Skip to main content

​
API requests

Confirm the bearer value begins with APTRANET_, the Aptranet-Secret header is present, and the secret matches the current value. A rolled secret stops working immediately.
The key is disabled, the secret is wrong, or the key lacks the permission required by the route. Review the key under Developers.
The product is not active for the organization or its billing state requires attention. Review Billing → Subscription and recent invoices.
Confirm the resource belongs to the key’s project and use the documented /cloud-cdn, /cloud-dns, /shield, or /tls-manager prefix.
Honor Retry-After when present. Use exponential backoff with jitter and avoid retrying validation errors.

​
Cloud CDN

  • Origin error: request the origin directly, verify its certificate and Host header, then review origin protocol, timeouts, and failover cases.
  • Unexpected cache: inspect cache-control headers, edge/browser ownership, cache-key inputs, and ignored query parameters. Purge only after correcting the policy.
  • Hostname not serving: verify DNS points to the distribution hostname and check TLS provisioning before enabling forced HTTPS.

​
Cloud DNS

  • Zone not authoritative: compare registrar delegation with the nameservers returned by Aptranet.
  • Old answer persists: inspect authoritative data first, then account for resolver and client caches until the previous TTL expires.
  • No routed answer: verify records are enabled, picker metadata matches the client, and health checks have at least one eligible result.

​
Cloud Shield

  • Protection remains pending: verify the linked CDN distribution and service readiness, then inspect the CDN connection view.
  • Feature unavailable: check the active plan, add-on, and project permissions. A 403 can reflect any of these controls.
  • Events look old: inspect the data freshness timestamp, select the correct time range, and confirm traffic reaches the protected distribution.
  • Change outcome uncertain: refresh state before retrying. A reconciliation error can mean the change applied; contact support with the resource and request time.

​
TLS Manager

  • Certificate upload rejected: verify the PEM chain, matching key, project quota, and unique name.
  • Certificate pending or expired: review issuance details and retry time for managed certificates; replace imported material before expiry.
  • Certificate deletion rejected: inspect distribution usage and detach or replace the certificate first. Managed certificates cannot be deleted from the inventory.
Follow the detailed Cloud Shield and certificate lifecycle guides for investigation. For persistent issues, follow the support checklist.