# callback_url_invalid

> Invalid callback address

- Status: 422 Unprocessable Entity
- Returned by: /api/public
- Operations: [createOrder](https://developers.rivr.io/reference/api-public/createOrder.md)
- Retry (`retryWhen`): `after_fix`
- Did anything happen? (`outcome`): `none` (It did not happen)
- Creating an order in /api/public
- Page in the portal: https://developers.rivr.io/errors/callback_url_invalid
- Try it: `GET https://developers.rivr.io/errors/simulate/callback_url_invalid` answers with the code's exact wire form; `?succeedAfter=N&attempt=K` gives a 200 once `attempt` passes `N`

## What it means

`callbackUrl` is not an address Rivr delivers the order's callbacks to. It must be an absolute `https` address of at most 2048 characters, without user info (`https://user:password@host`) and without a fragment (`#…`), and its host must not be `localhost`, a name under `.localhost` or an IP address in a loopback, private, carrier-grade NAT, link-local, multicast or unique-local range, for example `127.0.0.1`, `10.0.0.5`, `192.168.1.10` or `[::1]`. `message` says which rule was broken. The rule is checked last of the order's rules, before anything is created or changed. Rivr switches it on per environment, starting with the sandbox, and it is checked only where it is on: where it isn't, `callbackUrl` is accepted as before. An order without a `callbackUrl` is not affected.

## What your system does

Send an absolute `https` address to a public host as `callbackUrl`, without user info or a fragment, and send the order again with the same order id. If you build locally: run `rivr listen --forward-to http://localhost:4000` (after `rivr login`) and use the relay URL it prints as `callbackUrl`. It is an https address at the portal that forwards the deliveries to your machine.

## Is it worth retrying?

No, not without changing the call.

`retryWhen`: `after_fix`. Change the request first, as the code's page says: a value, the token, a header or a new key. Then send it.

## Did anything happen?

`outcome`: `none`. **It did not happen.** This call did not do what you asked for and changed nothing else that you can see or that concerns money. Where the code has an `outcomeNote`, it takes precedence.

## Example: /api/public

```http
HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json

{
  "propertyName": "CallbackUrl",
  "message": "CallbackUrl must use https.",
  "errorCode": "callback_url_invalid",
  "code": "callback_url_invalid",
  "type": "https://developers.rivr.io/errors/callback_url_invalid"
}
```

The `title`, `detail`, `message` and `error_description` texts are exactly as the API writes them today.