How do I investigate a failed API call or access denial?

When something in LUSID fails or is refused, the platform has already recorded what happened. LumiCode puts that record a command away: /api-history shows every API call made against your domain, not just your queries, and /access-history shows every entitlement decision, including which entitlement was checked and what decided it. Together they turn "access denied" into a specific answer you can act on or pass to an administrator.

Prerequisites

LumiCode installed and signed in. See How do I install LumiCode?
To see everyone's API calls in your domain, not just your own, the GlobalMetadataVisibility activity on the Lusid.Logs.AppRequest provider.
To see everyone's access checks, the Insights accesslogs-view-all permission.

Methods

Method 1: Find a failed API call

Type /api-history and press Enter.
Choose how far back to search: the last quarter of an hour, hour, day or week, or an exact range.
Optionally, narrow the search to one application.
For Include Started, leave it off. Each request is logged when it arrives and when it finishes, and the arrivals have no status or duration.
For Errors only, choose yes. Then, for Error contains, enter some text from the error, or leave it blank for any error.
For Show Extra, choose yes to include everyone's requests, if you're entitled to see them.

LumiCode lists the matching requests under a histogram of when they happened. When looking at all the api-calls, not just the failed ones, you will see different colours in the bars based on the result status. Press Esc at any question to go back one step.

In the list:

Key	What it does
↑ ↓ and Enter	Opens the full detail of a request: who called what, how long it took and what it answered.
`/`	Filters on the URL, endpoint, user or error text.
`d`	Changes the wide column between the URL, the controller and method, the error and the failure.
`h`	Hides the histogram.

In a request's detail, c copies its request ID and t keeps the request in the transcript. If the request started a query, d diagnoses that query. See How do I diagnose a failed query?

Method 2: Find out why access was denied

Type /access-history and press Enter.
Choose how far back to search, and optionally narrow it to one application.
For Show Extra, choose yes to include everyone's checks, if you're entitled to see them.
Find the denial in the list. / filters on the resource, action, entitlement or user.
Press Enter on it. The detail shows who asked for what, which entitlement was checked, what decided it, and whether it was granted or denied.

In the list, d changes the wide column between the resource, the entitlement, what was authoritative and the request ID, and h hides the histogram.

Method 3: Trace a denial back to its API call

A denial tells you what was refused. The API call behind it tells you what was being attempted at the time.

In /access-history, open the denial and press c to copy its request ID.
Open /api-history and search the same period.
Press / and paste the request ID.

Good to know

Requests and checks load as you scroll, up to the limit set by /set history-cap. Filtering with / loads them all first.
When you close either screen, the search and its table stay in the transcript.

Troubleshooting

I can't see a colleague's requests

Without Show Extra, LumiCode shows only your own requests and checks. With it, you see everyone's only if you have the entitlements listed under Prerequisites. Contact your LUSID administrator if you need them.

The list stops short of what I expected

LumiCode loads up to /set history-cap entries. Search a shorter period, narrow it to one application, or raise the limit.