Invalid value for "-out"; valid values are [go-template, hcl

Error message

Invalid value for "-out"; valid values are [go-template, hcl, json, none, table]

What it means

VarGetCommand.validateOutputFlag validates -output against a fixed allowlist (go-template, hcl, json, none, table). Any other value falls through the switch default and returns this error listing the valid values.

Source

Thrown at command/var_get.go:214

		c.Ui.Warn(hint)
	}
	return 0
}

func (c *VarGetCommand) validateOutputFlag() error {
	if c.outFmt != "go-template" && c.tmpl != "" {
		return errors.New(errUnexpectedTemplate)
	}
	switch c.outFmt {
	case "hcl", "json", "none", "table":
		return nil
	case "go-template": //noop - needs more validation
		if c.tmpl == "" {
			return errors.New(errMissingTemplate)
		}
		return nil
	default:
		return errors.New(errInvalidOutFormat)
	}
}

func (c *VarGetCommand) GetConcurrentUI() cli.ConcurrentUi {
	return cli.ConcurrentUi{Ui: c.Ui}
}

View on GitHub (pinned to 482b49bf1a)

Solutions

Use one of: go-template, hcl, json, none, table (lowercase)
Fix the spelling/case of the -output value
Pipe json output through another tool if you need a different serialization

Example fix

// before
vault kv get -output=yaml secret/foo
// after
vault kv get -output=json secret/foo | jq .

Defensive patterns

Strategy: validation

Validate before calling

switch outFmt {
case "go-template", "hcl", "json", "none", "table":
	// ok
default:
	return fmt.Errorf("invalid -out %q; must be one of go-template,hcl,json,none,table", outFmt)
}

Try / catch

if err := cmd.validateOutputFlag(); err != nil {
	if strings.Contains(err.Error(), "Invalid value for \"-out\"") {
		// normalize/fix outFmt (e.g. lowercase, map yaml->json) and retry
	}
	return err
}

Prevention

Keep a shell completion/allowlist for -output values
Lowercase and trim the format value in wrapper scripts
Remember kv get accepts hcl/none but kv list does not

When it happens

Trigger: Running `vault kv get -output=yaml|csv|text <path>` or any misspelled/upper-cased format value.

Common situations: Typo in scripts (e.g. -output=JSON instead of json); assuming formats supported by other tools (yaml) are valid here; older scripts using deprecated format names.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

Related errors

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/983356226122950b. Report an issue: GitHub.