ory/kratos · error

: Could not marshal the traits schema. This usually means…

Error message

%s: Could not marshal the traits schema. This usually means there is a problem with your upstream service as it served an invalid response.

What it means

After fetching a remote identity traits schema by ID, ValidateIdentity marshals the fetched schema (ts) back to JSON to compile it locally. If json.Marshal of the fetched schema fails, this error wraps the marshal failure. The message hints that the upstream service returned data that cannot be re-serialized as valid JSON.

Solutions

1. Inspect the wrapped json.Marshal error to see what value failed to serialize.
2. Fetch the schema ID manually (curl) and verify the endpoint returns valid JSON schema.
3. Check that the configured schema URL points to the correct, healthy upstream service.
4. Fix or replace the broken schema document on the upstream service, then retry.

Example fix

// before: upstream serves invalid schema
identities validate remote --schema-url https://broken-host/schemas
// after: verify and use a valid schema endpoint
 curl -s https://correct-host/schemas/identity-traits | jq .
identities validate remote --schema-url https://correct-host/schemas

resp, err := http.Get(schemaURL)
if err != nil { return err }
body, _ := io.ReadAll(resp.Body)
var probe map[string]any
if err := json.Unmarshal(body, &probe); err != nil {
    return fmt.Errorf("schema endpoint did not return valid JSON: %w", err)
}

func isValidJSONSchema(b []byte) bool {
    var v map[string]any
    return json.Unmarshal(b, &v) == nil
}

if err := validateIdentity(cmd, args); err != nil {
    var marshalErr *json.MarshalTypeError
    if errors.As(err, &marshalErr) {
        fmt.Fprintf(os.Stderr, "upstream schema invalid: %v\n", err)
    }
    return err
}

When it happens

Trigger: Running `identities validate` against a remote schema ID whose fetched content, when marshaled (json.Marshal(ts)), fails — e.g. the upstream schema registry returned a non-serializable or corrupt document.

Common situations: Pointing the CLI at a misbehaving or incompatible schema host (wrong --schema-url / remote config), a proxy intercepting responses, or a schema endpoint serving HTML error pages instead of JSON.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• unknown node type: %T
• node type and node attributes mismatch: %T !=
• expected to get the DSN as an argument, or the…
• expected zero or two args, got
• failed to unmarshal webhook configuration for

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/6e5b07afce6a91ee. Report an issue: GitHub.

Appendix: source

Thrown at cmd/identities/validate.go:128

	}

	// get custom identity schema id
	sid := gjson.Get(i, "schema_id")
	if !sid.Exists() {
		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), `%s: Expected key "schema_id" to be defined in identity file`, src)
		return cmdx.FailSilently(cmd)
	}

	customSchema, ok := schemas[sid.String()]
	if !ok {
		ts, _, err := getRemoteSchema(cmd.Context(), sid.String())
		if err != nil {
			_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "%s: Could not fetch schema with ID \"%s\": %s\n", src, sid.String(), err)
			return cmdx.FailSilently(cmd)
		}
		sf, err := json.Marshal(ts)
		if err != nil {
			return errors.Wrap(err, fmt.Sprintf("%s: Could not marshal the traits schema. This usually means there is a problem with your upstream service as it served an invalid response.", src))
		}

		// compile custom identity schema
		customSchema, err = jsonschema.CompileString(cmd.Context(), "identity_traits.schema.json", string(sf))
		if err != nil {
			_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "%s: Could not compile the traits schema: %s\n", src, err)
			return cmdx.FailSilently(cmd)
		}
		schemas[sid.String()] = customSchema
	}

	// validate against custom identity schema
	err = customSchema.Validate(bytes.NewBufferString(i))
	if err != nil {
		_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "%s: not valid\n", src)
		jsonschemax.FormatValidationErrorForCLI(cmd.ErrOrStderr(), []byte(i), err)
		foundValidationErrors = true
	}

View on GitHub (pinned to b86338da04)