Skip to content
Cloud Score Docs

Troubleshooting

The messages Cloud Score puts in front of you, grouped by the page that shows them, with what caused each one and what to do next.

On this page

How to use this page

Every line in the first column is copy Cloud Score actually renders: an error line, a badge, an empty state, or the message a refused request carries back to your application. Find the line, read why it appeared, then do the thing in the third column.

Two places tell you more than any single message can. The Route board in the Playground shows which stage a request stopped at, and the Request detail drawer in Logs shows the same board for a request that already ran, with its error and its attempts.

Some messages are deliberately vague

Sign-in answers the same 401 for an unknown address and for a wrong password, the gateway answers the same 401 for an unknown key and for a disabled one, and sign-up collapses several server refusals into one line. That is on purpose: it stops the forms telling an attacker which accounts and keys exist.

Message by message

Grouped by the page that shows the message.
You seeWhyWhat to do
Sign in and sign up
Invalid email or password.The sign-in call answered 401. An unknown address and a wrong password produce the same line, so the form never reveals which accounts exist.Retype the password. With no workspace yet, use Create an account and see Create your account.
Sign in is temporarily unavailable. Please try again.A connection or server failure prevented sign-in. Invalid credentials have their own uniform message; throttling shows the server detail and retry interval.Wait a minute and try again. If it keeps happening, check that your Cloud Score backend is reachable from the browser.
Account creation is temporarily unavailable. Please try again.A connection or server failure prevented account creation. Closed signup and throttling show their server detail separately.Retry after a temporary failure. If public signup is closed, contact your installation operator. To join an existing organization, ask its Admin to create your Member account.
This email is already registered.The sign-up call answered 409. Addresses are stored lower-cased and must be unique.Use the Sign in link at the foot of the form.
Enter your name. · Enter a valid email address. · Use at least 8 characters.The sign-up form checks its required fields in the browser before it sends anything.Fix the field the line sits under. The hint At least 8 characters. comes back once the field is valid.
Not authenticated or Dashboard could not be loadedThe Dashboard request failed. An expired session can cause an authentication error; a failed refresh may keep the last successful snapshot with a warning.Sign in again if the session expired, or use Retry dashboard after a temporary failure.
Playground
missing or invalid API keyHTTP 401. The value in Platform API key is unknown or belongs to a disabled key; the text is identical for both.Paste a live key whose Status badge reads Enabled. A key held by Save for session is cleared by signing out or by any visit to the sign-in page.
no enabled model matches the required capabilities and context windowThe Match stage ended with nothing: no enabled model carries every ticked Required capabilities box, or none has a large enough context window.Enable more models on Models, or untick a capability. The Match station reports how many were left.
policy selection requires a sandbox API keyHTTP 403. Policy checkboxes were sent for a key that is not flagged sandbox, which is only reachable when the page holds a stale key list.Reload the page. To hand-pick policies, open that key's ⋯ menu under Admin › API keys and click Sandbox on.
stream closed before completion · internal error · stream errorThe stream ended with no final event, or the backend sent an error event on a pipeline crash.Look the request up in Logs; the recorded row is what the pipeline actually persisted.
Output failed validation. Retrying… · Attempt failed. Rerouting… · Stopped. The request still finishes on the server; open it in Logs for the final numbers.The first two are normal recovery: shown output is discarded and either the prompt is sent again or another model is tried. The third, with the Stopped status, follows Stop.Nothing. Wait for the status badge to settle. A stopped request is still billed and recorded, so read its outcome in Logs.
Integrations
Failed: invalid API key · Failed: unknown error · Failed: request failed · Failed: save failedEvery failed result in the Connect dialog carries the Failed: prefix, then the vendor's own words, for example invalid or unauthorized credentials, API key is required, or unknown provider_type.Fix the field the message names and press Test again. Nothing is stored until Save, so a failed test costs you nothing.
