pola-rs/polars · error · ValueError

a non-HTTPS workspace_url was given ({workspace_url}). To al

Error message

a non-HTTPS workspace_url was given ({workspace_url}). To allow non-HTTPS URLs, pass require_https=False.

What it means

ValueError from the Unity Catalog client constructor (py-polars/src/polars/catalog/unity/client.py:82-92). pl.catalog.unity.Catalog requires workspace_url to start with 'https://' when require_https=True (the default). Because the bearer token is sent to this host, a plain-HTTP workspace URL is treated as a credential-leak risk and rejected unless you explicitly opt out with require_https=False. In bearer_token='auto' mode the SDK path additionally only engages for HTTPS *.cloud.databricks.com URLs inside Databricks runtimes.

Source

Thrown at py-polars/src/polars/catalog/unity/client.py:91

            URL of the workspace, or alternatively the URL of the Unity catalog
            API endpoint.
        bearer_token
            Bearer token to authenticate with. This can also be set to:

            * "auto": Automatically retrieve bearer tokens from the environment.
            * "databricks-sdk": Use the Databricks SDK to retrieve and use the
              bearer token from the environment.
        require_https
            Require the `workspace_url` to use HTTPS.
        """
        issue_unstable_warning("`Catalog` functionality is considered unstable.")

        if require_https and not workspace_url.startswith("https://"):
            msg = (
                f"a non-HTTPS workspace_url was given ({workspace_url}). To "
                "allow non-HTTPS URLs, pass require_https=False."
            )
            raise ValueError(msg)

        if bearer_token == "databricks-sdk" or (
            bearer_token == "auto"
            # For security, in "auto" mode, only retrieve/use the token if:
            # * We are running inside a Databricks environment
            # * The `workspace_url` is pointing to Databricks and uses HTTPS
            and "DATABRICKS_RUNTIME_VERSION" in os.environ
            and workspace_url.startswith("https://")
            and (
                workspace_url.removeprefix("https://")
                .split("/", 1)[0]
                .endswith(".cloud.databricks.com")
            )
        ):
            bearer_token = self._get_databricks_token()

        if bearer_token == "auto":
            bearer_token = None

View on GitHub (pinned to df599052da)

Solutions

1. Use the HTTPS workspace URL, e.g. https://adb-xxxx.azuredatabricks.net
2. Only for trusted internal networks, pass require_https=False explicitly
3. Check for a scheme typo or a proxy stripping https before the value reaches your config

Example fix

# before
catalog = Catalog(workspace_url='http://adb-123.azuredatabricks.net', bearer_token=tok)

# after
catalog = Catalog(workspace_url='https://adb-123.azuredatabricks.net', bearer_token=tok)

def workspace_url_ok(url: str, *, require_https: bool = True) -> bool:
    return (not require_https) or url.startswith('https://')

When it happens

Trigger: Catalog(workspace_url='http://adb-123...azuredatabricks.net', bearer_token=...) with default require_https=True; internal/on-prem gateways with http endpoints; URLs missing the scheme or using hostnames only.

Common situations: Corporate proxies that rewrite URLs to http; test environments against a local mock Databricks/Unity endpoint; typos in the scheme ('http://', 'adb-...' without scheme).

Related errors

• cannot apply delta_table_version for table of type {data_sou
• cannot apply delta_table_options for table of type {data_sou
• did not receive credentials from temporary credentials API f
• index positions should be smaller than 2^32
• index positions should be greater than or equal to -2^32

AI-assisted analysis of pola-rs/polars@df599052da (2026-08-16). Data as JSON: /api/errors/4ea4f511a4b7f44a. Report an issue: GitHub.