Troubleshooting
Error codes
Every error the UI or the API returns carries a code. Look up each code's meaning and what to do, by area.
Every gateway error response is {"detail": "<message>", "code": "<code>", "params": {...}}. The UI shows the message in the current language; API clients branch on code. The codes you will meet, grouped by area.
| Code | Meaning | Do |
|---|
login_required | Not signed in or session expired | Sign in again |
bad_credentials | Wrong username or password | — |
login_throttled | Too many failed sign-ins | Try again in 5 minutes |
default_password_refused | Still on the shipped password; remote sign-in refused | Set RST_ADMIN_PASSWORD_HASH; labs may set RST_ALLOW_DEFAULT_PASSWORD=1 |
read_only | A read-only role cannot change things | Ask an administrator |
admin_role_required | Current role has no admin rights | Ask an administrator |
admin_group_required | SSO: not in an RST_RBAC_ADMIN_GROUPS group | Ask the IdP admin |
sso_identity_required | SSO on, but no verified identity on the request | Sign in via the SSO entry; check oauth2-proxy |
csrf_rejected | Cross-site request refused | Act from the product's own pages |
rate_limited | Rate limit hit | Wait params.seconds; raise RST_RATELIMIT_* for big teams |
user_db_not_configured | No user table | Set RST_USER_DB_URL |
last_admin_locked / last_admin_undeletable | The last administrator cannot be disabled / demoted / deleted | Create another administrator first |
cannot_disable_self / cannot_delete_self | Cannot disable / delete yourself | — |
password_too_short / password_min_length | Under 8 characters | — |
password_change_not_supported | SSO accounts cannot change the password here | Change it in the IdP |
| Code | Meaning | Do |
|---|
feature_needs_standard | params.feature needs Standard or higher | Activate a licence |
feature_sealed | No licence, or the licence lacks this feature; the engine cannot be unsealed | Activate a licence that includes it |
trial_quota_exhausted | The unactivated daily quota (params.limit) is used up | Tomorrow, or activate |
license_invalid | Signature / decryption / tamper check failed | Ask sales to re-issue |
license_expired | Expired more than 7 days ago; service locked | Renew |
license_revoked | Revoked | Contact sales |
license_heartbeat_lost | No heartbeat for 7 days; service locked | Check network access to the licence server |
machine_id_unreadable | Hardware identity unreadable | Check the /etc/machine-id mount |
license_activate_failed | Activation refused (params.reason: seats used up, fingerprint mismatch, wrong product …) | Act on the reason |
| Code | Meaning | Do |
|---|
es_unreachable | Cannot reach ES | ES_URL, network, certificate |
es_auth_failed | ES authentication failed | ES_USER / ES_PASSWORD |
es_forbidden | The account cannot read this index | Add role privileges |
es_index_not_found | Index missing | Index / alias name; rolled over and deleted? |
es_timeout | ES query timed out | Busy cluster; narrow range / size; RST_ES_TIMEOUT_S |
es_request_failed | Other ES error (params.reason) | Read the reason |
index_not_whitelisted | Index outside the whitelist (params.patterns) | Add the pattern under Settings |
index_is_internal | The index is the product's own storage, not a query target | Use the matching page |
no_queryable_index | Nothing queryable | Check the connection or widen the whitelist |
dsl_validation_failed | The query failed read-only validation (params.reason) | Change the query |
| Code | Meaning | Do |
|---|
llm_generation_failed | Model call failed (params.reason) | Check provider state under AI models |
llm_timeout | Model call timed out | Raise the provider timeout; send fewer clusters |
llm_first_token_timeout | No answer started within params.limit_s s; aborted | Rephrase and retry; lower reasoning |
embedding_not_configured | No embedding model | AI models → Knowledge-base embedding model |
kb_dims_mismatch / kb_dim_mismatch | KB index dimension differs from the current model | Switch back, or delete .rst_copilot_kb and rebuild |
providers_empty | Provider list is empty | Configure at least one |
connection_test_failed | Test failed (params.reason) | Read the reason |
| Code | Meaning |
|---|
investigation_failed / triage_failed / detection_rule_failed / report_generation_failed / incident_report_failed | That feature failed; params.reason has detail |
detection_rule_rejected | The model declined (vague intent) |
too_many_alerts | At most params.cap alerts per triage run |
alerts_or_index_required | Triage needs either alerts or index |
conversation_not_found / analysis_record_not_found | Missing or expired |
field_dict_failed / explain_log_failed / explain_result_failed | Field dictionary / explanation failed |
kibana_link_failed / kibana_data_view_not_found | Deep link failed; Kibana has no data view for this index |
size_out_of_range / limit_out_of_range / top_k_out_of_range | Parameter out of range (1–500 / 1–200 / 1–50) |
| Code | Meaning | Do |
|---|
alert_webhook_disabled | Webhook push is off | Set RST_ALERT_WEBHOOK_SECRET |
alert_webhook_token_invalid | Wrong X-RST-Alert-Token | Check the Kibana connector header |
alert_not_found | No such alert | — |
push_failed | Delivery failed (params.reason) | See the delivery log |
delivery_not_retryable | Cannot resend (missing, or still queued / in flight) | — |
webhook_must_be_https / webhook_host_invalid / feishu_path_invalid / dingtalk_path_invalid / wecom_key_missing | Bot URL malformed | Copy it verbatim from the bot settings |
smtp_host_required / smtp_port_out_of_range / smtp_from_invalid | Mail server settings malformed | — |
recipients_required / recipient_invalid | Recipients empty or malformed | — |
| Code | Meaning |
|---|
masking_mode_unavailable | Invalid masking mode (params.choices) |
es_url_invalid | ES URL is not a full http(s) URL |
audit_webhook_host_not_allowed | Forwarding target not in RST_AUDIT_WEBHOOK_ALLOWLIST |
audit_webhook_host_link_local | Forwarding cannot target loopback / link-local (169.254.169.254 is cloud metadata, not a SIEM) |
syslog_url_invalid | syslog URL malformed |
content_pack_rejected / release_download_failed / rollback_failed | Content pack / online update signature or download failed |
| Code | Meaning |
|---|
rule_id_invalid | Rule ID must be 3–64 letters / digits / . _ - |
rule_query_required | The collection query (osquery SQL) is empty |
rule_needs_field / rule_needs_expected | This operator needs a judge field / expected value |
rule_operator_invalid / rule_severity_invalid | Invalid operator / severity |
baseline_rule_not_found | No such rule |
