Skip to main content
Question

Chronicle API / v1alpha & v1beta / Method: customFieldValues.batchUpdate: 500 stream terminated by RST_STREAM with error code: NO_ERROR

  • March 23, 2026
  • 2 replies
  • 37 views

u6004331239
Forum|alt.badge.img+1

This is a bug in the API implementation’s infra, most likely.

If/when there’s a better place for this report, please let me know.

When I attempt to send a new customFieldValue to a case, the first request’s status code is 500 and the message is:

{
"error": {
"code": 500,
"message": "stream terminated by RST_STREAM with error code: NO_ERROR",
"status": "INTERNAL"
}
}

The second attempt will succeed without any issues.

I suspect that the infra component which is responsible of responding to the HTTP request is in a cold state and an LB or similar just responds with the 500 message when the infra component is not warm yet. Idk, but something like that is happening there.

A bash script for reproducing the issue:

TOKEN=$(gcloud auth print-access-token --impersonate-service-account= [removed by moderator] 2>/dev/null)

echo "=== 10 attempts with 1s gap ==="
for i in $(seq 1 10); do
echo -n "Attempt $i: "
curl -s -w "HTTP_%{http_code}\n" -o /dev/null -X POST \
"https://us-chronicle.googleapis.com/v1alpha/projects/redacted/locations/us/instances/redacted/cases/caseIDhereInt/customFieldValues:batchUpdate" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"requests":[{"customFieldId":1,"identifier":caseIDhereInt,"values":["curl-batch-test"]}]}'
sleep 1
done

Note, there must be a customField with ID 1 and with scopes CASE available:

TOKEN=$(gcloud auth print-access-token --impersonate-service-account= [removed by moderator] 2>/dev/null)
curl -s -X POST \
"https://us-chronicle.googleapis.com/v1alpha/projects/redacted/locations/us/instances/redacted/customFields" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"displayName": "test",
"type": "FREE_TEXT",
"scopes": "CASE"
}'

2 replies

u6004331239
Forum|alt.badge.img+1
  • Author
  • March 23, 2026

Looks like the custom field value listing is broken, at least in us. Also in v1beta. Tried also the get method and it seems to be also broken. I added fault tolerance by sending the request three times. That did not help here.

TOKEN=$(gcloud auth print-access-token \
--impersonate-service-account= [removed by moderator] \
--scopes=https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/chronicle-backstory \
2>/dev/null)
INSTANCE="projects/redacted/locations/us/instances/redacted"
curl -s -w "\n--- HTTP status: %{http_code} ---\n" -X GET \
"https://us-chronicle.googleapis.com/v1alpha/${INSTANCE}/cases/caseIDhere/customFieldValues" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json"
{
"error": {
"code": 500,
"message": "stream terminated by RST_STREAM with error code: NO_ERROR",
"status": "INTERNAL"
}
}


Forum|alt.badge.img+13

I checked with our Engineering team and they advised this is a known issue, and a fix is rolling out.  I don’t have the exact date for the rollout unfortunately, other than it is in progress.  Thank you for reporting it, and apologies for the inconvenience.