> ## Documentation Index
> Fetch the complete documentation index at: https://developers.aptranet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting

> Diagnose authentication, permissions, activation, CDN, DNS, Cloud Shield, and certificate problems.

## API requests

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    Confirm the bearer value begins with `APTRANET_`, the `Aptranet-Secret` header is present, and the secret matches the current value. A rolled secret stops working immediately.
  </Accordion>

  <Accordion title="403 Forbidden">
    The key is disabled, the secret is wrong, or the key lacks the permission required by the route. Review the key under **Developers**.
  </Accordion>

  <Accordion title="402 Payment Required">
    The product is not active for the organization or its billing state requires attention. Review **Billing → Subscription** and recent invoices.
  </Accordion>

  <Accordion title="404 Not Found">
    Confirm the resource belongs to the key's project and use the documented `/cloud-cdn`, `/cloud-dns`, `/shield`, or `/tls-manager` prefix.
  </Accordion>

  <Accordion title="429 Too Many Requests">
    Honor `Retry-After` when present. Use exponential backoff with jitter and avoid retrying validation errors.
  </Accordion>
</AccordionGroup>

## Cloud CDN

* **Origin error:** request the origin directly, verify its certificate and Host header, then review origin protocol, timeouts, and failover cases.
* **Unexpected cache:** inspect cache-control headers, edge/browser ownership, cache-key inputs, and ignored query parameters. Purge only after correcting the policy.
* **Hostname not serving:** verify DNS points to the distribution hostname and check TLS provisioning before enabling forced HTTPS.

## Cloud DNS

* **Zone not authoritative:** compare registrar delegation with the nameservers returned by Aptranet.
* **Old answer persists:** inspect authoritative data first, then account for resolver and client caches until the previous TTL expires.
* **No routed answer:** verify records are enabled, picker metadata matches the client, and health checks have at least one eligible result.

## Cloud Shield

* **Protection remains pending:** verify the linked CDN distribution and service readiness, then inspect the CDN connection view.
* **Feature unavailable:** check the active plan, add-on, and project permissions. A 403 can reflect any of these controls.
* **Events look old:** inspect the data freshness timestamp, select the correct time range, and confirm traffic reaches the protected distribution.
* **Change outcome uncertain:** refresh state before retrying. A reconciliation error can mean the change applied; contact support with the resource and request time.

## TLS Manager

* **Certificate upload rejected:** verify the PEM chain, matching key, project quota, and unique name.
* **Certificate pending or expired:** review issuance details and retry time for managed certificates; replace imported material before expiry.
* **Certificate deletion rejected:** inspect distribution usage and detach or replace the certificate first. Managed certificates cannot be deleted from the inventory.

Follow the detailed [Cloud Shield](/cloud-shield/investigations) and [certificate lifecycle](/tls-manager/lifecycle) guides for investigation.

For persistent issues, follow the [support checklist](/operations/support).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.