weaviate/weaviate · warning

ErrBadRequest

ErrBadRequest

Error message

bad request

What it means

ErrBadRequest in cluster/rbac is the sentinel returned by the RBAC cluster Manager when a create/update (e.g. createNamespace, updateNamespace, CreateUser) request fails payload validation before it is applied via RAFT. Like its sibling sentinels in dynusers and replication, it is a plain errors.New value intended for errors.Is matching, letting the REST layer return 4xx rather than 500 for client mistakes.

Source

Thrown at cluster/rbac/manager.go:31

import (
	"encoding/json"
	"errors"
	"fmt"
	"maps"

	"github.com/weaviate/weaviate/usecases/auth/authorization/rbac"

	"github.com/sirupsen/logrus"

	cmd "github.com/weaviate/weaviate/cluster/proto/api"
	"github.com/weaviate/weaviate/usecases/auth/authorization"
	"github.com/weaviate/weaviate/usecases/config"
	usecasesNamespaces "github.com/weaviate/weaviate/usecases/namespaces"
	"github.com/weaviate/weaviate/usecases/schema/namespacing"
)

var ErrBadRequest = errors.New("bad request")

type Manager struct {
	authZ       *rbac.Manager
	authNconfig config.Authentication
	logger      logrus.FieldLogger
}

func NewManager(authZ *rbac.Manager, authNconfig config.Authentication, logger logrus.FieldLogger) *Manager {
	return &Manager{authZ: authZ, authNconfig: authNconfig, logger: logger}
}

func (m *Manager) GetRoles(req *cmd.QueryRequest) ([]byte, error) {
	if m.authZ == nil {
		return json.Marshal(cmd.QueryGetRolesResponse{})
	}

	subCommand := cmd.QueryGetRolesRequest{}
	if err := json.Unmarshal(req.SubCommand, &subCommand); err != nil {

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Fix the invalid request payload (role/user definition, namespace fields) before resubmitting.
2. Match with errors.Is(err, rbac.ErrBadRequest) in handlers to return a 422/400 response instead of 500.
3. Regenerate client bindings from the current OpenAPI/proto schema if the payload shape changed after an upgrade.

Example fix

// before
if err := rbacManager.UpdateNamespace(ctx, ns); err != nil {
    return err // 500 for a client mistake
}
// after
if err := rbacManager.UpdateNamespace(ctx, ns); err != nil {
    if errors.Is(err, rbac.ErrBadRequest) {
        return apierrors.NewUnprocessableEntity(err)
    }
    return err
}

// Validate RBAC payload before update
if ns == nil || ns.Name == "" || len(ns.Permissions) == 0 {
    return fmt.Errorf("invalid namespace/role payload")
}

func isRBACBadRequest(err error) bool {
    return errors.Is(err, rbac.ErrBadRequest)
}

if err := rbacManager.UpdateNamespace(ctx, ns); err != nil {
    if isRBACBadRequest(err) {
        return respond(422, err.Error())
    }
    return respond(500, err.Error())
}

When it happens

Trigger: Calling rbac Manager.CreateUser or namespace create/update with an invalid role/user definition or malformed payload; requests rejected during validation in the RAFT command path.

Common situations: Malformed RBAC role or user definitions from automation; missing required permissions fields; clients built against an older API schema submitting payloads the current server rejects.

Related errors

• ErrBadRequest
• ErrBadRequest
• bad request
• no roles or users to restore: %w
• no roles to remove permissions from: %w

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/59c44fe5f902a089. Report an issue: GitHub.