Dial failed: invalid api session id

zrok
1 
{
  "file": "/__w/zrok/zrok/agent/accessPrivate.go:45",
  "func": "github.com/openziti/zrok/agent.(*Agent).AccessPrivate.func1",
  "level": "info",
  "msg": "map[file:/__w/zrok/zrok/endpoints/proxy/frontend.go:133 func:github.com/openziti/zrok/endpoints/proxy.newServiceProxy.func3 level:error msg:error proxying: unable to dial service 'myproxy' (dial failed: invalid api session id, expected 6946e35b-df7f...., got 0777e9cd-....) time:2025-08-25T20:00:12.557331236+02:00]",
  "time": "2025-08-25T20:00:29.397Z"
}




{
  "file": "/__w/zrok/zrok/agent/accessPrivate.go:45",
  "func": "github.com/openziti/zrok/agent.(*Agent).AccessPrivate.func1",
  "level": "info",
  "msg": "map[file:/__w/zrok/zrok/endpoints/tcpTunnel/frontend.go:91 func:github.com/openziti/zrok/endpoints/tcpTunnel.(*Frontend).accept level:error msg:error dialing 'mytunnel': unable to dial service 'mytunnel' (dial failed: invalid api session id, expected b74a458a-....., got fc12ba49-.....) time:2025-08-25T20:03:14.275503887+02:00]",
  "time": "2025-08-25T20:03:14.626Z"
}

zrok 1.1.3 needs to be restarted

2

Try turning off “super network” and report back.

3

The same problem with 1.1.3 even after:

zrok config set superNetwork false

systemctl --user restart zrok-agent.service

{
  "file": "/__w/zrok/zrok/agent/accessPrivate.go:45",
  "func": "github.com/openziti/zrok/agent.(*Agent).AccessPrivate.func1",
  "level": "info",
  "msg": "map[file:/__w/zrok/zrok/endpoints/proxy/frontend.go:133 func:github.com/openziti/zrok/endpoints/proxy.newServiceProxy.func3 level:error msg:error proxying: unable to dial service 'myproxy' (dial failed: invalid api session id, expected d1a57560-..., got 2f9309e8-....) time:2025-08-25T20:42:56.768290676+02:00]",
  "time": "2025-08-25T20:42:57.174Z"
}

zrok 1.1.2 does not have this problem.

4

The only material difference between zrok 1.1.2 and 1.1.3 is the embedded Ziti SDK version.

5

In my previous post I wrote that ziti 1.6.7 does not work with ziti controller 1.5.4

The same problem is reported here.

I have tons of errors on routers while using 1.6.7 with ziti-controller 1.5.4.

I confirm that zrok 1.1.2 work reliably. Zrok 1.1.3 fails in few minutes.

Which version of ziti controller you use to test zrok 1.1.3 ?

These messages we can see in controller’s log (1.5.4) while trying zrok 1.1.3

{
  "_context": "ch{XXX}->u{classic}->i{XXX/r6MG}",
  "error": "invalid api session id, expected 6946e35b-..., got 0777e9cd-...",
  "file": "github.com/openziti/ziti/controller/handler_edge_ctrl/common.go:78",
  "func": "github.com/openziti/ziti/controller/handler_edge_ctrl.(*baseRequestHandler).returnError",
  "level": "error",
  "msg": "responded with error",
  "operation": "create.circuit",
  "routerId": "XXX",
  "time": "2025-08-25T18:00:43.118Z",
  "token": "eyJh...."
}
6

I have installed 1.6.7 on 2 routers. I confirm that zrok 1.1.3 works without this error.

I think there is a problem connecting zrok 1.1.3 to 1.5.4 routers.

So I need to upgrade all 1.5.4 routers to make zrok 1.1.3 work.

7

So I need to upgrade all 1.5.4 routers to make zrok 1.1.3 work.

Isn’t that the exact opposite of what you said previously?

ziti v1.6.8 should correct any issues related to zrok and ziti compatibility.

8

Where you see the opposite?

zrok 1.1.2 does not have this problem while connected to ziti-router 1.5.4

zrok 1.1.3 does have this problem while connected to ziti-router 1.5.4.

zrok 1.1.3 does not have this problem while connected to ziti-router 1.6.7

9

If this doesn’t contradict the above, then I’m not clearly understanding your version reporting.

Running a different version of the ziti controller and the routers adds a layer of unnecessary complexity.

10

Yes, It was a problem to connect ziti-router 1.6.7 to ziti-controller 1.5.4. So some additional configuration should be added to make this possible.

Now. I have upgraded ziti-controller 1.5.4 → 1.6.7.

I have only 2 ziti-routers with 1.6.7. So I have connected zrok 1.1.3 to them.

All other routers are under open-ziti 1.5.4. So all clients run zrok 1.1.2. Because zrok 1.1.3 can not work reliably with these routers.

I have understood that it is impossible to run zrok 1.1.3 with open ziti 1.5.4. But zrok 1.1.2 works fine.

11

This is my development environment (ziti 1.5.4 + zrok 1.1.3+), and it works fine. So I’m not sure we’re getting a clear picture of what’s going on.

12

This is strange. Because it simply does not work for me. I have “invalid api session id” if I connect zrok 1.1.3 to ziti router 1.5.4.

On the other hand, if I connect zrok 1.1.3 to ziti-router 1.6.7 the problem disappears.

13

There’s probably something going on with your ziti configuration that contributes to this issue for you, because those software versions are working fine for me.

Definitely do not mix and match ziti controller and router versions, because that adds yet another variable.

14

I see. If It works fine for you then the problem is somewhere else.

I can not upgrade all routers and services at the same time. Some services run weeks with no stop.

15

zrok version v1.1.3 [193a0f33]

I have just switched on ziti-routers 1.5.4. Full stop.

journalctl --since "5 minutes ago" --user -u zrok-agent.service  -g error | wc -l
88


{
  "file": "/__w/zrok/zrok/agent/accessPrivate.go:45",
  "func": "github.com/openziti/zrok/agent.(*Agent).AccessPrivate.func1",
  "level": "info",
  "msg": "map[file:/__w/zrok/zrok/endpoints/tcpTunnel/frontend.go:91 func:github.com/openziti/zrok/endpoints/tcpTunnel.(*Frontend).accept level:error msg:error dialing 'myTunnel': unable to dial service 'myTunnel' (dial failed: invalid api session id, expected d277cdce-b26b-484c-8c0f-b85b18a7638d, got b04a53f9-272a-4d74-9582-7beb9f1fdf38) time:2025-09-15T17:00:09.121532267+02:00]",
  "time": "2025-09-15T17:00:09.121Z"
}

I should add I use single node HA controller 1.6.7