santifer/career-ops · error · Error

lever: URL must use HTTPS: ${url}

Error message

lever: URL must use HTTPS: ${url}

What it means

Second guard in assertLeverUrl: after a successful parse, parsed.protocol must be 'https:'. Any non-HTTPS scheme is rejected to enforce TLS on the Lever API call.

Source

Thrown at providers/lever.mjs:18

// @ts-check
/** @typedef {import('./_types.js').Provider} Provider */

// Lever provider — hits the public postings endpoint.
// Auto-detects from careers_url via jobs.(eu.)?lever.co/<slug>.
// Handles both explicit `api:` URLs and auto-detection from `careers_url`.

const ALLOWED_LEVER_HOSTS = new Set(['api.lever.co', 'api.eu.lever.co']);

/** @param {string} url */
function assertLeverUrl(url) {
  let parsed;
  try {
    parsed = new URL(url);
  } catch {
    throw new Error(`lever: invalid URL: ${url}`);
  }
  if (parsed.protocol !== 'https:') throw new Error(`lever: URL must use HTTPS: ${url}`);
  if (!ALLOWED_LEVER_HOSTS.has(parsed.hostname))
    throw new Error(`lever: untrusted hostname "${parsed.hostname}" — must be one of: ${[...ALLOWED_LEVER_HOSTS].join(', ')}`);
  return url;
}

/** @param {import('./_types.js').PortalEntry} entry */
function resolveApiUrl(entry) {
  // Explicit api: wins — lets an entry keep a human-facing corporate
  // careers_url (e.g. https://www.coalfire.com/careers) while still pinning
  // the Lever postings board (mirrors greenhouse's api: precedence).
  if (entry.api) {
    assertLeverUrl(entry.api);
    return entry.api;
  }
  let url;
  try {
    url = new URL(entry.careers_url || '');
  } catch {

View on GitHub (pinned to 9b17a8ac97)

Solutions

1. Switch the scheme to https:// (Lever's API is HTTPS-only).
2. Verify with curl https://api.lever.co/v0/postings/<slug>.
3. Update any templated URL builder to emit https://.

Example fix

// before
api: http://api.lever.co/v0/postings/acme

// after
api: https://api.lever.co/v0/postings/acme

import { URL } from 'node:url';
export function isHttpsUrl(value) {
  try { return new URL(value).protocol === 'https:'; } catch { return false; }
}

/** @param {string} url */
function isHttps(url) {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}

try {
  assertLeverUrl(url);
} catch (err) {
  if (err.message.includes('HTTPS')) console.warn(`refusing non-HTTPS lever URL: ${url}`);
  throw err;
}

When it happens

Trigger: The URL parses but uses http://, ftp://, file://, or another non-https scheme — most often a plain-http api: or careers_url in portals.yml.

Common situations: A legacy config uses http://api.lever.co; a test fixture was written over HTTP; the careers_url was copied from a non-TLS source.

Related errors

• larajobs: URL must use HTTPS: ${url}
• manfred: URL must use HTTPS: ${url}
• arbeitnow: URL must use HTTPS: ${url}
• ashby: URL must use HTTPS: ${url}
• bamboohr: URL must use HTTPS: ${url}

AI-assisted analysis of santifer/career-ops@9b17a8ac97 (2026-08-13). Data as JSON: /api/errors/706a33e383a14ad8. Report an issue: GitHub.