Login, permissions and unavailable models

Role: Any reader; fixes may require the model, connector or service owner. Prerequisites: Know the intended API/profile and preserve the returned error code/request ID. Files: Private profile and relevant model/publication IDs, without sharing token secrets.

Check identity first

enumeray auth profiles
enumeray auth whoami
enumeray model get example

Use the intended --profile. Saved browser sessions renew before expiry while commands are active. A missing credential or expired/revoked refresh session needs login; an expired legacy profile needs one explicit refresh. An origin override does not carry a token to another service. A permissions error can mean a missing token scope, missing resource authorization, suspension or revocation; issuing another identical token cannot bypass policy.

For a reproducible report, capture structured errors separately from normal output:

enumeray --profile research --json auth whoami > identity.json 2> identity-error.json
enumeray --profile research --json model get example > model.json 2> model-error.json

Check each command’s exit status. An API error has a shape like {"status":403,"error":{"code":"insufficient_scope","message":"...","request_id":"..."},"retry_after":null}; the exact code depends on the endpoint. A local file or configuration failure uses client_error and has no HTTP status. Provide the actual error.code and error.request_id to the responsible owner. Keep scientific inputs and credential files out of the report.

To recover a browser profile, remove an unintended environment override, then follow its error guidance:

unset ENUMERAY_TOKEN
enumeray --profile research auth refresh
# If the refresh session is expired, revoked, or its renewal outcome is unknown:
enumeray --profile research auth login
enumeray --profile research auth whoami

A temporary identity-service failure before an exchange leaves credentials available for retry. If the provider might have consumed a rotating refresh token but the replacement was not saved, another login is necessary. If replacement credentials were saved and identity verification failed temporarily, the next command retries verification without exchanging the refresh token again.

Structured local session errors use session_ codes. session_login_required and session_renewal_uncertain require login; session_provider_unavailable and session_profile_busy allow a later retry. session_changed or session_account_mismatch requires selecting the original API/account before resuming. A session_persistence error means credential state could not be saved: preserve the profile and use explicit login if the exchange outcome is uncertain.

HTTP 401 and live-log auth_revoked do not establish whether a credential expired, was revoked, or the account lost authority. The CLI stops on these ambiguous rejections and on HTTP 403; it does not refresh to bypass them. Check scopes and current authority before another login. After recovery, resume the same release/analysis directory or log checkpoint rather than submitting another execution.

For a private-file permissions error, inspect the named path and set a regular file to mode 0600 using chmod 600 profiles.json (substitute the actual profile/prepared/state path). The CLI refuses symlinks; use the original regular file. If the profile points to the wrong API, auth configure intentionally clears its stored credentials, so log in to the corrected service afterward.

Symptom	Check / responsible role
Browser login unavailable	Service OIDC configuration and provider availability; service administrator
Loopback callback rejected	Public native-client redirect rules and PKCE support; provider/service administrator
Local private-file error	File is regular, not a symlink, and mode 0600 on Unix; account holder
Model absent from catalogue	Unlisted visibility, wrong profile/API, or unreadable offering; model owner
Model visible but not runnable	Access mode, block, current publication and installation authorization; model owner
Invitation rejected	Correct recipient account, token value, verified email when required, expiry and prior use; model owner/recipient
Scoped script fails while login works	Exact token scopes and remaining lifetime; token creator
Publication unavailable	Candidate readiness, grant/context status, connector acknowledgement and installation; model/connector owner

Inspect the candidate

Model administrators use model publications and model publication to see status and validation_message. Correct immutable installation/configuration issues through the author and connector workflows. A candidate failure does not replace the working current publication. Users cannot repair readiness by changing run inputs.

# Model owner or co-admin:
enumeray model publications example
enumeray model publication example PUBLICATION_ID
enumeray connector grant available

Use the exact candidate ID from registration. The registering account needs its own active grant; the model owner’s grant does not automatically cover every co-admin. A pending candidate needs the connector’s validation acknowledgement. For a rejected candidate, read validation_message and coordinate the installation fix with the connector owner before registering a new immutable candidate.

For guarded generation or publication conflicts, inspect the current state and the other administrator’s change. Do not repeat a management mutation with a guessed generation. Model visibility, run access, compute grants and OS installation access remain separate.

Expected outcome: The failed boundary and responsible owner are identified. Next: Obtain access or complete publication. Provide the error code and request ID to the owner, keeping credentials and scientific inputs private.