# API key errors

Source: https://docs.graphops.xyz/platform/errors/api-keys

Each error below is identified by the `code` in the [error response](/platform/errors#error-response). The response's `docsUrl` links to the matching entry on this page.

## `api_key_class_not_allowed`

Key not accepted by this API · HTTP 401 Unauthorized

A query key works only with GraphOps data services, and a service account API key works only with the platform API.

**What to do:** Call the platform API with a service account API key, and data services with a query key.

## `api_key_create_failed`

API key could not be created · HTTP 500 Internal Server Error

GraphOps hit an unexpected error while creating the API key.

**What to do:** Retry the request. If the error continues, contact support.

## `api_key_disabled`

API key disabled · HTTP 403 Forbidden

GraphOps support disabled this API key, so requests made with it are rejected.

**What to do:** Contact GraphOps support to find out why, or create a new key and use it instead.

## `api_key_explorer_query_not_allowed`

Service account cannot run explorer queries · HTTP 403 Forbidden

Service accounts cannot run explorer queries.

**What to do:** A service account cannot run explorer queries; query data services with a query key instead.

## `api_key_grant_class_mismatch`

Permission not available to a query key · HTTP 400 Bad Request

The request gives a query key a platform API permission. A query key holds only data services; platform API permissions belong to a service account.

**What to do:** Remove those permissions from the key, and grant them to a service account instead.

## `api_key_grant_duplicate`

API key permission listed twice · HTTP 400 Bad Request

The request lists the same permission more than once.

**What to do:** List each permission once, then retry the request.

## `api_key_grants_required`

API key permission required · HTTP 400 Bad Request

The request does not choose any permission for the API key.

**What to do:** Choose at least one service for the key to query, then retry the request.

## `api_key_id_conflict`

API key could not be issued · HTTP 409 Conflict

GraphOps could not generate a unique API key after several attempts. No key was issued.

**What to do:** Retry the request. If the error continues, contact support.

## `api_key_name_required`

API key label required · HTTP 400 Bad Request

The new label for the API key is empty.

**What to do:** Enter a label that names the key's workload and environment, such as `production-indexer`.

## `api_key_not_active`

API key not active · HTTP 409 Conflict

Only active API keys can be rotated. This key has already been revoked or rotated.

**What to do:** Create a new key with the same services instead.

## `api_key_not_found`

API key not found · HTTP 404 Not Found

No API key with this ID exists in the organization.

**What to do:** Refresh the API keys page, and check that you are in the organization that owns the key.

## `api_key_origin_invalid`

Invalid allowed origin · HTTP 400 Bad Request

An allowed origin on one of the key's services is not a valid origin. An origin is a lowercase scheme and host with an optional port and no path, such as `https://app.example.com`, or a wildcard for one label, such as `https://*.example.com`.

**What to do:** Correct the origin, then retry the request.

## `api_key_origin_not_allowed`

Origin not allowed by API key · HTTP 403 Forbidden

The API key is valid and includes this service, but the key limits this service to allowed origins and the request came from a browser origin that none of them match.

**What to do:** Call from a page on one of the origins the key allows for this service, matching its scheme, host and port exactly, or use Edit access on the API keys page to add this origin to the service.

## `api_key_origin_required`

Browser origin required by API key · HTTP 403 Forbidden

The API key limits this service to allowed origins, so the service accepts only browser requests from those origins. This request sent no `Origin` header, as requests from servers, scripts, `curl` and native gRPC clients do not.

**What to do:** Call from a page on one of the origins the key allows for this service, or use a key whose access to this service has no origin limit for requests from servers and scripts.

## `api_key_permission_not_held`

Permission not held by you · HTTP 403 Forbidden

The request gives a service account a permission you do not hold in this organization. A service account can hold only permissions held by the person who creates or edits it.

**What to do:** Remove the permission the error names from the service account, or ask an organization owner to make the change.

## `api_key_restriction_duplicate`

API key limit lists an item twice · HTTP 400 Bad Request

A limit on the API key lists the same item more than once.

**What to do:** List each network, Subgraph, deployment or origin once, then retry the request.

## `api_key_restriction_empty`

API key limit is empty · HTTP 400 Bad Request

A limit on the API key has no items. A limit must name at least one item.

