hashicorp/nomad · error

Payload provided but forbidden by parameterized job

Error message

Payload provided but forbidden by parameterized job

What it means

The inverse of the required-payload check: if the job declares payload = "forbidden" but the dispatch request includes a non-empty payload, Dispatch rejects it because a forbidden-payload job cannot accept input data.

Source

Thrown at nomad/job_endpoint.go:2138

	reply.Index = jobCreateIndex

	if eval != nil {
		reply.EvalID = eval.ID
		reply.EvalCreateIndex = jobCreateIndex
	}

	return nil
}

// validateDispatchRequest returns whether the request is valid given the
// parameterized job.
func validateDispatchRequest(req *structs.JobDispatchRequest, job *structs.Job, config *Config) error {
	// Check the payload constraint is met
	hasInputData := len(req.Payload) != 0
	if job.ParameterizedJob.Payload == structs.DispatchPayloadRequired && !hasInputData {
		return fmt.Errorf("Payload is not provided but required by parameterized job")
	} else if job.ParameterizedJob.Payload == structs.DispatchPayloadForbidden && hasInputData {
		return fmt.Errorf("Payload provided but forbidden by parameterized job")
	}

	// Check the payload doesn't exceed the size limit
	if l := len(req.Payload); l > DispatchPayloadSizeLimit {
		return fmt.Errorf("Payload exceeds maximum size; %d > %d", l, DispatchPayloadSizeLimit)
	}

	// Check if the metadata is a set
	keys := make(map[string]struct{}, len(req.Meta))
	for k := range req.Meta {
		if _, ok := keys[k]; ok {
			return fmt.Errorf("Duplicate key %q in passed metadata", k)
		}
		keys[k] = struct{}{}
	}

	required := set.From(job.ParameterizedJob.MetaRequired)
	optional := set.From(job.ParameterizedJob.MetaOptional)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Remove the payload from the dispatch call (no stdin pipe)
2. If payload is actually needed, change the job spec to `payload = "required"` or "optional" and resubmit
3. Audit automation to conditionally send payloads based on the job's declared constraint

Example fix

// before
echo '{"x":1}' | nomad job dispatch batch-process
// after (job forbids payload)
nomad job dispatch batch-process

if *job.ParameterizedJob.Payload == "forbidden" && len(payload) > 0 {
    return fmt.Errorf("job %s forbids payloads", jobID)
}

When it happens

Trigger: Dispatching a parameterized job with `parameterized { payload = "forbidden" }` while sending a non-empty Payload (e.g. piping stdin into `nomad job dispatch`).

Common situations: Scripts with unconditional `echo data | nomad job dispatch` reused across jobs; job spec changed to forbidden while callers still send payloads; clients defaulting to attaching a payload.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Payload is not provided but required by parameterized job
• Payload exceeds maximum size; %d > %d
• Dispatch request included unpermitted metadata keys: %v
• unknown task name %q
• must specify at least one healthy/unhealthy allocation ID

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/a76df3d7c005e65c. Report an issue: GitHub.