Errors and Troubleshooting

Logs

API events are logged in the Audit Log. API related events are indicated next to the Actor with the API icon:

---

API related events are listed in the Audit Log. You can also quickly navigate to token specific events via the tokens list:

1. From Tokens, select one token row.
2. Click View Audit Events.
3. The Audit Log opens, pre-filtered to this token's events within the last week. Update the filter as needed.

The filtered audit log shows results for a single token. Since accounts can have multiple tokens, it may not include all events for a given user.

---

Error responses

Every endpoint returns the same error shape: a JSON body with an error field describing what went wrong.

Status	Meaning	What to check
400 Bad Request	A parameter or request body failed validation	The response includes a validationFailures array naming each field that failed.
401 Unauthorized	The API token is missing or invalid	The x-material-client-secret header is present and the token is correct.
403 Forbidden	The token is valid, but the account behind it lacks permission	The account's roles. Some endpoints need more than read access, and a few check a per-account setting.
404 Not Found	The resource doesn't exist, or your token can't reach it	The encoded ID, and whether the resource belongs to a tenant your token can access
429 Too Many Requests	You've reached the rate limit on an endpoint that has one	Wait the number of seconds in the Retry-After header, then retry. See Rate limiting below.
500 Internal Server Error	Something failed on Material's side	Retry, then contact support if it persists.

A 403 doesn't always mean your token is under-scoped. Two cases are worth knowing:

• Requesting include=investigation on an OAuth app needs permission to read investigation data on top of app access. Without it you get a 403 rather than a response with the field quietly missing, so a null value always means there's nothing to show.
• Revoking an account's grant of an OAuth app returns 403 when OAuth App Remediation is turned off for that account. That's a per-account setting, not a property of your token.

---

Rate limiting

Some endpoints are rate limited to protect your instance. When you reach a limit, the endpoint returns 429 Too Many Requests with a Retry-After header giving the number of seconds to wait before you try again.

Endpoint	How the limit is counted	When it resets
Search Messages (POST /api/v1/messages/search)	Days searched: each search uses one unit for every day its date range covers	Daily, at midnight UTC
Move Messages to Inbox (POST /api/v1/messages/move-to-inbox)	The number of messages a request targets, shared across every token in your organization	After a short wait

The Search Messages limit applies only if your instance has a daily search budget. When it does, both successful and rate-limited responses include these headers, so you can track your usage as you go:

• X-RateLimit-Limit: your daily budget, in days searched
• X-RateLimit-Remaining: how much of the budget is left
• X-RateLimit-Reset: when the budget resets, as a Unix timestamp in seconds

A rejected search doesn't use any of your budget, so a search with a shorter date range can still go through.

Build retries into any script that runs at volume. When you receive a 429, wait for the time in Retry-After, then retry rather than continuing at the same rate. A 429 doesn't mean anything is wrong with your token.

Before version 1.64, Search Messages returned 400 Bad Request when you reached the limit. If your integration checks for a 400 to detect the limit, update it to handle 429.

The Material MCP server is rate limited separately, with its own limit and its own error format. See Material MCP Server for details.