Skip to main content

​
Troubleshooting

​
A request is rejected

Read the structured error code and the HTTP status together before changing anything in the integration. They tell you which of three things to correct: the credential itself (UNAUTHENTICATED), the scope it carries (FORBIDDEN), or the request you wrote (INVALID_REQUEST, TARGET_NOT_APPROVED). None of the three is fixed by retrying. Keep the request ID with the assessment record. It identifies the failing request in a support conversation without exposing credentials.

​
A target is rejected

TARGET_NOT_APPROVED means the value is not approved for the caller’s organization. Read the approved target list again and use a returned value unchanged. Do not substitute a hostname from a ticket, a chat message, or a local configuration file, and do not retry with a credential from another organization. If the target you need is genuinely absent, request the change from Antigen rather than working around it.

​
Event observation stops

Keep the Run ID and the last event position you fully handled. Read the Run’s current state, then reconnect strictly after that sequence. Do not restart at zero unless you intend to reprocess every event as new evidence.

​
A create or lifecycle response is ambiguous

Do not submit a replacement automatically. Load the saved Run ID and inspect its current lifecycle state first. A local failure tells you what your caller knows, not what the Run did, and a second create is a new assessment record rather than a retry.

​
A local wait expires

A wait deadline bounds your process, not the Run. Reconnect later with the saved ID and event checkpoint. Cancel only when ending the assessment is the intended decision.

​
A Run has no findings

No findings is a valid outcome for a completed Run. Record the assessment scope and final state, then follow your organization’s normal review process. Treating it as an integration failure hides a real result.

​
Product resources