---
title: unauthorized — Unauthorized
description: "HTTP 401 unauthorized: A valid bearer token is required."
canonical_url: "https://cascades.crscreditapi.com/docs/api/errors/unauthorized"
doc_version: "1.0.0"
last_updated: "2026-10-09T18:04:24Z"
http_status: 401
source: config/api_error_codes.yml
---

# `unauthorized` — Unauthorized

**HTTP 401 Unauthorized**

Message: "A valid bearer token is required."

Envelope schema: `ErrorEnvelope` in [openapi.json](https://cascades.crscreditapi.com/openapi.json#/components/schemas/ErrorEnvelope) ([YAML](https://cascades.crscreditapi.com/openapi.yaml)).

## What causes it
- No `Authorization: Bearer <token>` header was sent (the response carries `WWW-Authenticate: Bearer realm="api"`).
- The token is unknown, expired (default lifetime is 90 days), revoked, or belongs to a deactivated API client (`WWW-Authenticate: Bearer error="invalid_token"`).
- The header used a different scheme (`Basic`, `Token`) or the token was sent as a query parameter.

## How to fix it
1. Send the key exactly as `Authorization: Bearer <key>`; the scheme is case-insensitive, the key is not.
2. Mint a fresh key from the API & MCP page if yours has expired or was revoked, and rotate it in your secrets store.
3. Never retry a 401 in a loop — repeated unknown-token attempts from one IP earn a temporary `rate_limited` ban.

## Operations that return it
Any operation can return this code.
- [GET /workflows](/docs/api/workflows/list-workflows) — List workflows
- [POST /workflows](/docs/api/workflows/create-workflow) — Create a workflow
- [POST /workflows/generate](/docs/api/workflows/generate-workflow) — Generate a workflow from a prompt
- [GET /workflows/{id}](/docs/api/workflows/get-workflow) — Show a workflow
- [PATCH /workflows/{id}](/docs/api/workflows/update-workflow) — Update a workflow
- [DELETE /workflows/{id}](/docs/api/workflows/delete-workflow) — Delete a workflow
- [GET /workflows/{id}/test_cases](/docs/api/workflows/list-workflow-test-cases) — List sandbox test cases for a workflow
- [POST /workflows/{id}/trigger](/docs/api/workflows/trigger-workflow) — Trigger a workflow
- [GET /workflow_templates](/docs/api/workflow-templates/list-workflow-templates) — List published templates
- [GET /workflow_templates/{id}](/docs/api/workflow-templates/get-workflow-template) — Show a template (with definition)
- [GET /executions](/docs/api/executions/list-executions) — List executions
- [GET /executions/{id}](/docs/api/executions/get-execution) — Show an execution
- [POST /executions/{id}/cancel](/docs/api/executions/cancel-execution) — Cancel an execution
- [POST /executions/{id}/re_evaluations](/docs/api/executions/re-evaluate-execution) — Re-evaluate an execution
- [POST /executions/{id}/review_decisions](/docs/api/executions/submit-review-decision) — Approve or deny a paused review
- [GET /executions/{id}/review_events](/docs/api/executions/list-review-events) — List review audit events
- [POST /executions/{id}/review_assignment](/docs/api/executions/assign-review) — Claim or unassign a review
- [POST /executions/{id}/review_notes](/docs/api/executions/add-review-note) — Append a review note
- [POST /executions/review_bulk_actions](/docs/api/executions/bulk-review-actions) — Bulk approve / deny / assign_to_me
- [GET /executions/{id}/report_artifacts](/docs/api/executions/list-report-artifacts) — List credit-report PDFs for an execution
- [GET /executions/{id}/report_artifacts/{artifact_id}](/docs/api/executions/get-report-artifact) — Download a credit-report PDF
- [GET /executions/{id}/notice_artifacts](/docs/api/executions/list-notice-artifacts) — List adverse-action notice PDFs for an execution
- [GET /executions/{id}/notice_artifacts/{artifact_id}](/docs/api/executions/get-notice-artifact) — Download an adverse-action notice PDF
- [POST /workflows/{id}/batches](/docs/api/batches/create-batch) — Create a batch from N rows
- [GET /batches](/docs/api/batches/list-batches) — List batches
- [GET /batches/{id}](/docs/api/batches/get-batch) — Show a batch
- [GET /batches/{id}/executions](/docs/api/batches/list-batch-executions) — List child executions of a batch
- [POST /batches/{id}/cancel](/docs/api/batches/cancel-batch) — Cancel a batch
- [POST /batches/{id}/resume](/docs/api/batches/resume-batch) — Resume an interrupted batch
- [POST /batches/{id}/retry_failed](/docs/api/batches/retry-failed-batch) — Retry failed and skipped rows
- [GET /batches/{id}/exports.csv](/docs/api/batches/export-batch) — Download flat results CSV
- [GET /batches/{id}/exports.zip](/docs/api/batches/export-batch-zip) — Download structured ZIP of batch results
- [GET /batches/{id}/adverse_action_notices.zip](/docs/api/batches/download-batch-adverse-action-notices) — Download all adverse-action notice PDFs as a ZIP
- [GET /webhook_subscriptions](/docs/api/webhooks/list-webhook-subscriptions) — List webhook subscriptions
- [POST /webhook_subscriptions](/docs/api/webhooks/create-webhook-subscription) — Create a webhook subscription
- [GET /webhook_subscriptions/{id}](/docs/api/webhooks/get-webhook-subscription) — Show a webhook subscription
- [PATCH /webhook_subscriptions/{id}](/docs/api/webhooks/update-webhook-subscription) — Update a webhook subscription
- [DELETE /webhook_subscriptions/{id}](/docs/api/webhooks/delete-webhook-subscription) — Delete a webhook subscription
- [POST /webhook_subscriptions/{id}/rotate_secret](/docs/api/webhooks/rotate-webhook-secret) — Rotate the signing secret
- [GET /webhook_deliveries](/docs/api/webhooks/list-webhook-deliveries) — List webhook deliveries
- [GET /webhook_deliveries/{id}](/docs/api/webhooks/get-webhook-delivery) — Show a webhook delivery
- [POST /webhook_deliveries/{id}/retry](/docs/api/webhooks/retry-webhook-delivery) — Manually retry a failed or dead delivery

## Example response

```http
HTTP/1.1 401 Unauthorized
Content-Type: application/json
```

```json
{
  "error": {
    "code": "unauthorized",
    "message": "A valid bearer token is required.",
    "details": [],
    "request_id": "6f1c2a3e-8d4b-4c5e-9f0a-1b2c3d4e5f60",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/unauthorized"
  }
}
```

## Related
- [/docs/concepts/scopes-and-keys](/docs/concepts/scopes-and-keys)

[All error codes](https://cascades.crscreditapi.com/docs/api/errors.md)

## Sitemap

See the full [sitemap](https://cascades.crscreditapi.com/sitemap.md) for all pages.