hashicorp/nomad · error

unexpected NotBeforeLeeway type: %v

Error message

unexpected NotBeforeLeeway type: %v

What it means

Analogous to the ExpirationLeeway error, this is returned in api/acl.go's custom unmarshal when the NotBeforeLeeway JSON value has an unexpected type. Only duration strings and numeric (float64 nanosecond) values are accepted; anything else fails decoding.

Source

Thrown at api/acl.go:970

			}
		case float64:
			c.ExpirationLeeway = time.Duration(v)
		default:
			return fmt.Errorf("unexpected ExpirationLeeway type: %v", v)
		}
	}
	if aux.NotBeforeLeeway != nil {
		switch v := aux.NotBeforeLeeway.(type) {
		case string:
			if v != "" {
				if c.NotBeforeLeeway, err = time.ParseDuration(v); err != nil {
					return err
				}
			}
		case float64:
			c.NotBeforeLeeway = time.Duration(v)
		default:
			return fmt.Errorf("unexpected NotBeforeLeeway type: %v", v)
		}
	}
	if aux.ClockSkewLeeway != nil {
		switch v := aux.ClockSkewLeeway.(type) {
		case string:
			if v != "" {
				if c.ClockSkewLeeway, err = time.ParseDuration(v); err != nil {
					return err
				}
			}
		case float64:
			c.ClockSkewLeeway = time.Duration(v)
		default:
			return fmt.Errorf("unexpected ClockSkewLeeway type: %v", v)
		}
	}
	return nil
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Use a Go duration string (e.g. "30s", "2m") or an integer nanosecond value for NotBeforeLeeway.
2. Fix the marshaling side so the field is emitted as string/number.
3. Validate the JSON payload shape against the auth method schema before submitting.

Example fix

// before
{"NotBeforeLeeway": true}
// after
{"NotBeforeLeeway": "30s"}

if !validLeeway(payload.NotBeforeLeeway) {
    return fmt.Errorf("NotBeforeLeeway must be a duration string (e.g. \"30s\") or numeric nanoseconds")
}

func isDurationOrNumber(v interface{}) bool {
    switch t := v.(type) {
    case string:
        _, err := time.ParseDuration(t)
        return err == nil
    case float64:
        return true
    }
    return false
}

When it happens

Trigger: Creating or updating an ACL auth method with a JSON `NotBeforeLeeway` value that is not a string duration or number — e.g. a bool, object, or array.

Common situations: Terraform/SDK configs emitting structured duration objects; manual JSON edits with wrong types; copying response JSON back into a request after the field was round-tripped into a different type.

Related errors

• unexpected ExpirationLeeway type: %v
• unexpected ClockSkewLeeway type: %v
• unexpected ExpirationLeeway type: %v
• unexpected NotBeforeLeeway type: %v
• default auth config text could not be deserialized: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/bb1501d618e30a84. Report an issue: GitHub.