Diagnose a failed REST request in order: URL, connectivity, credentials, permission, payload, rate limit, then server health. That order prevents changing code when the real problem is a missing slash or wrong key.
Fast diagnostic flow
- Confirm HTTPS, host, API version, username, app slug and endpoint slug.
- Confirm the route’s trailing slash.
- Confirm the key exists in the process environment without printing its value.
- Check that the key type and scopes match the route.
- Read the status and JSON error details.
- Check rate limits, timeout and server status before retrying.
Authentication versus authorisation
401 means the service cannot accept the credential. Check the Bearer header, variable name and token validity. 403 means the identity is known but the requested resource or operation is not permitted; check endpoint visibility, app ownership and key scopes.
Use a minimal safe probe
curl -i "$MEOW_API/v1/$MEOW_USERNAME/weather-station/readings/" \
-H "Authorization: Bearer $MEOW_APP_API_KEY"Code language: JavaScript (javascript)Run a read-only request first. It distinguishes connectivity and authentication from write validation, and it avoids creating or deleting data while you diagnose the client.
Safe request logging
print({"method": method, "url": url, "status": response.status_code,
"request_id": response.headers.get("X-Request-ID")})Code language: PHP (php)Log the route, status, duration and request ID, but redact Authorization headers, keys and sensitive payload values.
Retryable failures
Do not retry 400, 401, 403 or 404 unchanged. For 429, respect the server’s delay guidance. For transient 500 or 503, retry a small number of times with exponential backoff and then surface the request ID for investigation.
Escalation record
When asking for help, provide the UTC time, method, route without secrets, status, sanitized response code, request ID, client version and the smallest reproducible request.
Next step
Return to the status-code guide or apply the complete production checklist.