CrowdSec remediation metrics not shown in Console: /v1/usage-metrics returns 400 (feature_flags sent as object, LAPI expects []string)

[nick83972]

Description

The integrated CrowdSec remediation component (Lua) in NPMplus is sending invalid JSON payloads to the CrowdSec Local API (LAPI) for usage metrics. This results in an HTTP 400 error, and as a consequence, no remediation metrics (blocks/processed requests) are displayed in the CrowdSec Console dashboard.

The specific error is a schema mismatch in the feature_flags field. NPMplus sends an object {}, but CrowdSec (since v1.7.x) strictly expects an array of strings [].

Environment

• Image: zoeyvid/npmplus:latest
• NPMplus Version: 2.13.6 (Build 2026-01-20-r2-7a067c6)
• Remediation Component Version: crowdsec-npmplus-bouncer/v1.1.3+2026-01-20-r2-7a067c6-2.13.6
• CrowdSec LAPI Version: v1.7.4-db3efdbf

Logs (from CrowdSec LAPI)

When the bouncer attempts to push metrics, the following error is logged:

time="2026-01-21T14:46:46+01:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.feature_flags of type []string" func=UsageMetrics

time="2026-01-21T14:46:46+01:00" level=info msg="192.168.178.254 - [Wed, 21 Jan 2026 14:46:46 CET] "POST /v1/usage-metrics HTTP/1.1 400 442.833µs "crowdsec-npmplus-bouncer/v1.1.3+2026-01-20-r2-7a067c6-2.13.6" "" module=lapi

[arktisk-varg]

I have the same issue, same setup. Not sure since which update though. Everything works, except the mentioned bouncer-metrics. Where I get the same error message as above.

[ctrlaltdelete007]

Same issue here.

Environment:

• NPMplus: 2026-02-19-r3 (zoeyvid/npmplus:latest)
• crowdsec-npmplus-bouncer: v1.1.3+2026-02-19-r3-17c2a68-2.14.0
• CrowdSec: v1.7.6-eacc8192

All remediation works correctly (decisions + bans are applied).
Only usage metrics are failing.

Every ~15 minutes the LAPI logs:

level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.feature_flags of type []string" func=UsageMetrics

The bouncer POSTs to /v1/usage-metrics and receives HTTP 400.

Looks like feature_flags is sent as an object while LAPI expects []string.

[JoramHhub]

I just installed NPMplus with Crowdsec a couple of days ago. Today I was looking through the console and found an empty Remediation Metrics page. Researching this problem I stumbled upon this issue and confirmed the same log lines as the users above.

As this issue seems to be open for a couple of months I hope it will get picked up so we can get more insights into the workings of Crowdsec.