multica-ai/multica · error

rotate webhook url: %w

Error message

rotate webhook url: %w

What it means

Wrapped error from POST /api/autopilots/{id}/triggers/{triggerID}/rotate-webhook-token in `multica autopilot trigger rotate-webhook-url`. Both references resolved and the user confirmed (or passed --yes); the server-side rotation of the webhook secret failed. Successful rotation returns a new URL which the CLI prints via printWebhookURL.

Source

Thrown at server/cmd/multica/cmd_autopilot.go:650

	// version uses an AlertDialog; the CLI mirrors that with a y/N prompt
	// unless --yes was passed for scripted use. Style matches confirmOverwrite
	// in cmd_setup.go.
	yes, _ := cmd.Flags().GetBool("yes")
	if !yes {
		fmt.Fprintln(os.Stderr, "This will invalidate the current webhook URL immediately. Continue? [y/N] ")
		reader := bufio.NewReader(os.Stdin)
		answer, _ := reader.ReadString('\n')
		answer = strings.TrimSpace(strings.ToLower(answer))
		if answer != "y" && answer != "yes" {
			fmt.Fprintln(os.Stderr, "Aborted.")
			return nil
		}
	}

	var result map[string]any
	path := "/api/autopilots/" + autopilotRef.ID + "/triggers/" + triggerRef.ID + "/rotate-webhook-token"
	if err := client.PostJSON(ctx, path, nil, &result); err != nil {
		return fmt.Errorf("rotate webhook url: %w", err)
	}

	output, _ := cmd.Flags().GetString("output")
	if output == "json" {
		return cli.PrintJSON(os.Stdout, result)
	}
	fmt.Printf("Webhook URL rotated for trigger %s\n", strVal(result, "id"))
	printWebhookURL(client, result)
	return nil
}

func runAutopilotTriggerUpdate(cmd *cobra.Command, args []string) error {
	client, err := newAPIClient(cmd)
	if err != nil {
		return err
	}

	body := map[string]any{}

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Verify the trigger kind is webhook: GET /api/autopilots/{id} and check triggers[].kind
2. Re-resolve the trigger ID — 404 usually means it was deleted concurrently
3. Re-run with --yes after confirming; the failure left the old URL intact (rotation is server-atomic)
4. Fix auth/permissions on 401/403

Example fix

// before
multica autopilot trigger rotate-webhook-url my-pilot sched-trig --yes
// rotate webhook url: request failed: 400: trigger is not a webhook trigger

// after
multica autopilot trigger rotate-webhook-url my-pilot webhook-trig-uuid --yes

KIND=$(curl -s -H "Authorization: Bearer $TOKEN" "$API/api/autopilots/$ID" | jq -r --arg t "$TRIGGER" ".triggers[] | select(.id==\"$t\") | .kind")
[ "$KIND" = "webhook" ] || { echo "trigger $TRIGGER is kind=$KIND, not webhook" >&2; exit 1; }

Branch on wrapped status: 400 not-a-webhook -> pick the right trigger; 404 -> re-resolve (trigger gone); 401/403 -> fix credentials; 5xx/network -> one retry. Rotation is atomic server-side: a failed call leaves the old URL valid.

When it happens

Trigger: POST returning 400 when the trigger is not kind=webhook (schedule triggers have no token to rotate), 404 when the trigger was deleted between resolution and rotation, 403 without trigger-management permission, 409 on concurrent rotation, or a network/timeout failure under cli.APIContext.

Common situations: Rotating a schedule trigger by mistake; token deleted in the UI concurrently; under-privileged service account; old integrations still posting to the previous URL after rotation (expected, but often discovered here when re-checking the trigger).

Related errors

• --timezone is only valid with --kind schedule
• --cron is only valid with --kind schedule
• create trigger: %w
• resolve trigger: %w
• trigger autopilot: %w

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/e913b187461ec185. Report an issue: GitHub.