nextcloud/all-in-one · error · \Exception

Unexpected response from deSEC during domain registration (H

Error message

Unexpected response from deSEC during domain registration (HTTP {code}): {body}

What it means

POST /domains/ returned a status outside every handled case — not 201 (created), and for user slugs not 400/403/409 either; for random slugs any non-201/non-409 code (including 400/403) lands here immediately. The raw body is embedded.

Source

Thrown at php/src/Desec/DesecManager.php:328

                if ($this->ownsDomain($token, $domain)) {
                    return $domain;
                }
                if ($code === 403) {
                    throw new \Exception(
                        'Your deSEC account has reached its domain limit and "' . $domain . '" is not '
                        . 'one of your existing domains. Remove an unused domain at desec.io, or contact '
                        . 'deSEC support to raise the limit, then try again.'
                    );
                }
                throw new \Exception('"' . $domain . '" is already taken. Please choose a different subdomain and try again.');
            }

            if ($code === 409) {
                // Random slug collided with an existing name — try another.
                continue;
            }

            throw new \Exception('Unexpected response from deSEC during domain registration (HTTP ' . $code . '): ' . $res->getBody()->getContents());
        }

        throw new \Exception('Could not register a free dedyn.io domain after ' . self::MAX_SLUG_ATTEMPTS . ' attempts. Please try again.');
    }

    /**
     * Checks whether the authenticated account already owns the given domain.
     *
     * Used to recover from a failed creation when the user is reusing a slug they
     * registered earlier: GET /domains/{name}/ returns 200 only for a domain the
     * token's account owns, 404 otherwise.
     *
     * @throws \Exception on network failure or an unexpected HTTP response
     */
    private function ownsDomain(string $token, string $domain): bool {
        try {
            $res = $this->guzzleClient->get($this->configurationManager->desecApiBase . '/domains/' . $domain . '/', [
                'headers' => ['Authorization' => 'Token ' . $token],

View on GitHub (pinned to 6b788eec5e)

Solutions

Read the embedded body for the API's own explanation
On 401, re-login to obtain a fresh token and retry creation
On 429, wait and retry later rather than immediately re-running
On 5xx, check deSEC status and retry after recovery

Defensive patterns

Strategy: try-catch

Try / catch

try {
    $domain = $manager->registerDomain($token, $slug);
} catch (\Exception $e) {
    if (preg_match('/during domain registration \(HTTP (\d+)\)/', $e->getMessage(), $m)) {
        if ($m[1] === '401') { $token = refreshDesecToken($email, $password); return retry(); }
        if ($m[1] === '429') { scheduleRetry(60); return; }
    }
    throw $e;
}

Prevention

Keep the token fresh — minimize delay between login and domain creation
Handle 401 by re-authenticating instead of reusing the dead token
Log the embedded body; it distinguishes API incidents from client mistakes

When it happens

Trigger: 429 domain-creation rate limit; 401 token expired/revoked between login and creation; 5xx from deSEC; random-slug mode receiving 403 (quota) or 400, which have no continue-path and throw here.

Common situations: deSEC incident returning 502/503; long gap between login and domain creation invalidating the token; rate limiting after repeated setup attempts.

Related errors

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/ef21599075415528. Report an issue: GitHub.