nsqio/nsq · error
got response %s %q
Error message
got response %s %q
What it means
internal/http_api's Client.GETV1 (api_request.go) is the helper nsqadmin, nsqlookupd and the apps use to GET an nsqd/nsqlookupd HTTP API endpoint (e.g. /info, /stats, /lookup) with timeouts and negotiate-v1. On any response whose status is not exactly 200 it returns 'got response %s %q' with the HTTP status line and the (possibly empty) response body; one special case is handled internally: a 403 over http triggers an https retry via the https_port advertised by the daemon. Non-200 therefore means the daemon answered but rejected the request.
Source
Thrown at internal/http_api/api_request.go:81
}
body, err := io.ReadAll(resp.Body)
closeErr := resp.Body.Close()
if err != nil {
return err
}
if closeErr != nil {
return closeErr
}
if resp.StatusCode != 200 {
if resp.StatusCode == 403 && !strings.HasPrefix(endpoint, "https") {
endpoint, err = httpsEndpoint(endpoint, body)
if err != nil {
return err
}
goto retry
}
return fmt.Errorf("got response %s %q", resp.Status, body)
}
err = json.Unmarshal(body, &v)
if err != nil {
return err
}
return nil
}
// PostV1 is a helper function to perform a V1 HTTP request
// and parse our NSQ daemon's expected response format, with deadlines.
func (c *Client) POSTV1(endpoint string, data url.Values, v interface{}) error {
retry:
var reqBody io.Reader
if data != nil {
js, err := json.Marshal(data)
if err != nil {
return fmt.Errorf("failed to marshal POST data to endpoint: %v", endpoint)View on GitHub (pinned to 85cf10c09c)
Solutions
- Replay the exact URL with curl from the nsqadmin host: 'curl -i http://nsqd:4151/info' — it must return 200 with JSON.
- Fix the address/port in --lookupd-http-address / --nsqd-http-address (HTTP port, default 4151 for nsqd, 4161 for lookupd).
- If nsqd runs TLS-only or requires client certs, configure the http-client TLS options (and note 403+http auto-retries https only when the daemon advertises https_port).
- When auth is enabled, provision nsqadmin's allowed auth secret / client cert so requests are authorized.
Example fix
# before nsqadmin --nsqd-http-address=10.0.0.1:4150 # got response "404 Not Found" "<html>..." (4150 is the TCP port) # after nsqadmin --nsqd-http-address=10.0.0.1:4151 curl -i http://10.0.0.1:4151/info # 200 OK application/json
Defensive patterns
Strategy: try-catch
Validate before calling
// before driving the UI/tools, verify each daemon answers 200 on its HTTP API
func nsqdAPIAlive(base string) error {
c := &http.Client{Timeout: 2 * time.Second}
resp, err := c.Get(base + "/info")
if err != nil {
return err
}
defer resp.Body.Close()
if resp.StatusCode != http.StatusOK {
return fmt.Errorf("%s/info answered %d — fix address/auth before proceeding", base, resp.StatusCode)
}
return nil
} Try / catch
// around http_api GETV1 callers: classify the response error instead of string-matching blindly
if err := client.GETV1(endpoint, &v); err != nil {
if strings.Contains(err.Error(), "got response") {
// daemon reachable but refused: log status+body, alert on 4xx config errors,
// retry later on 5xx after the daemon recovers
return classifyAndRetry(err)
}
return err // transport-level failure (timeout, refused) — different remediation
} Prevention
- Smoke-test /info on every configured address before starting nsqadmin.
- Point admin tooling at the HTTP ports (nsqd 4151, lookupd 4161), never the TCP ports.
- When auth/TLS client certs are required on nsqd, configure the http-client TLS flags on the caller side too.
- Keep proxies from rewriting nsqd status codes.
When it happens
Trigger: Querying a wrong port (a non-NSQ HTTP server returning 404 with an HTML body), an nsqd endpoint that errors (500 on /stats under corruption), 401/403 when TLS-client-auth or auth is required and the client sent no credentials, or hitting an endpoint that moved. Used pervasively by nsqadmin pages and by nsq_to_nsq/nssql-style tools that create topics via /topic/create.
Common situations: nsqadmin configured with --nsqd-http-address pointing at the wrong port (e.g. the TCP 4150 instead of HTTP 4151); auth-enabled nsqd while nsqadmin lacks --http-client-auth-* / notification credentials; reverse proxy in front of nsqd returning 403 or 502 HTML that swallows the real status; version skew where an endpoint was removed.
Related errors
- failed to LoadX509KeyPair %s, %s - %s
- failed to read TLS root CA file %s - %s
- failed to AppendCertsFromPEM %s
- failed to resolve --lookupd-http-address (%s) - %s
- failed to resolve --nsqd-http-address (%s) - %s
AI-assisted analysis of nsqio/nsq@85cf10c09c (2026-08-16).
Data as JSON: /api/errors/c9e21a9be725f1a7.
Report an issue: GitHub.