**What to do:** Add at least one item to the limit, or remove the limit so the service is not limited.

## `api_key_restriction_invalid`

API key limit item not valid · HTTP 400 Bad Request

An item in a limit on the API key is not in the expected format, such as a malformed Deployment CID or network ID. A malformed allowed origin is reported as `api_key_origin_invalid`.

**What to do:** Check the item against the format the API keys documentation shows, then retry.

## `api_key_restriction_not_found`

API key limit item not found · HTTP 400 Bad Request

A limit on the API key names a network the service does not offer, or a Managed Subgraph or Endpoint Alias that does not exist in the organization.

**What to do:** Choose items from the lists on the API keys page, then retry the request.

## `api_key_restriction_too_many`

API key limit has too many items · HTTP 400 Bad Request

A limit on the API key, such as a service's networks or allowed origins, lists more items than one key allows.

**What to do:** Remove items from the limit, or split the workload across several keys with smaller limits.

## `api_key_restriction_unsupported`

API key limit not supported · HTTP 400 Bad Request

The request sets a limit the permission does not support, such as allowed origins on Substreams or on a service account permission.

**What to do:** Remove that limit from the service, then retry the request.

## `api_key_revoke_failed`

API key could not be revoked · HTTP 500 Internal Server Error

GraphOps hit an unexpected error while revoking the API key.

**What to do:** Refresh the API keys page to check whether the key was revoked, then retry if needed. If the error continues, contact support.

## `api_key_rotate_failed`

API key could not be rotated · HTTP 500 Internal Server Error

GraphOps hit an unexpected error while rotating the API key.

**What to do:** Refresh the API keys page to check whether the key was rotated, then retry if needed. If the error continues, contact support.

## `api_key_route_not_allowed`

Route not covered by API key · HTTP 403 Forbidden

The API key is valid and includes this service, but the path you called is not one of the service's endpoints.

**What to do:** Check the request host and path against the service's endpoint documentation.

## `api_key_target_not_allowed`

Target not allowed by API key · HTTP 403 Forbidden

The API key or service account is valid and holds the permission, but its limits do not allow the target the request names, such as the network, Endpoint Alias, deployment or Managed Subgraph. A service account limited to named Managed Subgraphs is also refused by requests that name no Managed Subgraph.

**What to do:** Call a target the limits allow, or change the limits: Edit access on the API keys page for a query key, or edit the service account.

## `api_key_unauthorized`

API key not accepted · HTTP 401 Unauthorized

The request has no valid API key for this service or the platform API. The key may be missing, malformed, unknown or revoked, or not include the service you called. Data services accept only query keys, and the platform API accepts only service account API keys.

**What to do:** Send an active key that includes this service, in the format shown on the service's authentication page. For the platform API, send an active service account API key.

## `api_key_update_access_failed`

API key access could not be changed · HTTP 500 Internal Server Error

GraphOps hit an unexpected error while changing the API key's access.

**What to do:** Refresh the API keys page to check whether the change was saved, then retry if needed. If the error continues, contact support.

## `api_key_update_name_failed`

API key label could not be changed · HTTP 500 Internal Server Error

GraphOps hit an unexpected error while changing the API key's label.

**What to do:** Retry the request. If the error continues, contact support.

## `api_keys_limit_reached`

API key limit reached · HTTP 409 Conflict

The organization already has the maximum number of active API keys.

**What to do:** Revoke keys you no longer use, or contact support to raise the limit.

## `api_keys_list_failed`

API keys could not be loaded · HTTP 500 Internal Server Error

GraphOps hit an unexpected error while loading the organization's API keys.

**What to do:** Retry the request. If the error continues, contact support.

## `authorization_unavailable`

Authorization temporarily unavailable · HTTP 503 Service Unavailable

GraphOps could not check the API key because authorization is briefly unavailable. The request was not served.

**What to do:** Retry after a short wait. If the error continues, check GraphOps status or contact support.

## `credits_exhausted`

Credits exhausted · HTTP 403 Forbidden

The API key is valid, but the organization has no credits left, so its services are paused.

**What to do:** Top up credits on the Billing page. Service resumes automatically once the balance is above zero.

## `usage_access_paused`

Service access paused · HTTP 403 Forbidden

The API key is valid, but GraphOps support paused services for the organization. Adding credits does not restore access.

**What to do:** Contact GraphOps support to find out why and to restore access.