List Rejected Resources

GET /environments/{env_id}/rejected_resources

List Rejected Resources

List configuration resources in the environment that at least one data plane node is currently refusing to apply. A save can succeed at the API and still be rejected at a gateway — for example when an older gateway version does not recognize a newer field. A rejected resource is skipped in full, never partially applied, while the rest of the configuration keeps serving. Entries clear automatically within about five minutes once no node reports the rejection anymore. An empty data array means no resource is currently rejected.

Parameters

• env_id (path, string, required): Environment ID that scopes the request.

Responses

• 200: OK

• data (array, required): Resources currently rejected by at least one data plane node, most recently reported first. Empty when every node has accepted the whole configuration.

• data[].kine_key (string, required): Delivery key of the resource as published to data plane nodes, in the form /aisix/<environment id>/<resource kind>/<resource id>. Always present, even when it cannot be parsed into resource_kind and resource_id.

• data[].resource_kind (string, required): Resource collection parsed from the delivery key — for example models or api_keys. Empty when the key does not follow the expected form.

• data[].resource_id (string, required): Resource ID parsed from the delivery key. Empty when the key does not follow the expected form.

• data[].last_error_kind (string, required): Category of the most recent rejection, as classified by the rejecting node. bad_key: the delivery key did not match the expected /aisix/<environment id>/<resource kind>/<resource id> form. non_json: the delivered value was not valid JSON. schema_failed: the value was valid JSON but failed the resource kind's schema. parse_failed: the value passed the schema but the node still could not load it — usually a field mismatch between the saved resource and the node's gateway version. unknown_kind: the key referenced a resource kind the node's gateway version does not recognize.

• data[].last_error (string, required): Verbatim error message from the most recent rejection.

• data[].rejected_by_dps (array, required): dp_id of each gateway certificate whose nodes are currently rejecting the resource. Matches dp_id in the data plane nodes list, so a fleet where only some nodes reject a resource — for example during a rolling upgrade — can be narrowed to the affected nodes.

• data[].first_seen_at (string, required): Time when the rejection was first reported.

• data[].last_seen_at (string, required): Time when the rejection was most recently reported.

• data[].stale_serving_since (string, optional): Present when every node rejecting this resource is still serving the resource's last accepted values — requests keep working with the previous configuration while newer saves are not applied. The timestamp is the oldest moment any node fell back to the previous values, and it survives node restarts. Absent when at least one rejecting node has no previous values to fall back to; the resource is fully out of service on such nodes and needs urgent attention.

• 400: Request body or parameters failed validation.

• error (object, required): Error details.

• error.code (string, required): Machine-readable identifier. Examples: UNAUTHENTICATED, INVALID_REQUEST, MASTER_KEY_UNSET, INTERNAL.

• error.message (string, required): Human-readable explanation; safe to surface to operators.

• 401: Missing or invalid bearer. Response fields (application/json): identical to GET /environments/{env_id}/rejected_resources, response 400 above.

• 404: Resource not found. Response fields (application/json): identical to GET /environments/{env_id}/rejected_resources, response 400 above.

• 503: The deployment is not configured to serve this data. Response fields (application/json): identical to GET /environments/{env_id}/rejected_resources, response 400 above.

cURL

curl -X GET '$AISIX_CP/environments/{env_id}/rejected_resources' -H 'Authorization: Bearer $AISIX_TOKEN'