netbirdio/netbird · error

posture checks shouldn't be empty

Error message

posture checks shouldn't be empty

What it means

Returned by Checks.Validate (management/server/posture/checks.go:306): after the name check passes, GetChecks() must yield at least one concrete check body (for example a version, process, or OS-specific check). A posture check with no actual checks would never evaluate anything, so it is rejected.

Source

Thrown at management/server/posture/checks.go:306

	}

	return &api.PostureCheck{
		Id:          pc.ID,
		Name:        pc.Name,
		Description: &pc.Description,
		Checks:      checks,
	}
}

// Validate checks the validity of a posture checks.
func (pc *Checks) Validate() error {
	if pc.Name == "" {
		return errors.New("posture checks name shouldn't be empty")
	}

	checks := pc.GetChecks()
	if len(checks) == 0 {
		return errors.New("posture checks shouldn't be empty")
	}

	for _, check := range checks {
		if err := check.Validate(); err != nil {
			return err
		}
	}

	return nil
}

func isVersionValid(ver string) bool {
	newVersion, err := version.NewVersion(ver)
	if err != nil {
		return false
	}

	if newVersion != nil {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Include at least one real check body under its correct key, e.g. checks.nb_version_check, checks.process_check, or the OS-specific variants
2. Verify the field name against the API schema (shared/management/http/api) for the server version you call

Example fix

// before
{ "name": "agent", "checks": {} }

// after
{ "name": "agent", "checks": { "nb_version_check": { "min_version": "0.50.0" } } }

// Mirror GetChecks(): at least one check body must be non-nil
hasCheck := req.Checks.NBVersionCheck != nil || req.Checks.ProcessCheck != nil /* ... OS variants ... */
if !hasCheck {
    return errors.New("at least one concrete check (e.g. nb_version_check) is required")
}

_, err := postureAPI.CreateCheck(ctx, req)
if err != nil && strings.Contains(err.Error(), "posture checks shouldn't be empty") {
    // the checks key was empty or unrecognized; fix payload keys, not the retry
}

When it happens

Trigger: POST /api/posture-checks (or PUT) whose checks object is empty, or whose fields all deserialize to nil so GetChecks() returns an empty slice.

Common situations: Sending {"checks": {}} because the client does not know which check types exist; sending a check under the wrong JSON key so it is silently ignored during unmarshalling; building the payload from a config schema that drifted from the server version.

Related errors

• posture checks name shouldn't be empty
• router not part of network
• peer and peer_groups cannot be set at the same time
• either peer or peer_groups must be provided
• self deletion is not allowed

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/f6799d2fe53bec53. Report an issue: GitHub.