EQTY LabDocs

Integrity Service Troubleshooting

Common Integrity Service symptoms and first-line checks.

View as Markdown

Use this page for first-line checks when lineage, manifest, certificate, or credential-status workflows fail.

Lineage Graph Is Missing

Confirm the Guardian features.lineage setting is on, Integrity Service is running, and the user holds the view_project_data permission on the project. Guardian loads a project’s lineage from GET /graph/v1/{projectUuid}, and the response tells you which check failed:

  • An empty list. The project has no lineage registered yet; the EQTY SDK has not registered a graph under it.
  • A 403. The caller lacks view_project_data on the project. Policy manifest requests return the same 403.
  • A 404. The project’s root graph was never registered with Integrity Service.

Guardian does not use the GET /graph/v1/ list, which leaves out graphs in projects where the caller lacks view_project_data; only API callers see that filtering.

Authorization Errors

When authentication is enabled, Integrity Service checks each request with Auth Service. A 401 “Failed to authenticate token” means Auth Service rejected the caller’s token. A 503 “Auth Service unavailable” means Auth Service could not be reached or returned a server error; check Auth Service health, then retry.

Certificate Issuance Fails

Confirm Governance Service can reach Integrity Service, signing configuration is healthy, and the supporting policy and evidence records are available.

For agent certifications, a 403 from Integrity Service on a review or on a reviewer’s certification request means the request arrived without Governance Service’s X-Governance-Authorization. Reviews and reviewer certifications go only through Governance Service, so check its AUTH_SERVICE_API_KEY.

Credential Status Is Unexpected

Confirm whether the credential was revoked, the applied policy was archived, or the certificate workflow was retried. Revoked credentials should not be treated as active evidence.

Manifest Is Missing or Incomplete

Confirm the policy, subject, declarations, reviews, and related evidence were available when the manifest was created.

Blob Storage Errors

When Integrity Service cannot reach or read its configured blob store, it returns 503 Service Unavailable with: “Integrity Service blob storage is unavailable or misconfigured. Check the configured provider, bucket/container, region/folder, credentials, permissions, and network access.” Check the configured provider’s credentials, container or bucket name, and network reachability from the service.

Escalation Information

When escalating, include the project, policy or certificate, approximate time, affected workflow, and whether Guardian shows an error. Do not include private key material or sensitive evidence contents in tickets.