A valid request URL is required to generate request examples{
"environment": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"kind": "live"
},
"checks": [
{
"id": "jwks",
"title": "<string>",
"status": "ok",
"evidence": "<string>",
"fix": "<string>"
}
]
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Run the install doctor
What is wrong with this environment’s integration, with the evidence behind each finding. Readable by any member and never gated by a plan — you cannot fix an installation whose diagnosis you cannot see.
Every check answers one of three statuses, and the third one is the important one:
ok— observed working, with the observation inevidence.attention— observed broken.fixsays what to do about it.unknown— we cannot tell, andevidencesays why. This is never a synonym forok: a check with nothing to go on sends you to look rather than reassuring you, because a wrong reassurance is exactly what stops somebody looking.
The jwks check is the clearest case of that. The key set is a public, cacheable document served through a CDN by design, so a fetch answered from a cache never reaches us — its absence is reported as unknown and phrased “never seen by us”, never “never fetched”.
A valid request URL is required to generate request examples{
"environment": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"kind": "live"
},
"checks": [
{
"id": "jwks",
"title": "<string>",
"status": "ok",
"evidence": "<string>",
"fix": "<string>"
}
]
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Path Parameters
The environment's id.