---
title: "Integrity Service Troubleshooting"
description: "Common Integrity Service symptoms and first-line checks."
source: "Guardian Platform"
---
Use this page for first-line checks when lineage, manifest, certificate, or credential-status workflows fail.

## Lineage Graph Is Missing

Confirm the Guardian `features.lineage` setting is on, Integrity Service is running, and the user holds the `view_project_data` permission on the project. Guardian loads a project's lineage from `GET /graph/v1/{projectUuid}`, and the response tells you which check failed:

- **An empty list.** The project has no lineage registered yet; the EQTY SDK has not registered a graph under it.
- **A 403.** The caller lacks `view_project_data` on the project. Policy manifest requests return the same `403`.
- **A 404.** The project's root graph was never registered with Integrity Service.

Guardian does not use the `GET /graph/v1/` list, which leaves out graphs in projects where the caller lacks `view_project_data`; only API callers see that filtering.

## Authorization Errors

When authentication is enabled, Integrity Service checks each request with Auth Service. A `401` "Failed to authenticate token" means Auth Service rejected the caller's token. A `503` "Auth Service unavailable" means Auth Service could not be reached or returned a server error; check Auth Service health, then retry.

## Certificate Issuance Fails

Confirm Governance Service can reach Integrity Service, signing configuration is healthy, and the supporting policy and evidence records are available.

For agent certifications, a `403` from Integrity Service on a review or on a reviewer's certification request means the request arrived without Governance Service's `X-Governance-Authorization`. Reviews and reviewer certifications go only through Governance Service, so check its `AUTH_SERVICE_API_KEY`.

## Credential Status Is Unexpected

Confirm whether the credential was revoked, the applied policy was archived, or the certificate workflow was retried. Revoked credentials should not be treated as active evidence.

## Manifest Is Missing or Incomplete

Confirm the policy, subject, declarations, reviews, and related evidence were available when the manifest was created.

## Blob Storage Errors

When Integrity Service cannot reach or read its configured blob store, it returns `503 Service Unavailable` with: "Integrity Service blob storage is unavailable or misconfigured. Check the configured provider, bucket/container, region/folder, credentials, permissions, and network access." Check the configured provider's credentials, container or bucket name, and network reachability from the service.

## Escalation Information

When escalating, include the project, policy or certificate, approximate time, affected workflow, and whether Guardian shows an error. Do not include private key material or sensitive evidence contents in tickets.

## Related

- [Integrity Service Operations](./operations.mdx) — required configuration and routine health checks
- [RBAC and Membership](../auth-service/rbac-and-membership.mdx) — which roles grant view_project_data on a project
- [Key Configuration](../auth-service/key-configuration.mdx#troubleshooting) — signing checks when certificate issuance fails
- [Deployment Troubleshooting](../deployment/troubleshooting.mdx) — deployment-level checks for certificates and lineage
- [Lineage Graphs](../user-guide/lineage-graphs.mdx) — what users should see once a lineage graph loads