santifer/career-ops · warning · Error

comeet: URL path must be the careers-api endpoint: ${redactT

Error message

comeet: URL path must be the careers-api endpoint: ${redactToken(url)}

What it means

Thrown by comeet's assertComeetUrl when the URL is valid https on www.comeet.co but its pathname does not start with /careers-api/. The path prefix check complements the hostname pin so a URL on the API host but outside the careers endpoint cannot be driven. Defense-in-depth: resolveApiUrl's isComeetApiUrl applies the same startsWith('/careers-api/') check and returns null (→ error 165) first, so fetch() surfaces 165. Reachable via a direct assertComeetUrl call.

Source

Thrown at providers/comeet.mjs:40

  } catch {
    return false;
  }
  return parsed.protocol === 'https:' && parsed.hostname === COMEET_API_HOST && parsed.pathname.startsWith('/careers-api/');
}

/** @param {string} url */
function assertComeetUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`comeet: invalid URL: ${redactToken(url)}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`comeet: URL must use HTTPS: ${redactToken(url)}`);
  if (parsed.hostname !== COMEET_API_HOST)
    throw new Error(`comeet: untrusted hostname "${parsed.hostname}" — must be ${COMEET_API_HOST}`);
  if (!parsed.pathname.startsWith('/careers-api/'))
    throw new Error(`comeet: URL path must be the careers-api endpoint: ${redactToken(url)}`);
  return url;
}

// Redact the per-tenant ?token= so neither the (informational, possibly-logged)
// DetectHit url nor a thrown validation error carries the secret. Best-effort:
// falls back to a regex strip when the value can't be parsed as a URL.
function redactToken(url) {
  try {
    const parsed = new URL(url);
    if (parsed.searchParams.has('token')) parsed.searchParams.set('token', 'REDACTED');
    return parsed.href;
  } catch {
    return typeof url === 'string' ? url.replace(/([?&]token=)[^&#]*/gi, '$1REDACTED') : url;
  }
}

/** @param {import('./_types.js').PortalEntry} entry */
function resolveApiUrl(entry) {

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. For direct calls, use the full positions URL: https://www.comeet.co/careers-api/2.0/company/<uid>/positions?token=<token>.
2. For fetch() use, set entry.api to that full positions URL (this shows as 165, same fix).
3. Copy the URL from Comeet's careers-API documentation, not from the browser address bar of the branded jobs page.

Example fix

// before — right host, wrong path
assertComeetUrl('https://www.comeet.co/jobs/abc');

// after — careers-api positions endpoint
assertComeetUrl('https://www.comeet.co/careers-api/2.0/company/abc/positions?token=TOKEN');

function isComeetCareersApiPath(u) {
  try { return new URL(u).pathname.startsWith('/careers-api/'); } catch { return false; }
}

function isComeetPositionsUrl(u) {
  if (typeof u !== 'string' || !u) return false;
  try {
    const p = new URL(u);
    return p.protocol === 'https:' && p.hostname === 'www.comeet.co' && p.pathname.startsWith('/careers-api/');
  } catch { return false; }
}

try { assertComeetUrl(url); }
catch (e) {
  if (/^comeet: URL path must be the careers-api endpoint/.test(e.message)) { /* not the positions endpoint — skip */ }
  else throw e;
}

When it happens

Trigger: assertComeetUrl is called directly with an https://www.comeet.co/... URL whose path is not under /careers-api/ (e.g. a marketing page or a different API version path). Through fetch(), the same input fails isComeetApiUrl and reports as error 165.

Common situations: Using a Comeet URL that is on the right host but is not the positions endpoint; a direct test against a stub path; an entry whose api: was copied from a non-careers-api Comeet page.

Related errors

• comeet: invalid URL: ${redactToken(url)}
• comeet: URL must use HTTPS: ${redactToken(url)}
• comeet: untrusted hostname "${parsed.hostname}" — must be ${
• echojobs: invalid URL: ${url}
• echojobs: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/1d07f3fa4bacb17b. Report an issue: GitHub.