Troubleshooting
Use the response, request ID and Activity detail to find where a call stopped.
On this page
401: check the identity sent to the gateway
Confirm that the client uses the gateway URL for the intended agent and sends that agent’s current bearer token. A console login session or console API key is not an agent token. Check that the client is not pointing at a different Sallyport environment and that the agent token has not been replaced or revoked.
403 or missing service tools: check the binding
If service tools are missing from an authenticated MCP client, confirm the selected agent and workspace. Check that the agent has an active binding for that service. Open Access requests for a missing binding, paused binding, retired credential or expired grant. For a 403 from the console API, read its error details too: audit export requires an owner, admin or auditor role.
The call is waiting for approval
Open Approvals and review the pending card. Ask the client to continue the original call with the same call_id after the decision. If it was denied, the same call_id returns the recorded denial. If it expired, send the operation again without the old call_id; an expired call was not dispatched.
The upstream service returned an error
Open the call in Activity. If the call reached the upstream service, inspect the returned status and timeline. Check the service’s availability and the binding’s host, allowed method and path. If the call stopped before dispatch, use the recorded decision or policy information to correct the binding or access.
Rotate an upstream key without interrupting access
- Create a replacement key at the upstream provider while the current key still works.
- In Credentials, rotate the Sallyport credential and save the replacement value. Sallyport stores provider keys for dispatch; the key must remain valid at the provider.
- Make a successful call with the new Sallyport credential, then revoke the distinct old key at the provider. Do not revoke the provider key Sallyport still stores before replacing it.
Find the IDs for investigation
Copy request_id from the HTTP error response when one is present; it identifies that API request. In Activity, open the event to see the call_id, agent, binding, credential version, policy and journal sequence. These IDs identify different things, so include both when reporting an issue.