Troubleshooting

A short list of things that go wrong and how to fix them. If your error isn't here, check the FAQ and the Glossary.

"Request has unresolved variables"

The URL, a header, a query param, an auth field, or the body contains a {{placeholder}} that doesn't match any enabled variable in the active environment. The error message lists every missing key.

Fix: open the Environments sheet, find the variable, and either enable it or define it. Alternatively, replace the placeholder with a literal value in the request.

If the variable is defined but still missing, check that the active environment is the one you think it is — the URL bar's environment picker is the source of truth.

"Request URL must be absolute after variables resolve"

The URL the server tried to send is not absolute. This usually means:

• The URL bar has no scheme (example.com/users instead of https://example.com/users).
• A variable's value resolves to a relative path (baseUrl was set to api.example.com instead of https://api.example.com).
• A path-only URL was supplied to a body upload that needed an absolute URL.

Fix: prefix the value with https:// or http://.

"Only HTTP and HTTPS URLs are supported"

The proxy only forwards to http:// and https:// targets. ftp://, file://, ws://, and data: URLs are not supported.

Fix: use a different tool for non-HTTP requests. The WebSocket case is not currently supported at all.

"GET requests cannot include a body"

GET and HEAD cannot have bodies, by spec. Rewind enforces this before the request is sent.

Fix: switch the method to POST (or PUT/PATCH/DELETE). If the API you're calling really needs a body on a GET, that API is non-conformant; you'll have to use curl or another tool.

"Request timed out" / "Request cancelled"

• Timed out: the configured timeoutMs elapsed without the upstream returning any response. Either increase the timeout on the request's Settings tab, or investigate why the upstream is slow.
• Cancelled: you (or the runner) called DELETE /api/v1/executions/:id. The red error strip in the response panel reads "Request cancelled".

"OAuth token request failed"

The OAuth 2 client credentials token URL returned a non-2xx response. The error includes the token endpoint's status code.

Fix: double-check the Token URL, Client ID, and Client secret. If your IdP requires a different grant type, this mode isn't right for you — switch to the manual access token flow.

"Browser origin is not allowed"

The web app sent a request whose Origin header is not on the proxy's allowlist. The default allowlist is http://localhost:5173, http://127.0.0.1:5173, http://localhost:8000, http://127.0.0.1:8000. If you're running the web app on a different host or port, the proxy will reject the request.

Fix: run the web app on one of the allowed origins, or extend the allowlist by passing allowedOrigins to createApp in a custom build.

"Local session is not initialized"

Mutating requests (POST/PUT/PATCH/DELETE) require a same-site rewind_session cookie that is set by the first GET request. The cookie has httpOnly and sameSite: "strict". This error appears when the cookie is missing.

Fix: do a regular request first (a GET /health is enough), or refresh the page. If the cookie is being blocked, check that the browser is on the same origin as the API.

"Maximum redirects exceeded"

The configured maxRedirects was hit. Default is 10. Either raise it on the request's Settings tab, or uncheck Follow redirects to inspect the chain.

"Archive checksum failed for …"

A file inside a .rewind archive has a SHA-256 that doesn't match the manifest. The archive is corrupted or was edited after export.

Fix: re-export from the source workspace, then restore again.

"Archive has missing items: attachment:att_…"

The archive references an attachment that isn't in the file. Re-export from the source workspace with includeSecrets: true if the missing attachment is sensitive, or attach the missing file manually before re-exporting.

"Unsafe archive path: …"

The archive contains an entry with .. traversal, an absolute path, or a Windows-style separator. The current implementation extracts into a temp directory, so this is a defense-in-depth check, but the archive is rejected outright. Recreate the archive from a trusted Rewind export — never hand-edit it.

History shows the request but the response is missing

The response body was either too big to store (storageState: "omitted_limit") or the body file is gone (storageState: "missing"). Raise the storage limits, or check that your backups/ directory is intact.

"Database is locked"

SQLite throws this when two processes try to write at the same time. The dev server is the only process that should be writing. If you started the API twice (e.g. once with bun run dev and once with bun run dev:api in another terminal), the second one is the lock holder.

Fix: kill the duplicate, or point the second process at a different SQLITE_PATH.

The sidebar is empty after restart

The local API didn't finish starting before the web app's first loadWorkspace call. Refresh the page. If it persists, check the status bar's API indicator: if it shows a red dot, the API isn't reachable from the web app.

What's next?

• FAQ — short answers to common questions
• The status bar at the bottom of the workspace shows the last response status and duration. It also shows a count of collections, environments, and history entries — a sudden drop in any of these is a hint that something was deleted.
• The backend writes rotating log files in <data-dir>/logs/rewind.log[.1..4]. Each line has a level (INFO, WARN, ERROR) and is JSON-encoded. Path-like values are redacted. See Data and storage for the exact path on your OS.