Re-test failed: and Disconnect failed: lines, plus a red line carrying the connection's last error such as HTTP 429Card actions report their own failure with a prefix. The red line under them is the newest failure a background check or a re-test recorded for that connection.Rotate the credential with Edit, then click Re-test. Editing alone never re-checks the connection.
Badge Disconnected on a card you just savedBy design. Test in the dialog never touches the saved row, so a fresh card has no check behind it yet.Click Re-test, or wait for the next background check. The badge then reads Connected or Error.
Models
Discover failed: Azure deployments must be added manually — deployment names are specific to your resource.Azure deployment names belong to your own resource, so Cloud Score refuses to guess them. It is the only outcome Discover Azure AI Foundry models ever has.Have your operator register the deployments through the API. There is no form for them on this page.
Discover failed: provider not found · Discover failed: discover failedThe provider row is gone, or the backend could not fetch the model catalogue.Check the provider still has a card on Integrations, then run Discover again.
Connect a provider in Integrations to populate the registry. · No models yet. Connect a provider above and click Discover. · No models match this filter.No provider is connected, the registry is still empty, or the Provider filter is hiding every row.Connect a provider, run its Discover button, then set Provider back to All providers.
toggle failed · enable failed · disable failed · save failed · Input price must be a decimal number like 1.25A row switch, a bulk action, or the Edit dialog was refused. The first four lines are the fallbacks when a call fails; the price and tier lines are checked in the browser before anything is sent.Prices are plain decimals with at most six decimal places and no currency sign; tiers are whole numbers from 1 to 5. After a failed bulk action, flip the switch on the one row you need.
Policies
blocked by policy '<name>', or the rule's own Block message; in the test panel, BlockedA policy with Block request matched and evaluation stopped there. No provider was called, so the request is recorded blocked and costs nothing.Find the rule on Policies. Evaluation runs from the lowest priority number upward, so the first matching block wins. Narrow its conditions or switch it off.
Save failed · toggle failed · delete failed · reorder failed · test failedThe matching call was refused. reorder failed can appear after only part of a move landed, because moving one row renumbers every policy.Reload the page to see the order that actually saved, then repeat the action. Concurrent edits are never flagged here; the last save wins.
API keys and Guardrails
key has request history — disable it instead of deletingRevoke was refused because the key has already served requests and deleting it would break their audit trail.Click Disable instead. Calls with that key stop at once and its history stays in Logs.
Attached to {n} key(s). Detach them first. · a profile with that name exists · the built-in Observe profile cannot be edited — duplicate it insteadA profile still bound to keys cannot be deleted, profile names are unique per workspace, and the built-in profile is read-only by design.Move keys off with Detach, rename, or start from New profile and copy the rules across.
Scan rules isn't available yet — the backend endpoint hasn't shipped. · Too many scans — wait a moment and try again. · Could not reach the scan preview endpoint.The preview endpoint is missing on this backend, you passed 60 previews in a minute, or the browser could not reach it.After a throttle or a network failure, wait a moment and click Scan again; if the endpoint has not shipped on your backend, the preview stays unavailable until it does. Your profile is untouched either way: the preview stores nothing.
No detectors matched this text.Detection is literal pattern and checksum matching, and findings below the fixed confidence floor are dropped. Published test card numbers fall below it.Test with a realistic value before concluding the profile is off. Spaced digits, base64 and lookalike characters also evade the detectors.
Cost and budgets
budget exhausted: <scope> <scope_value> at <utilization_pct>% (model_spend) or monthly budget exhausted: spent $<spend> of $<budget>A budget gate refused the request before any provider was called, so it is recorded blocked. Which line you get depends on whether pre-flight budgets are on for your install.Raise the amount, or switch At 100 % to warn under Budgets. A sandbox key never skips the gate.
No budgets yet — requests are not gated. Add one above.No budget exists, so no request is admitted against one and nothing is capped.Add one in New budget. warn reports the breach and still serves the request; block refuses it.
