Troubleshoot your first environment
This page covers the errors you can meet on the First environment track, from sign-up to the first denied call. Each entry gives the message you see, what it means, and the fix.
Most answers start in Access Activity. In the Admin Portal, under Operate, select Access Activity, then select the row for the failed call. Its Policy Decision names the reason.
Account and environment
Create environment is not available
Your account is still waiting for activation. The Environments page shows Your account is being activated until a PolicyArc admin activates it. You can create an environment once it is active. See Create your account.
The verification link does not work
The link in the verification email lasts 1 hour. Sign in again to get a new one.
Sign-in
The identity provider refuses to send you back
The identity provider does not know the PolicyArc callback URL. Copy the URL from step 2 of the Add a sign-in provider form, Add this redirect URI to your IdP, and register it in your provider's console exactly as shown.
Sign-in ends with access_denied
Policy refused the sign-in. One cause is the denylist. If you added your user to it, open Policy in the Admin Portal, then Controls, then Denylist, and remove your user id from subjects. Select Save and sign in again.
The client says Authentication required
The gateway answered a tool call with the JSON-RPC error Authentication required, code -32001. Your token has expired or was never sent. Tokens on a new environment last one hour. Reconnect the client so it signs in again.
Tool calls
Each message below is the text the MCP client shows as the tool result.
| Message | Reason in Access Activity | What it means | Fix |
|---|---|---|---|
HTTP 403: Access denied | pdp_deny when policy refused the call, with a pdp_reason such as subject_denied. Other reasons come from obligations that policy attached to the call. | Policy, or an obligation it attached, refused the call. | Read the reason. For subject_denied, remove the user from the denylist. |
HTTP 403: Introspection failed | introspection_failed | The gateway's introspection call to the authorization server failed. | Retry the call. If it keeps failing, check the environment's health on its dashboard page. |
Starts with HTTP 502: Upstream request failed: | upstream_request_failed | The gateway passed the call, but the request to the upstream service failed. The rest of the message gives the error. | Retry the call. Check that the upstream service is up. |
The client lists no tools
The environment has no connector yet, or the connector is disabled. In the Admin Portal, open APIs & Connectors and check that the resource is listed under Managed Resources with status Enabled.
A denial still applies after you removed it
The policy engine loads control data on its next bundle poll. Wait a few seconds after Save and try again.
Send feedback about this page