Troubleshoot Connector
Recover failed approvals, missing mappings, stale shared information, and connections interrupted by credentials or deployment changes.
Start in Organization → Connector → Connections → Connection → Overview in Console. Record the connection ID, active grant revision, affected direction, and last successful synchronization time before changing the connection.
The connection remains pending approval
In Connection → Grants, inspect the product approval that is missing. An administrator for that product must approve the exact requested scope. General Console administration does not replace the product role.
If someone edited the pending selection, earlier approvals no longer apply. Ask the named product administrator to review the replacement revision. After both approvals appear, select Activate connection in Overview and confirm Connected with a successful synchronization.
A resource is missing from the mapping selector
In Connection → Grants, confirm that the source project and receiving asset group are within the active grant. In Overview, inspect the inventory synchronization time and its error. Pending scope expansion does not change the active selection.
If the resource is in scope, in Activity, select Synchronize. After success, reopen Resources → Add mapping and compare the exact resource ID. If the resource was replaced, review the replacement ID instead of reusing the previous mapping. If the source record is absent, inspect it in the source product.
Shared information is stale
In Connection → Overview, compare each direction's last successful synchronization. Degraded indicates that part of the connection is failing; Disconnected indicates that its service connection is unavailable. Inspect the affected direction's error before assuming both directions failed.
For credential errors, in Credentials, inspect the active credential and complete rotation. For a self-hosted transport error, inspect DNS, outbound HTTPS, certificate trust, and clock health on the Connector host using its product deployment reference.
After correcting the error, in Activity, select Synchronize. Confirm a successful result and a later observation for the affected resource. If the source product itself has no later observation, restore its agent or executor connection before treating the received state as fresh.
Connector is connected but protection is absent
In Guard Network protection → Services → Service → Readiness, inspect ownership, origin health, certificates, policy adoption, capacity, and edge enrollment. Then inspect Service → Traffic for requests traversing the edge.
If no traffic reaches the edge, follow Guard cutover verification. An inventory mapping does not change DNS or routes. For an endpoint control, inspect agent capabilities and adoption instead of treating a service mapping as agent enrollment.
A change has an unknown result
In Connection → Activity, open the original source operation reference. For Infra, follow operation recovery. For Guard, inspect the action's per-target executor acknowledgements under response actions.
Restore the connection and read the original result before submitting another change. A connection timeout does not prove that the source rejected the operation, and a fresh request can repeat an effect that already completed.
A restored installation conflicts with an active identity
Pause automation on the restored installation. Keep the clone disconnected while you compare its installation identity with the active installation in Connection → Overview. A copied database does not authorize a second installation to use the same grant.
For Infra, follow Connector administration transfer. For Guard, follow the identity reconciliation requirements in DDoS Connector enrollment. Resume synchronization after the approved installation identity and resource mappings agree.
A customer integration receives a permission error
For 401, inspect the service-account key audience, expiry, and revocation under
Connector → Access → Service accounts → Account → Keys. For 403, inspect
its role, explicit connection and integration bindings, and requested scopes
under Account → Access. Then compare the active selection in
Connection → Grants with the requested source or destination.
Creating an integration registration does not approve its native product grant. Follow Connect a custom integration to complete that approval. A broader key scope does not substitute for it.
A subscription acknowledges events but the catalog is unchanged
In Connection → Events → Subscription → Deliveries, confirm Delivered and record the event ID. Inspect the receiver's durable inbox and downstream worker transaction for that same ID. A successful HTTP response confirms receipt, not business processing.
If the inbox contains the event, recover its worker from that stored record. If the inbox is missing, correct the receiver's acknowledgement order before replaying the retained delivery. Keep the event's stable identity through recovery to avoid repeating an already completed effect.
Collect a support record
In Connection → Activity, collect the failed exchange reference, source operation ID, product and installation IDs, grant revision, and timestamps. Include the visible error and whether one or both directions fail.
Send those references through Solarius support. Exclude credentials, enrollment tokens, raw endpoint evidence, and workload contents from the support record.