vault.tls)
		if err != nil {
			return fmt.Errorf("failed to configure TLS: %w", err)
		}
	}

	req, err := http.NewRequest(http.MethodGet, vaultAddr+"/v1/sys/health", nil)
	if err != nil {
		return fmt.Errorf("failed to create HTTP request for Vault API URL=%q: %w", vaultAddr, err)
	}

	req.Header.Add("X-Vault-Token", c.vault.token())
	req.Header.Add("User-Agent", userAgent)
	resp, err := client.Do(req)
	c.writeBody(dir, "vault-sys-health.json", resp, err)

	return nil
}

// writeBytes writes a file to the archive, recording it in the manifest
func (c *OperatorDebugCommand) writeBytes(dir, file string, data []byte) error {
	// Replace invalid characters in filename
	filename := helper.CleanFilename(file, "_")

	relativePath := filepath.Join(dir, filename)
	c.manifest = append(c.manifest, relativePath)
	dirPath := filepath.Join(c.collectDir, dir)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check the Vault address passed via -vault-address or VAULT_ADDR for stray whitespace, newlines, or invalid characters and correct it.
2. Verify the address has a valid scheme, e.g. `http://127.0.0.1:8200` or `https://vault.service.consul:8200`.
3. Test the URL parses: run `url.Parse` on it in a snippet or simply open the address + `/v1/sys/health` in curl.
4. Re-run `nomad operator debug` after fixing the address; note the debug bundle will be missing vault-sys-health.json until then.

Example fix

// before
export VAULT_ADDR="http://vault:8200\n"
// after
export VAULT_ADDR="http://vault:8200"

u, err := url.Parse(os.Getenv("VAULT_ADDR"))
if err != nil || u.Scheme == "" || u.Host == "" {
    return fmt.Errorf("invalid VAULT_ADDR %q: %w", os.Getenv("VAULT_ADDR"), err)
}
if strings.TrimSpace(u.String()) != u.String() {
    return fmt.Errorf("VAULT_ADDR contains whitespace")
}

When it happens

Trigger: Running `nomad operator debug` with a `-vault-address` (or VAULT_ADDR environment variable) that cannot be parsed as a URL — e.g. contains spaces, a newline, an invalid scheme, or control characters. Any http.NewRequest failure on vaultAddr+"/v1/sys/health".

Common situations: VAULT_ADDR set with a trailing newline or stray whitespace from a config file or secret manager; address copied with spaces; VAULT_ADDR left empty/unset in a way that produces an invalid URL; typo like 'http:/vault:8200' (single slash).

Related errors

• invalid digest format
• unsupported checksum format
• Nomad Enterprise only endpoint
• Unknown log level
• secret path cannot contain template delimiters or parenthesi

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/8dae5680384d16a5. Report an issue: GitHub.