microsoft/semantic-kernel · error · FunctionExecutionException

The operation path resolves to '{request.path}', which is ou

Error message

The operation path resolves to '{request.path}', which is outside the configured server base path '{base_path}'.

What it means

The second part of `_ensure_request_target_matches_server`: even when scheme/host/port match, the request path must stay within the server's base path. If the resolved request path neither equals the base path (sans trailing slash) nor starts with it, this FunctionExecutionException is raised. This prevents path traversal beyond the server's base directory even when the host is correct.

Source

Thrown at python/semantic_kernel/connectors/openapi_plugin/models/rest_api_operation.py:262

        server = urlparse(server_url)
        request = urlparse(request_url)

        if (request.scheme, request.username, request.password, request.hostname, request.port) != (
            server.scheme,
            server.username,
            server.password,
            server.hostname,
            server.port,
        ):
            raise FunctionExecutionException(
                f"The operation path resolves to '{request.scheme}://{request.netloc}', which does not match "
                f"the configured server '{server.scheme}://{server.netloc}'."
            )

        # get_server_url guarantees a trailing slash, so the server base path always ends with "/".
        base_path = server.path
        if request.path != base_path.rstrip("/") and not request.path.startswith(base_path):
            raise FunctionExecutionException(
                f"The operation path resolves to '{request.path}', which is outside the configured server "
                f"base path '{base_path}'."
            )

    def get_server_url(self, server_url_override=None, api_host_url=None, arguments=None):
        """Get the server URL for the operation."""
        if arguments is None:
            arguments = {}

        # Prioritize server_url_override
        if (
            server_url_override is not None
            and isinstance(server_url_override, (ParseResult, ParseResultBytes))
            and server_url_override.geturl() != b""
        ):
            server_url_string = server_url_override.geturl()
        elif server_url_override is not None and isinstance(server_url_override, str) and server_url_override != "":
            server_url_string = server_url_override

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Ensure operation paths are within the server's configured base path.
2. Correct the server URL to include the proper base path, or adjust the operation paths to be relative to it.
3. Review the OpenAPI spec for paths that legitimately fall outside the server base and restructure accordingly.

Example fix

// before (server base /api/v1/ but operation resolves to /admin)
server_url = "https://api.example.com/api/v1/"
// after (ensure operation paths stay under the base)
server_url = "https://api.example.com/api/v1/"
# operation path should be relative, e.g. "users" not "/admin/users"

from urllib.parse import urlparse
def validate_base_path(server_url: str, request_url: str):
    s, r = urlparse(server_url), urlparse(request_url)
    base_path = s.path
    if r.path != base_path.rstrip('/') and not r.path.startswith(base_path):
        raise ValueError(f"Request path '{r.path}' is outside server base path '{base_path}'")

try:
    result = await api.my_operation(**args)
except FunctionExecutionException as e:
    if "outside the configured server base path" in str(e):
        # ensure operation paths stay within the server base path
        ...

When it happens

Trigger: The operation path, after joining with the server URL, resolves outside the server's base path. For example server base is `/api/v1/` but the resolved request path is `/admin/users`.

Common situations: An operation path starts with `..` that bypasses the host check but escapes the base path. A server base path is configured but an operation path is designed for a different base. Misconfigured server URL with a base path component.

Related errors

• The operation path resolves to '{request.scheme}://{request.
• Path '{path}' contains a dot-segment, which could lead to pa
• Error building the URL for the operation {self.id}: {e!s}
• No argument provided for the '{variable_name}' server variab
• Path '{path}' contains a dot-segment, which could lead to pa

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/39ec802473063cbe. Report an issue: GitHub.