What causes "query visiblity request is invalid" in temporalio/temporal?

Remove empty entries from RootCAData.

query visiblity request is invalid

Error message

query visiblity request is invalid

What it means

This is a wrapping error from validateClientTLS: validateCAs rejected an entry in ClientTLS.RootCAData, the list of inline PEM root CAs used to verify the server (or mTLS peer). The underlying cause is typically an empty string in the list.

Source

Thrown at common/archiver/constants.go:35

	// ErrReasonInvalidArchiveRequest is the error reason for invalid archive request
	ErrReasonInvalidArchiveRequest = "archive request is invalid"
	// ErrReasonReadHistory is the error reason for failing to read history
	ErrReasonReadHistory = "failed to read history batches"
	// ErrReasonHistoryMutated is the error reason for mutated history
	ErrReasonHistoryMutated = "history was mutated"
)

var (
	// ErrInvalidURI is the error for invalid URI
	ErrInvalidURI = errors.New("URI is invalid")
	// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver
	ErrURISchemeMismatch = errors.New("URI scheme does not match the archiver")
	// ErrHistoryMutated is the error for mutated history
	ErrHistoryMutated = errors.New("history was mutated")
	// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request
	ErrInvalidGetHistoryRequest = errors.New("get archived history request is invalid")
	// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request
	ErrInvalidQueryVisibilityRequest = errors.New("query visiblity request is invalid")
	// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token
	ErrNextPageTokenCorrupted = errors.New("next page token is corrupted")
	// ErrHistoryNotExist is the error for non-exist history
	ErrHistoryNotExist = errors.New("requested workflow history does not exist")
)

View on GitHub (pinned to bde624efd1)

Solutions

Remove empty entries from RootCAData.
Fix the source of the empty value (missing secret, unset env var, bad template).
If CAs are on disk, switch to RootCAFiles and empty RootCAData.
Validate the PEM content parses as an x509 certificate before deployment.

Example fix

// before
ClientTLS:
  RootCAData: [""]
// after
ClientTLS:
  RootCAData: ["-----BEGIN CERTIFICATE-----..."]

Defensive patterns

Strategy: validation

Validate before calling

for i, ca := range cfg.RootCAData {
	if strings.TrimSpace(ca) == "" {
		return fmt.Errorf("RootCAData[%d] is empty", i)
	}
}

Prevention

Fail fast on empty secret values before constructing client TLS config.
Guard env-based injection: require ROOT_CA_DATA to be non-empty at startup.
Validate rendered PEM with crypto/x509 before use.

When it happens

Trigger: Calling validateGroupTLS or validateWorkerTLS with ClientTLS.RootCAData containing an empty or whitespace-only entry.

Common situations: Client config generated from a template with an unfilled root CA value; env expansion to empty string; a YAML list item left blank; secret not yet mounted so data renders empty.

Related errors

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/a31cd0afc6a5d655. Report an issue: GitHub.