Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.lasscyber.com/llms.txt

Use this file to discover all available pages before exploring further.

HTTP status401 Unauthorized
Codeunauthorized
Retry?No — refresh credentials and re-issue.

​
When this happens

The request reached the API but authentication failed. Common causes:
  • No Authorization header at all.
  • The header is present but the bearer token is empty / malformed.
  • The API key has been deleted (rotated out).
  • The Auth0 JWT has expired.
  • The Agnes-Version is so old the server cannot accept its credentials.
The 401 is independent of authorisation (your scope set, role, tenant access). Authentication failures are 401; authorisation failures are forbidden (403).

​
Example response

{
  "detail": "Invalid authentication credentials",
  "code": "unauthorized",
  "request_id": "5b3f6c7e-7d24-4d40-9b12-3a59c01c6e91",
  "doc_url": "https://docs.lasscyber.com/errors/unauthorized"
}

​
How to fix

  1. Confirm the Authorization: Bearer … header is set.
  2. Confirm the token’s prefix:
    • ak_ for live keys.
    • ak_test_ for sandbox keys.
    • JWT for Auth0-authenticated dashboard requests.
  3. If using API keys, mint a fresh one in agnes.lasscyber.com/keys and delete the old one once the new one is rolled out.
  4. If using JWTs, sign in again from the dashboard.

​
SDK behaviour

SDKException
Pythonagnes.AuthenticationError
TypeScriptAuthenticationError
Both SDKs surface request_id on the exception. SDKs do not retry 401s automatically; the only way out is to refresh credentials.
  • Authentication — bearer headers, key rotation, version pinning.
  • forbidden — authentication succeeded but authorization failed.