No request in range carries a declared reference model, so there is no counterfactual line to draw — set one under Optimization → Settings.Routing savings are measured against a declared reference model, and no row inside the selected range carries one.Pick a Reference model on Optimization settings. Rows already recorded without a reference are still counted, but they are never charted.
Optimization
A large — on the Routing signals tab, or — in every Measured cell, with a hover saying nothing is zero, only unmeasuredThe backend returned no routing signals, so the Routing signals tab and the Measured column on Models have nothing to show. The answer is held for the rest of your session.Read the dash as unmeasured, never as zero. There is nothing to fix in your workspace.
Badge Semantic matching unavailable, or the warning Semantic needs an embedder; without one, requests fall back to exact matchingNo connected provider can produce the 1536-dimension embeddings semantic matching needs.Connect a provider badged Supports embeddings (1536) on Integrations. Until then semantic requests fall back to exact matching rather than failing.
Badges Observe only and Not wired, and the lines Save failed, Purge failed, Body is not valid JSON, Decision check failedObserve only means the control saves your value but nothing acts on it yet; Not wired means no backend code reads the field at all, so the control is disabled but keeps its value. The four lines are the failures of the settings save, the cache purge, and the decision check.Open the badge help for the backend line that proves it. For Body is not valid JSON, fix the JSON in Check a decision before pressing Check decision.
Logs
No requests match these filters.The query returned nothing. The same line appears with and without filters, so it also stands in for a workspace with no traffic yet.Click Clear. model_key is an exact match, and Search intent / preview… searches only the intent and the prompt excerpt.
Failed to load requests · Invalid cursor · Failed to load request detail · Request not foundThe list or the drawer could not load. Request not found also covers an id that belongs to another workspace.Reload the page. Filters live in memory only, so they reset when you navigate away and the view cannot be bookmarked.
(bodies not stored for this key) · Not stored: blocked by AI Security · Not stored: the request included documents · No plan recorded for this request (pre-engine row). · Candidates not recorded for this request — trace predates the candidates array.Prompts are kept only when the key has Store request/response bodies on, the request was not blocked by AI Security, and it attached no documents; the first three lines name which of these applied. The other two lines mean the row predates the feature that would have filled them.Turn body storage on for the key whose previews you want; it applies to requests sent after the change. Optimize against a fresh request rather than an older row.
Organization (Platform)
sum = X.XX — must equal 1.00 and scoring weights must sum to 1.0 (±0.001)The three Scoring weights sliders must total exactly 1.00. The first line is the page's own check, the second the server's.Drag the sliders until the line reads sum = 1.00 ✓. Save platform settings stays disabled until it does.
Badge Heuristic fallback, the option no connected providers — connect one in Integrations, and the save errors model_key is required when provider_id is set and provider not foundNo classifier is configured, or the model you picked belongs to a provider that is not in your workspace. Requests are then classified by built-in keyword rules instead of an LLM.Connect a provider, pick a Model under Classifier, then click Save platform settings. Routing keeps working either way.

Good to know

A dash is never a zero

Across Cloud Score a — means the value was not recorded; a real zero prints as 0 or $0. In Logs a Cost of $0 is a request that made no billed call, while — means the cost is unknown. The same rule explains the unmeasured panel on Signals and the Measured column on Models.

Blocked and failed are different outcomes

blocked means Cloud Score refused before spending anything: a policy, a budget, or AI Security stopped the request. failed means Cloud Score tried and could not deliver, for example no_candidates, provider_error, or validation_failed. Both are recorded. Statuses and badges lists the full vocabulary.

The native endpoint answers 200 even when a request fails

By default the outcome lives in the body, not in the HTTP code: The native API answers HTTP 200 even for failed requests — the outcome lives in status. Always check the envelope, not the HTTP code. If a client reports success on a request Cloud Score blocked, this is why.

Three actions delete without asking

Disconnect on Integrations removes the provider with every model discovered from it and its health history. The trash icon on Policies hard-deletes the rule with its version history. A security profile with no attached keys is deleted with no prompt at all. None of the three can be undone.

Related