usebruno/bruno · error · Error

Invalid URL: only http and https URLs are allowed

Error message

Invalid URL: only http and https URLs are allowed

What it means

Error "Invalid URL: only http and https URLs are allowed" thrown in usebruno/bruno.

Source

Thrown at packages/bruno-electron/src/ipc/openapi-sync.js:1702

      const { format, brunoConfig, collectionRoot } = loadBrunoConfig(collectionPath);

      // Merge new config into existing entry (allowlist keys only)
      const allowedKeys = ['sourceUrl', 'groupBy', 'lastSyncDate', 'specHash', 'autoCheck', 'autoCheckInterval'];
      const sanitizedConfig = {};
      for (const key of allowedKeys) {
        if (key in config) {
          sanitizedConfig[key] = config[key];
        }
      }

      // sourceUrl is required — it identifies which entry to create/update
      if (!sanitizedConfig.sourceUrl) {
        throw new Error('sourceUrl is required to update openapi sync config');
      }

      // Validate sourceUrl — reject protocol-based non-http(s) URLs (e.g. ftp://, file://)
      if (sanitizedConfig.sourceUrl.includes('://') && !isValidHttpUrl(sanitizedConfig.sourceUrl)) {
        throw new Error('Invalid URL: only http and https URLs are allowed');
      }

      // Resolve to absolute for consistent internal handling (saveBrunoConfig converts back to relative)
      sanitizedConfig.sourceUrl = resolveSourceUrl(collectionPath, sanitizedConfig.sourceUrl);

      // Update or create the single openapi entry
      const existingEntry = brunoConfig.openapi?.[0];
      if (existingEntry) {
        brunoConfig.openapi = [{ ...existingEntry, ...sanitizedConfig }];
      } else {
        if (!('autoCheck' in sanitizedConfig)) sanitizedConfig.autoCheck = true;
        if (!('autoCheckInterval' in sanitizedConfig)) sanitizedConfig.autoCheckInterval = 5;
        brunoConfig.openapi = [sanitizedConfig];
      }

      // Save updated config
      await saveBrunoConfig(collectionPath, format, brunoConfig, collectionRoot);

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Use an http:// or https:// URL for the spec source.
2. Remove unsupported schemes like file: or ftp:.

When it happens

Trigger: Thrown at packages/bruno-electron/src/ipc/openapi-sync.js:1702 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/55d119e4f83e96a9. Report an issue: GitHub.