> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.aptranet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting

> Diagnose authentication, permissions, activation, CDN, DNS, Cloud Shield, and certificate problems.

## API requests

> **401 Unauthorized**
>
> Confirm the bearer value begins with `APTRANET_`, the `Aptranet-Secret` header is present, and the secret matches the current value. A rolled secret stops working immediately.

> **403 Forbidden**
>
> The key is disabled, the secret is wrong, or the key lacks the permission required by the route. Review the key under **Developers**.

> **402 Payment Required**
>
> The product is not active for the organization or its billing state requires attention. Review **Billing → Subscription** and recent invoices.

> **404 Not Found**
>
> Confirm the resource belongs to the key's project and use the documented `/cloud-cdn`, `/cloud-dns`, `/shield`, or `/tls-manager` prefix.

> **429 Too Many Requests**
>
> Honor `Retry-After` when present. Use exponential backoff with jitter and avoid retrying validation errors.

## Cloud CDN

* **Origin error:** request the origin directly, verify its certificate and Host header, then review origin protocol, timeouts, and failover cases.
* **Unexpected cache:** inspect cache-control headers, edge/browser ownership, cache-key inputs, and ignored query parameters. Purge only after correcting the policy.
* **Hostname not serving:** verify DNS points to the distribution hostname and check TLS provisioning before enabling forced HTTPS.

## Cloud DNS

* **Zone not authoritative:** compare registrar delegation with the nameservers returned by Aptranet.
* **Old answer persists:** inspect authoritative data first, then account for resolver and client caches until the previous TTL expires.
* **No routed answer:** verify records are enabled, picker metadata matches the client, and health checks have at least one eligible result.

## Cloud Shield

* **Protection remains pending:** verify the linked CDN distribution and service readiness, then inspect the CDN connection view.
* **Feature unavailable:** check the active plan, add-on, and project permissions. A 403 can reflect any of these controls.
* **Events look old:** inspect the data freshness timestamp, select the correct time range, and confirm traffic reaches the protected distribution.
* **Change outcome uncertain:** refresh state before retrying. A reconciliation error can mean the change applied; contact support with the resource and request time.

## TLS Manager

* **Certificate upload rejected:** verify the PEM chain, matching key, project quota, and unique name.
* **Certificate pending or expired:** review issuance details and retry time for managed certificates; replace imported material before expiry.
* **Certificate deletion rejected:** inspect distribution usage and detach or replace the certificate first. Managed certificates cannot be deleted from the inventory.

Follow the detailed [Cloud Shield](/cloud-shield/investigations) and [certificate lifecycle](/tls-manager/lifecycle) guides for investigation.

For persistent issues, follow the [support checklist](/operations/support).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.