Each section is a symptom → cause → resolution table. Messages are quoted the
way the platform emits them, so searching this page for the exact string in
your logs is the fastest route to the answer.
If the symptom is not here, go to Where to look and collect
the evidence before changing anything.
api token has read-only scope; this endpoint requires write scope
A personal access token with read scope was used on an unsafe method. Scope is enforced centrally, not per route.
Mint a token with write scope, or switch the call to a read.
requires role: editor (or higher)
The account's role is below what the endpoint needs.
Have an administrator raise the role, or perform the action as someone who has it.
permission_denied with reason: not_a_member
The account is not a member of the project that owns the resource.
Add the account to the project. Note that a project-scoped token cannot reach outside its project at all.
permission_denied with reason: protected_environment
The target environment is protected; writes to it need an explicit grant regardless of role.
Grant access to the environment, or target a non-protected one.
license_expired
The instance is in read-only mode. Every write is refused platform-wide.
Renew the license. Reads keep working meanwhile.
A 403 naming a feature that is not licensed
The entitlement for that capability is not in the license.
Contact Abrq to extend the entitlement. Enabling it in configuration will not bypass the check.
The RBAC 403 body carries reason, required_capability, project_id and
environment_id — read those rather than guessing which of the four causes
applies. See API.
ABRQ_VERSION is unset, so the tag resolved to something that does not exist for your registry credentials.
Set ABRQ_VERSION in the environment file and verify the resolved image before starting.
Helm install hangs, migration Job never finishes, database shows a lock wait
The pre-install migrator hook Job runs before the in-cluster database is ready, and the two deadlock.
Do not enable the pre-install hook Job against an in-cluster database. Run migrations as a post-install/upgrade step, or point at an external database that is already up.
Pods restart in a loop shortly after becoming ready
Probes are pointed at an endpoint that does not exist, or their timeouts are shorter than startup takes.
Point liveness and readiness at GET /health — it is the only health endpoint; /ready, /readyz and /healthz do not exist. Give the startup probe enough budget for migrations.
One replica works, another rejects every token
The replicas do not share ABRQ_JWT_SECRET (and ABRQ_MASTER_KEY).
Source both from one secret object mounted into every replica.
Structured JSON logs, one object per line, including the request_id that appears in every error response. The platform writes no log files — do not go looking in the container filesystem.
Per-family run-log tables
Persisted logs per run for CDC, streams, file ingestions and ETL, visible in the UI and subject to the retention sweep.
SSE tails
Live log lines while a run is in progress: the CDC log tail and the stream-runs stream.
Audit feed
Who changed which configuration, and when. The first place to check when behaviour changed without a deploy.
GET /health
Whether the framework database and Redis are both reachable, plus the running version and commit.
Tip. When you open a support conversation, include the request_id from
the error response, the version and commit from GET /health, and the
exact message text. Those three make almost every report reproducible.