Look up a console error message
When a read or an action fails, the console shows a heading and a sentence. This page lists every one of those headings exactly as it appears on screen, so searching the words in front of you finds the explanation. Twelve of the thirteen returned nothing on a search of this documentation before this page existed.
The headings below are grouped by what you should do about them, because that is the only grouping that helps at the moment you are reading one.
It is about your permission or an approval
Not permitted
Your role does not permit this action. The control should have been gated before you could reach it, so seeing this heading means the engine refused a direct request rather than a click. Check the capability your role holds in roles and capabilities.
Verify your identity
The action needs a fresh identity check that was not completed. Your session is still active, so you have not been signed out. Try again and approve the passkey prompt. If the prompt keeps returning and never accepts, see step-up re-authentication, which covers that specific failure and how to tell it from a device problem.
Awaiting approval
The apply needs a second authorised identity to approve this exact plan, and the approver must differ from you. Raise or open the approval, then apply once it is approved. See dual control for restores.
It is a setup step, not an outage
These three mean the engine and console are not wired to each other correctly. None of them is a fault in your data, and none is transient, so retrying will not help.
Engine CONSOLE_ORIGIN is not set to this console
The engine is reachable but does not allow this console’s origin, so the browser blocks the response. Set the engine’s CONSOLE_ORIGIN to this console’s URL.
This console was deployed without its engine binding
The console proxies the engine on its own hostname through a service binding, and this deploy has none, so the engine is receiving nothing at all. The engine URL is not the problem and may be perfectly healthy: restore the ENGINE service binding in the console’s deploy. That distinction matters, because this state used to be reported as a wrong address and sent people to correct something that was already right.
That address answered with a web page, not engine data
Something served a web page where the engine’s data was expected. Check the engine URL, and that the engine is deployed and healthy. A proxy or a hosting placeholder in front of the engine answers this way too.
It is the engine, or the path to it
Could not reach the engine
The request did not complete at all. Check the engine is reachable on its custom domain and try again.
The console answered for the engine, and the engine did not
The proxied call failed inside the console itself, so the engine never received it. Check that the engine Worker is deployed, is not deleted and is within its limits. This is distinct from the engine returning an error: there is nothing in the engine’s own logs to find, because the request never arrived.
The engine returned an error
The request reached the engine and it failed. Nothing was changed. Retry, and if it persists check the engine logs, which will have the refusal.
The engine answered, but the response could not be read
The request reached the engine and completed, but the response could not be understood. This is not a reachability problem, so checking the network will not help: it usually means a version mismatch between the console and the engine. Update them to matching versions.
The engine is rate limiting requests
Too many requests reached the engine at once. Nothing was changed. Wait a moment and try again; where the engine tells the console how long to wait, the message says. Bulk actions pace themselves, so this is more likely from several people or several tabs acting at once than from one fleet action.
It is Cloudflare Access
Your Cloudflare Access session needs refreshing
The engine returned a Cloudflare Access page where data was expected. Re-authenticate through Access and try again.
Your Access session is not valid
Re-authenticate through Cloudflare Access to continue.
What every one of these has in common
Each says whether anything changed, and where a message says nothing was changed, nothing was: the refusal happened before the write. So none of these headings is a reason to go looking for a half-applied action.
Last updated .