machines.delete sometimes misses Digest header

[nschloe]

I noticed recently that some of my calls to machines.delete do not return a Digest header. This happens ]

res = requests.delete(
    f"https://api.keygen.sh/v1/accounts/{account_id}/machines/{fingerprint}",
    headers={
        "Content-Type": "application/vnd.api+json",
        "Accept": "application/vnd.api+json",
        "Authorization": auth,
        "Keygen-Version": "1.7",
    },
    timeout=5,
)

[ezekg]

Can you share a request log of this happening? A request ID would be very helpful, or any other information e.g. error message, etc. The information you've given doesn't give me anything to go off of, unfortunately.

[nschloe]

Sure!

<Response [404]>

Headers:

{
   "Server":"Cowboy",
   "Reporting-Endpoints":"heroku-nel=https://nel.heroku.com/reports?ts=1741345090&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=vfAyVwZxeAlyW3mL8Yaid5ym%2Fy%2F9KaQ9OXzrU2tLz9M%3D",
   "Nel":"{\"report_to\":\"heroku-nel\",\"max_age\":3600,\"success_fraction\":0.005,\"failure_fraction\":0.05,\"response_headers\":[\"Via\"]}",
   "Connection":"keep-alive",
   "Cache-Control":"no-store",
   "Content-Length":"208",
   "Content-Security-Policy":"default-src 'none'; report-uri /-/csp-reports; report-to csp-reports;",
   "Content-Type":"application/vnd.api+json; charset=utf-8",
   "Keygen-Account":"",
   "Keygen-Bearer":"",
   "Keygen-Edition":"EE",
   "Keygen-Environment":"",
   "Keygen-License":"id=\"645993cd-e5f4-40e4-8a43-b35cefd04a8d\", iss=\"2025-01-22 20:09:28 UTC\", exp=\"\"",
   "Keygen-Mode":"multiplayer",
   "Keygen-Revision":"d4852391a19ff0fd17e7de986d4a5337d5fa80ad",
   "Keygen-Token":"",
   "Keygen-Version":"1.7",
   "Referrer-Policy":"strict-origin-when-cross-origin",
   "Report-To":"{ \"group\": \"csp-reports\", \"max_age\": 10886400, \"endpoints\": [{ \"url\": \"https://api.keygen.sh/-/csp-reports\" }] }",
   "Strict-Transport-Security":"max-age=63072000; includeSubDomains",
   "Vary":"Accept, Origin",
   "X-Content-Type-Options":"nosniff",
   "X-Frame-Options":"SAMEORIGIN",
   "X-Permitted-Cross-Domain-Policies":"none",
   "X-Powered-By":"Ruby, Rails, and a lot of coffee. (And the occasional Islay.)",
   "X-Ratelimit-Count":"1",
   "X-Ratelimit-Limit":"60",
   "X-Ratelimit-Remaining":"59",
   "X-Ratelimit-Reset":"1741345091",
   "X-Ratelimit-Window":"1s",
   "X-Request-Id":"e70b41d5-f914-4e73-8621-5331e806f1f6",
   "X-Xss-Protection":"0",
   "Date":"Fri, 07 Mar 2025 10:58:10 GMT",
   "Via":"1.1 vegur"
}

Content:

{
   "meta":{
      "id":"e70b41d5-f914-4e73-8621-5331e806f1f6"
   },
   "errors":[
      {
         "title":"Not found",
         "detail":"The requested endpoint was not found (check your HTTP method, Accept header, and URL path)",
         "code":"NOT_FOUND"
      }
   ]
}

[ezekg]

Per the error message, you're making a request to an API endpoint that doesn't exist (e.g. invalid URL path), so the request is not able to complete the account lookup and routing, meaning there's no private key to use to generate the signature and digest, thus it's skipped. This indicates a bug in your integration, likely due to blank or null values in the URL path:

https://app.keygen.sh/request-logs/e70b41d5-f914-4e73-8621-5331e806f1f6

This behavior i.r.t. certain errors is documented here.

[nschloe]

I believe I understand now what the problem is: The fingerprint in

f"https://api.keygen.sh/v1/accounts/{account_id}/machines/{fingerprint}",

contains a /! I thought I made it URL-safe with

from urllib.parse import quote

quote(fingerprint)

but that doesn't convert slashes by default. This

quote(fingerprint, safe="")

fixes things.

[ezekg]

Glad you figured it out. I believe I've also been bitten by that quirk before. 🙂