Identify the failed check before changing the request.
Inspect a rejected application programming interface (API) request. Decide whether the problem is the credential, its intended API, or the permission for the action.
Why this lesson?
A developer must find why an Inventory application programming interface (API) rejected a request. They need to fix the request while keeping the required security checks enabled.
Learning goal and prerequisites
Inspect the rejected request
The API returns invalid_token. Open Claims & checks to review the signature, issuer, time limits and audience. Choose a diagnosis in the checkpoint, then use Reveal diagnosis to read the explanation.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Security failures are easier to diagnose when the checks are examined in a consistent order. Randomly changing token validation, audiences, or permissions may make one request succeed while removing the protection that was supposed to reject a bad request.
Start with identity and credential validity. Is the caller using the authentication method this service expects? Is the token or session genuine, within its time limits, issued by the expected authority, and intended for this resource? If the credential is sender-constrained, is the proof or certificate binding also valid?
Then move to authorization. Does the credential grant the requested action? Does local policy allow access to this particular resource, tenant, ownership relationship, or delegated task? A valid token can still fail because it is for the wrong API or lacks the required permission.
Use the error response and inspected values as evidence. Change only the condition that is actually wrong. Do not disable signature checks, accept every audience, or grant broad scopes just to remove an error. Good troubleshooting preserves the security model while explaining exactly which check failed and why.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.