Docs / Troubleshooting
Troubleshooting
Symptom, cause, fix. If your problem is not here, write to hello@protet.io with the exact message and what you ran.
Account and sign-in
No verification email
Check spam, then request a new link (the response is always {"status": "ok"}, whether or not the address is registered):
curl -X POST https://protet.io/auth/resend-verification \
-H "Content-Type: application/json" -d '{"email": "you@example.com"}'
Re-sends are limited to 5 per hour per source address.
Login says "invalid email or password"
The email or password is wrong (the message is the same for both, on purpose). If you forgot the password, use Sign in and the reset link, or POST /auth/forgot-password. "account suspended" (403) means the account was suspended; write to us.
Sign-up returns 422
The body is invalid: email must be a valid address and password 8 to 256 characters. The detail list names the field.
Tokens and 401 / 403 / 429
| You see | Cause and fix |
|---|---|
401 authentication required | No Authorization: Bearer header, or the session token (valid 1 hour) expired. Log in again. |
401 invalid refresh token: malformed ingest token ... | The value is not a complete ingest token. Copy the whole token from the dashboard; no quotes or line breaks. It is shown once; mint a new one if lost. |
401 from /v1/ingest | You sent the refresh token to the ingest endpoint. Trade it first at /v1/ingest/refresh and send the short-lived access token (valid 1 hour). |
401 invalid or revoked license key | The pull token was revoked or mistyped. Mint a new one under Pull tokens. |
403 | The endpoint is not available on your plan (for example /v1/usage on an on-prem account, or /portal/ingest-token without a cloud plan), or the account is suspended. |
429 too many ... | Rate limit hit. Limits are per hour: 5 sign-ups, 5 re-sends, 5 resets per source address; 10 logins per email and address. Wait up to an hour. |
The GitHub Action
Remember the Action is in preview and does not currently produce a trustworthy verdict (status). Separately from that:
"no token provided: monitoring disabled for this job"
The token input was empty. The secret name must match (${{ secrets.PROTET_TOKEN }} needs a repository secret called PROTET_TOKEN). Pull requests from forks never receive secrets, so monitoring is off there by design.
"execve audit rule not confirmed" or "no events captured"
The runner could not enable auditd. It needs Linux and sudo. Hosted ubuntu-* runners work; macOS, Windows and locked-down self-hosted runners are not supported yet.
No pull request comment
By design a comment is only created for a malicious verdict, and the job needs pull-requests: write in permissions and a pull_request trigger. Every run still writes the job summary.
A run reports benign but should not have
This is the known preview limitation. Do not treat a benign result from the Action as proof the build was checked.
The job takes longer
The Action waits up to about 30 seconds to flush events and up to about 90 seconds for the verdict at the end of the job.
Sending events yourself
422 naming binary and args
You sent a joined cmd string. Send the executable path in binary and its arguments in args. See Integrations.
Events accepted but no verdict
The ingest-to-verdict path is in preview; accepted events do not currently turn into a verdict you can rely on.
Usage
/v1/usage returns 503
The metering service is temporarily unreachable. Retry in a minute.
Usage does not match my builds
A session is one monitored pod's lifetime (one monitored job in GitHub Actions). Counts reset each calendar month, at the time resets_at shows.
On-prem: bundle, license
GET /v1/bundle returns 202
A new bundle is being built. Wait 30 seconds and request again; later requests are served from cache.
Bundle request returns 403 "no plan assigned"
Your account has no on-prem plan. Free cloud accounts do not have a downloadable bundle. Write to hello@protet.io.
Services stop at start-up
With license enforcement on, an expired license stops the services with the reason in the log. A license or bundle that does not match LICENSE_PUBLIC_KEY or BUNDLE_PUBLIC_KEY is also refused. Fetch fresh keys from /v1/public-keys, re-download the license, and check days remaining in the dashboard.
Pods stuck in ImagePullBackOff
The image registry needs credentials: create a docker-registry secret and set global.imagePullSecret.
Helm: "modelBundle.keySecretName is required with modelBundle.url"
Pull-on-start needs a secret holding your pull token. Create it and set modelBundle.keySecretName (see Helm values). Also set signing.bundlePublicKey.
Intel feed
404 under /intel/v1/
Only the files listed in the feed guide exist. The old /package-analysis addresses redirect to the new ones or are gone.
503 with Retry-After
The storage behind the feed is briefly unavailable. Retry after the number of seconds given.