Skip to content

Troubleshooting (end users)

This page helps site owners and contributors quickly solve common issues.

Login and permissions

“I can’t access the Hub”

  • Ensure you can log in with your ECMWF account.
  • If you’re redirected repeatedly, try a private browser window.
  • If the Hub is down for everyone, escalate to the platform team.

“I can see the site but I can’t edit settings”

You’re probably not an administrator of that site.

  • Ask a site admin to add you as an admin user/group.

401 from API

  • A 401 only comes from the password-prompt flows: WebDAV and .htpasswd protected pages. Token-based Site API calls answer 403 instead — see below.

403 from API

  • A required token may be missing, invalid, or expired.
  • Send a Site API token to the regular Site API endpoint. Public files on a public site use the unauthenticated /s/api/v2/pub/files/ endpoint.
  • Ensure the header is Authorization: Bearer <token>.
  • For uploads, check that the token allows writes (a read-only token gets 403 on any write). For Hub actions, check that you have site administrator access.

405 from API

  • The platform is in read-only mode (usually a maintenance window). While it's on, write requests answer 405 with a read-only warning; reads keep working. Check the Hub or ask the platform team.
  • Write requests to the public files endpoint don't answer 405: they get 404, because that endpoint only implements GET and HEAD. Send writes to the regular /s/api/v2/files/ endpoint with a token.

S3 requests return 403

  • The session token (X-Amz-Security-Token header or AWS_SESSION_TOKEN) must carry its type prefix: Master <token> or Bearer <token>. A bare token is not recognised. See WebDAV and S3 interfaces.

A POST to a public site answers 403

A public site answers read-only methods only (GET, HEAD, OPTIONS, PROPFIND, SEARCH). A POST, PUT, PATCH, or DELETE answers 403 before it reaches a custom application. A token does not help: the public handler has no authentication step. When the input fits in the URL, use GET. Use a private site for an application that needs a request body.

Content issues

“My files are missing” (public sites)

For requests to the public Site API:

  • If a directory or a parent directory contains .htpasswd, listings omit the protected subtree and requests to it return 404 intentionally.

So 404 can mean:

  • file doesn’t exist
  • OR file exists but is hidden by .htpasswd

Check your content tree for .htpasswd in the directory and its parent directories. Browser and WebDAV requests to protected paths use HTTP Basic Authentication.

Upload fails

Common causes:

  • expired/incorrect token
  • insufficient permissions
  • path not allowed
  • service temporarily unavailable

Quick checks:

  1. Call the health endpoint.
  2. Try uploading a small file.
  3. If it only fails for large uploads, it might be a timeout issue.

Site health

Health endpoint fails

Try:

  • GET https://<domain>/<space>/<site>/s/api/v2/health/

Call it with a Site API token (or open it in a browser as a site administrator). If it fails:

  • wait a minute and retry
  • attempt a restart (if you’re a site admin)
  • check hub status

Signed URL problems

Signed URL returns 403

  • It may have expired.
  • It may be for a different file URL.

Signed URL returns 404

  • The target URL might be wrong, or the resource might no longer be available.

When to escalate

Escalate to the platform team when:

  • the Hub is down
  • multiple sites are failing
  • you see repeated 5xx errors
  • the problem persists after retries

Include:

  • site space + name
  • timestamps
  • the endpoint you called
  • the HTTP status code