Check API Calls

Check Management API calls

• Do you have a Management API Access Token?

• Did the access token expire?

• Did the access token contain the scopes needed for the call you made?

• If a rule adjusts the scopes in the access token or checks whether specific users are allowed to have the scopes, have you checked the rule to make sure it is executing correctly?

• Get the access token from a HAR file and test it in the Auth0 Management API Explorer to see if it works there.

  Before sharing a HAR file with anyone (including Auth0), ensure that you remove or obfuscate all sensitive data, such as:

  • Confidential user information
  • Personal identifiable information (PII)
  • Confidential application information

  To learn more, read the following articles on Auth0 Community:

  • Sanitizing HTTP Traces
  • How to Sanitize an HTTP Trace File Automatically
  • How to Manually Redact Sensitive Information
  • HAR File is Too Large to Upload to the Support Case

• If you are calling the Auth0 Management API from an application that authenticates with Client Credentials Flow, note that rules are not executed in this context. For functionality similar to a Rule, an Action in the Machine to Machine Flow on the credentials-exchange trigger can be used in this context instead.

Check other API calls

• Check in the HAR file if the access token contains correct scopes to call the API.

  Before sharing a HAR file with anyone (including Auth0), ensure that you remove or obfuscate all sensitive data, such as:

  • Confidential user information
  • Personal identifiable information (PII)
  • Confidential application information

  To learn more, read the following articles on Auth0 Community:

  • Sanitizing HTTP Traces
  • How to Sanitize an HTTP Trace File Automatically
  • How to Manually Redact Sensitive Information
  • HAR File is Too Large to Upload to the Support Case

• Check if the response to the /authorize endpoint call contains a scopes object. If so, check if the returned scopes are different from the requested scopes.

• Make sure your API can validate the Access Token. It should validate the audience, issuer, client (if any), signature algorithm, signature, claims and permissions.

• If you experience errors with access token expiration, they could be caused by clock skew differences manifested across different systems or even different language libraries, such as Java and Node.js. This can be handled by running NTP on servers and configuring a clock skew tolerance in libraries used to validate tokens such as jwt.verify.

See the Monitoring page for more details on each of the log events that can help you troubleshoot issues.

Learn more

• Call Your API Using the Authorization Code Flow with PKCE
• Call Your API Using the Authorization Code Flow
• Call Your API Using the Client Credentials Flow
• Call Your API Using the Device Authorization Flow