temporalio/temporal · error

get archived history request is invalid

Error message

get archived history request is invalid

What it means

ServerTLS allows client CAs either as inline PEM data (ClientCAData) or as file paths (ClientCAFiles), but not both simultaneously. Providing both would make CA pool construction ambiguous, so validateServerTLS rejects the combination outright.

Source

Thrown at common/archiver/constants.go:33

	// ErrReasonInvalidURI is the error reason for invalid URI
	ErrReasonInvalidURI = "URI is invalid"
	// ErrReasonInvalidArchiveRequest is the error reason for invalid archive request
	ErrReasonInvalidArchiveRequest = "archive request is invalid"
	// ErrReasonReadHistory is the error reason for failing to read history
	ErrReasonReadHistory = "failed to read history batches"
	// ErrReasonHistoryMutated is the error reason for mutated history
	ErrReasonHistoryMutated = "history was mutated"
)

var (
	// ErrInvalidURI is the error for invalid URI
	ErrInvalidURI = errors.New("URI is invalid")
	// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver
	ErrURISchemeMismatch = errors.New("URI scheme does not match the archiver")
	// ErrHistoryMutated is the error for mutated history
	ErrHistoryMutated = errors.New("history was mutated")
	// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request
	ErrInvalidGetHistoryRequest = errors.New("get archived history request is invalid")
	// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request
	ErrInvalidQueryVisibilityRequest = errors.New("query visiblity request is invalid")
	// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token
	ErrNextPageTokenCorrupted = errors.New("next page token is corrupted")
	// ErrHistoryNotExist is the error for non-exist history
	ErrHistoryNotExist = errors.New("requested workflow history does not exist")
)

View on GitHub (pinned to bde624efd1)

Solutions

1. Keep one representation: clear ClientCAFiles and keep ClientCAData, or the reverse.
2. For containerized deployments, prefer inline ClientCAData so no mounted files are required.
3. Audit config merging so only one layer contributes client CAs.
4. Add a pre-deploy config check asserting mutual exclusivity of all File/Data TLS pairs.

Example fix

// before
ServerTLS:
  ClientCAFiles: [/etc/temporal/client-ca.pem]
  ClientCAData: ["-----BEGIN CERTIFICATE-----..."]
// after
ServerTLS:
  ClientCAData: ["-----BEGIN CERTIFICATE-----..."]

if len(cfg.ClientCAFiles) > 0 && len(cfg.ClientCAData) > 0 {
	return fmt.Errorf("choose either ClientCAFiles or ClientCAData, not both")
}

When it happens

Trigger: Calling validateGroupTLS/validateServerTLS where both len(ClientCAFiles) > 0 and len(ClientCAData) > 0.

Common situations: Migrating from file-based to inline CA data but forgetting to clear the file list; base config sets files while an overlay adds data; operator pastes CA PEM into the wrong section of an already file-configured deployment.

Related errors

• URI is invalid
• requested workflow history does not exist
• URI scheme does not match the archiver
• history was mutated
• query visiblity request is invalid

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/8b5323b433db11db. Report an issue: GitHub.