VaultPilotVaultPilot
SearchTRRequest a demo
VaultPilotVaultPilot
Request a demoSearch the siteTürkçe

Integration API client gets 401, scope denied, or no data

Use this article when an integration API client receives 401 or a scope-denied response, or gets an empty encrypted snapshot. It covers the /api/public/v1/ secrets, server status, directory status and updates status endpoints.

First checks

  1. Confirm the request goes to the intended endpoint under https://<SERVER_HOST>:1734/api/public/v1/....
  2. Confirm the client is active, not revoked.
  3. Confirm the client ID starts with pmc_ and the client secret starts with pms_.
  4. Confirm the client has the scope that endpoint requires: SECRETS_READ, SERVER_STATUS_READ, DIRECTORY_STATUS_READ or UPDATE_STATUS_READ.
  5. For a secret snapshot endpoint, confirm at least one vault is assigned to the client.
  6. Confirm the consuming system sends Basic auth or both compatibility headers.
  7. Confirm the consuming system sends a GET request without a body.
  8. Confirm the consuming system does not log the authorization header.

Public v1 endpoints are read-only and rate-limited. Oversized credential headers are treated as invalid credentials.

What the errors usually mean

SymptomMost likely cause
401 or auth failureMissing, malformed, wrong or revoked client credentials.
Scope deniedThe client exists but lacks the scope the endpoint requires.
Body sent on GETPublic v1 endpoints do not accept request bodies.
Too many requestsThe client is over the public API rate limit; slow down and retry.
Empty vaults arrayNo vault has been assigned, or the assigned vault has no records.
Hidden or invalid secret IDThe ID is malformed, deleted or outside the client’s vaults; the endpoint returns 403 Integration authorization failed.

Safe evidence

Safe to share privately after redaction:

  • Timestamp of the failing request.
  • Client display name, not the secret.
  • Scope list and vault count.
  • Endpoint path, such as /api/public/v1/server/status, without credentials.
  • Status code and error name.

Never send real client secrets, authorization headers, vault payloads, databases, logs with credentials or screenshots showing secret values.

Still stuck?

Check the troubleshooting guide, then write to support@vaultpilot.io with the version, the steps you took and the exact redacted error. Never attach passwords, vault exports or private keys.

Open the troubleshooting guide

Back to Knowledge base