# When the assistant can't connect or a tool fails

Connection errors show up before a conversation starts, tool errors in the middle of one. This page lists both by what you see, and the limits the server sets for results and runtime.

> **Type:** troubleshooting
> **For:** Anyone whose assistant can't reach Szenera or reports an error from a tool
> **Prerequisite:** none

## The connection fails

The server checks your credential against the platform at the start of a session and on every later request. The session identifier alone opens nothing.

| What you see | Meaning | Solution |
|---|---|---|
| `401` with `error="invalid_request"` | The request carries no credential. | Sign in through OAuth, or send `Authorization: Bearer ak_…`. |
| `401` with `error="invalid_token"` | The platform rejected the credential: expired, revoked, or mistyped. | Sign in again, or use a valid key. An access token `oat_…` is valid for one hour. |
| `404` with `{"error": "no_session"}` | The session has expired. It lives for 24 hours and every call extends it. | Nothing to do: the client starts a new session by itself. Reconnect if it doesn't. |
| `400` with `{"error": "no_session_id"}` | The header `Mcp-Session-Id` is missing or malformed. | Use a client that follows the MCP specification. |
| The sign-in fails right away | The client didn't pass on the permissions (`scope`) the server names, and the authorization server rejects a request without them. | Update the client. The permissions are in the resource metadata and in the `401` answer. |

A `401` always carries the header `WWW-Authenticate` with the address of the resource metadata, so a client that supports OAuth knows where to sign in.

## A tool fails

A failed tool answers with three fields: `error`, `hint` (one sentence in English), and `correlationId`, with which the operations team finds the call again.

| `error` | Meaning | Solution |
|---|---|---|
| `unauthenticated` | The platform rejected the credential (`401`). | Sign in again. |
| `permission_denied` | The credential lacks the permission (`403`). The hint names the area. | Allow the area again, or use a key with the permission, see [Permissions and consent](/mcp/permissions). |
| `not_found` | There is nothing with this identifier in your organization (`404`). | Take the identifier from a list fetched with the same credential. |
| `conflict` | The object changed since it was read (`409`). | Read it again and decide again. |
| `invalid_input` | The platform rejected the values (`422`). | Check the values. Field paths from the platform's answer are kept. |
| `no_seat_available` | All booked seats of your organization are taken (`402`). | Book another seat in the portal, or delete a display you no longer need. |
| `rate_limited` | The rate limit is used up (`429`). | Wait and try again, see [Throttling and rate-limit headers](/api/rate-limits). |
| `platform_unreachable` | The API doesn't answer. | Try again later. The server can do nothing without it. |
| `timeout` | The time for the call has run out. | Ask a narrower question, for example with a filter or a smaller list. |
| `canceled` | The call was canceled, for example because the connection dropped. | Call it again. |
| `unexpected` | The platform answered in a way the server can't classify. | Try again later, and give the `correlationId` to support. |

## A writing tool does nothing

That is the preview. Without `confirm: true`, a writing tool reads the current state and answers with `"status": "preview"` and `"executed": false`. The assistant shows you the effect and calls the tool again with the same values and `confirm: true`. Only then does it answer `"status": "executed"`.

## Limits

| Limit | Default |
|---|---|
| Runtime of a tool call | 30 seconds |
| Runtime of a single call to the API | 15 seconds |
| Length of a result | 20,000 characters, anything beyond that is visibly cut off |
| Entries in a list | 50 per answer, which also caps the requested page size |
| Idle session | 24 hours, every call extends it |

The operator of your environment can set these values differently.

## Related

- [Connect an AI assistant](/mcp/connect-assistant)
- [Permissions and consent](/mcp/permissions)
- [The error format](/api/error-format)