What causes "discovery service refused our Request" in hyperledger/fabric?

Inspect the wrapped underlying gRPC error for the server's specific reason (authentication/channel not found)

discovery service refused our Request

Error message

discovery service refused our Request

What it means

Client.Send in discovery/client/client.go:183 invokes the gRPC Discover RPC; if the server returns an error or the RPC fails, it is wrapped with 'discovery service refused our Request'. This happens after successful connect/serialize/sign, so the rejection comes from the server side (auth, channel, or request content).

Source

Thrown at discovery/client/client.go:183

	}

	sig, err := c.signRequest(payload)
	if err != nil {
		return nil, errors.Wrap(err, "failed signing Request")
	}

	conn, err := c.createConnection()
	if err != nil {
		return nil, errors.Wrap(err, "failed connecting to discovery service")
	}

	cl := discovery.NewDiscoveryClient(conn)
	resp, err := cl.Discover(ctx, &discovery.SignedRequest{
		Payload:   payload,
		Signature: sig,
	})
	if err != nil {
		return nil, errors.Wrap(err, "discovery service refused our Request")
	}
	if n := len(resp.Results); n != req.lastIndex {
		return nil, errors.Errorf("Sent %d queries but received %d responses back", req.lastIndex, n)
	}
	return req.computeResponse(resp)
}

type resultOrError any

type response map[key]resultOrError

type localResponse struct {
	response
}

func (cr *localResponse) Peers() ([]*Peer, error) {
	return parsePeers(protoext.LocalMembershipQueryType, cr.response, "")
}

View on GitHub (pinned to 2736b63f8f)

Solutions

Inspect the wrapped underlying gRPC error for the server's specific reason (authentication/channel not found)
Ensure the AuthInfo identity matches the signer identity and, under mutual TLS, matches the TLS client certificate
Verify the client identity belongs to an organization allowed to use discovery on that channel (channel policies/acl)
Confirm the channel name in the queries exists on the target peer

Example fix

// before: TLS cert identity differs from signing identity
auth := &discovery.AuthInfo{ClientIdentity: idA} // signed by signerB

// after: same identity for AuthInfo and signing
auth := &discovery.AuthInfo{ClientIdentity: idA}
signer := signerForIdentity(idA)

Defensive patterns

Strategy: retry

Validate before calling

if auth.ClientIdentity == nil || !bytes.Equal(auth.ClientIdentity, signedIdentityBytes) {
    return errors.New("AuthInfo identity must match the signing identity and TLS client cert")
}

Try / catch

resp, err := client.Send(ctx, req, auth)
if err != nil && strings.Contains(err.Error(), "discovery service refused our Request") {
    // inspect wrapped gRPC status; fix identity/acl/channel, then retry
}

Prevention

Use the same identity for AuthInfo, signing, and (mutual TLS) client certificate
Enroll the client identity with the peer's MSP and verify channel ACLs allow discovery
Confirm channel names in queries exist on the peer

When it happens

Trigger: The Discover RPC returns a non-nil error: authentication failure (signature doesn't match the identity/TLS cert), unknown channel in the query, ineligible identity for the requested service, or server-side panic/stream error.

Common situations: Client identity not enrolled on the peer (peer.membership access control); AuthInfo identity mismatch with the actual TLS client cert; querying a channel the peer isn't a member of; discovery auth cache rejecting stale credentials.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/f72293c92dab0117. Report an issue: GitHub.