rancher/rancher · error

invalid subscriptionId

Error message

invalid subscriptionId

What it means

getCredentialsFromBody (handler.go:317) parses an inline credential payload for AKS lister endpoints and requires a non-empty subscriptionId string; an empty value yields 400 'invalid subscriptionId'. Unlike checkCredentials (which says 'must provide subscriptionId'), this path is used when credentials are pasted directly in the request body.

Source

Thrown at pkg/api/norman/customization/aks/handler.go:328

			return http.StatusOK, nil
		}
	}

	return httperror.InvalidBodyContent.Status, fmt.Errorf("cloud credential not found")
}

func (h *handler) getCredentialsFromBody(req *http.Request, cap *Capabilities) (int, error) {
	raw, err := io.ReadAll(req.Body)
	if err != nil {
		return http.StatusBadRequest, fmt.Errorf("cannot read request body: %v", err)
	}

	if err = json.Unmarshal(raw, &cap); err != nil {
		return http.StatusBadRequest, fmt.Errorf("cannot parse request body: %v", err)
	}

	if cap.SubscriptionID == "" {
		return http.StatusBadRequest, fmt.Errorf("invalid subscriptionId")
	}
	if cap.TenantID == "" {
		return http.StatusBadRequest, fmt.Errorf("invalid tenantId")
	}
	if cap.ClientID == "" {
		return http.StatusBadRequest, fmt.Errorf("invalid clientId")
	}
	if cap.ClientSecret == "" {
		return http.StatusBadRequest, fmt.Errorf("invalid clientSecret")
	}

	clientEnvironment := ""
	if cap.Environment != "" {
		clientEnvironment = cap.Environment
	}
	_, azureEnvironment := GetEnvironment(clientEnvironment)

	if cap.BaseURL == "" {

View on GitHub (pinned to 932558d4e6)

Solutions

1. Include subscriptionId as a non-empty string GUID in the request body
2. Use exact camelCase keys matching the API schema (subscriptionId, tenantId, clientId, clientSecret)
3. Copy the four values from 'az account show' to guarantee they are populated

Example fix

// before
const body = { tenantId, clientId, clientSecret, region };
// after
const body = { subscriptionId, tenantId, clientId, clientSecret, region };

const isGuid = (s) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s || '');
if (!isGuid(body.subscriptionId)) throw new Error('subscriptionId (GUID) is required for inline AKS requests');

function hasInlineAksCreds(b) {
  return typeof b?.subscriptionId === 'string' && b.subscriptionId !== '';
}

if (!hasInlineAksCreds(body)) { flagField('subscriptionId'); return; }
const resp = await post(listEndpoint, body);

When it happens

Trigger: POSTing to an aks lister action with credentials inline where subscriptionId is missing, empty, or under a differently-cased key (SubscriptionId) that json.Unmarshal ignores.

Common situations: UI 'paste credentials' flow left subscription blank; partial payload copied from the cloud credential edit dialog; key casing drift after an SDK/UI update.

Related errors

• must provide clientSecret
• invalid cloud credential ID %s
• invalid tenantId
• invalid clientId
• invalid clientSecret

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/126e77eaefd75fb8. Report an issue: GitHub.