netbirdio/netbird · error

at least one target is required

Error message

at least one target is required

What it means

Returned by Service.Validate (management/internals/modules/reverseproxy/service/service.go:864) when the Targets slice is empty. A reverse-proxy service forwards traffic to its target list, so a service with zero targets has nothing to proxy and is rejected before mode defaults are applied.

Source

Thrown at management/internals/modules/reverseproxy/service/service.go:864

	return &proto.AccessRestrictions{
		AllowedCidrs:     r.AllowedCIDRs,
		BlockedCidrs:     r.BlockedCIDRs,
		AllowedCountries: r.AllowedCountries,
		BlockedCountries: r.BlockedCountries,
		CrowdsecMode:     r.CrowdSecMode,
	}
}

func (s *Service) Validate() error {
	if s.Name == "" {
		return errors.New("service name is required")
	}
	if len(s.Name) > 255 {
		return errors.New("service name exceeds maximum length of 255 characters")
	}

	if len(s.Targets) == 0 {
		return errors.New("at least one target is required")
	}

	if s.Mode == "" {
		s.Mode = ModeHTTP
	}

	if err := validateHeaderAuths(s.Auth.HeaderAuths); err != nil {
		return err
	}
	if err := validateAccessRestrictions(&s.Restrictions); err != nil {
		return err
	}
	if err := s.validatePrivateRequirements(); err != nil {
		return err
	}

	switch s.Mode {
	case ModeHTTP:

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Include at least one target (e.g. http://host:port) in the create/update request.
2. Validate client-side that the targets array is non-empty before calling.
3. If you intended to remove a target, keep at least one remaining or delete the service instead.

Example fix

# before
{"name": "internal-api", "mode": "http", "domain": "api.example.net", "targets": []}

# after
{"name": "internal-api", "mode": "http", "domain": "api.example.net", "targets": ["http://10.0.0.5:8080"]}

if len(svc.Targets) == 0 {
    return fmt.Errorf("at least one target is required")
}

When it happens

Trigger: Creating or updating a service with no Targets array, or with the array present but empty ([]), including updates intended to clear all targets.

Common situations: UI allows saving before a target is added; API client sends {"targets": []}; a plan to 'create now, add targets later' via API, which the model does not permit.

Related errors

• service name is required
• service name exceeds maximum length of 255 characters
• private services require at least one access group
• private services cannot enable bearer auth (SSO): NetBird-on
• service domain is required

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/379a2be37309d46b. Report an issue: GitHub.