Administration troubleshooting

Use this page when Administration or the sign-in screen shows a message you do not understand. Find the exact text in the tables below, then do what the row says.

Find your message

Copy the message exactly as it appears, and search this page for it.
Read the What it means and what to do column in that row.
If the message says you cannot do something, your role probably lacks a permission. Ask an administrator, or check the permission reference.
If no row matches, open the page for that area, for example Users, Sign-in security or Platform.

Note

Messages from the server appear as the server wrote them, and where the server gives a reason, that reason is what you see. Some appear inside a form field instead of as a notification.

Users and accounts

You see	What it means and what to do
User registered successfully	The user was created. Nothing to do.
Email already taken.	A user with this email already exists, in any letter case. Use another email, or open the existing user.
One or more invalid role IDs provided	A role you picked was deleted in the meantime. Reload the page and choose roles that exist.
Passwords do not match	The password and its confirmation differ. Type both again.
Password must be at least 8 characters	The password is too short. Meet every rule in the checklist under the field.
Password must contain at least one uppercase letter	Add an uppercase letter.
Password must contain at least one lowercase letter	Add a lowercase letter.
Password must contain at least one number	Add a number.
Password must contain at least one special character	Add a special character.
Password may only contain letters, numbers and followed by a list of symbols	The password uses a character that is not allowed. Remove accents, spaces and emoji, and use only the listed symbols.
At least one role is required	Tick at least one role before you save.
User updated successfully	The changes on the user form were saved. Nothing to do.
You have `<n>` unsaved changes. If you leave now, your changes will be discarded.	You are closing an editor with pending changes. Select Keep editing to go back, or Discard changes to lose the edits.
Are you sure you want to change the name of this user to "`<name>`"?	Name changes ask for a confirmation. Confirm to save the new name, or cancel to keep the current one.
Invalid File with Please upload an Excel file (.xlsx or .xls)	Batch Add accepts only Excel files. Start from Download Template.
File Too Large with Maximum allowed file size is 10 MB.	The file is too large. Keep each file under 5 MB, because the server refuses larger files. Split the list into several files.
Batch registration is unavailable: no active email notification config found	Batch Add needs an active default Email integration. Open Notifications and make an Email integration active and default.
Failed to parse the provided Excel file	The file is damaged or is not a valid workbook. Start again from Download Template.
No worksheet found in the Excel file	The workbook has no sheet to read. Start from Download Template.
`Excel file exceeds the maximum allowed rows. Maximum: 300, provided: <n>`	The file has more than 300 user rows. Split it into files of at most 300 rows.
Name is Required, Email is Required, Email is invalid or Invalid role(s): `<name(s)>`	A row was skipped in Batch Add for this reason. Select Download skipped, fix those cells and upload the file again.
Uploading and processing users…	The file is being processed. Wait; large files take a moment.
Registration completed with skips	Some rows were not registered. Select Download skipped, fix those rows and upload the file again.
All users registered	Every row was registered. Nothing to do.
User deleted successfully, Users deleted or `<n> user(s) deleted successfully.`	The deletion worked. Nothing to do.
Some users could not be deleted or Deletion failed	The batch delete did not remove every user. Check the list of users shown. Your own account and the system user cannot be deleted.
Deletion failed for all users.	None of the selected users could be deleted. Read the names in the dialog. Your own account and the built-in system account cannot be deleted; try again for the others.
Users deletion partially succeeded. or `<deleted> deleted, <failed> failed.`	Some selected users were deleted and others were not. Read the names that failed, then try again for those.
All users were deleted successfully.	Every selected user was deleted. Nothing to do.
`<n>` user(s) will be deleted. This cannot be undone.	The batch delete confirmation counts the selected accounts. Confirm to delete; the run cannot be undone.
No users match your criteria	The search or the Selected only filter found nothing. Clear the search or turn off Selected only.
There are no other users that can be deleted.	No accounts are left that you can delete. Nothing to do.
Cannot delete your own account.	Ask another administrator to delete your account.
Cannot delete the system user.	The built-in system account cannot be deleted.
You cannot deactivate your account.	Ask another administrator to deactivate your account.
You cannot remove admin role from your account.	Ask another administrator to remove the Admin role from your account.
User must have at least one role	A user always needs a role. Assign another role first, then remove this one.
User status updated to Active or User status updated to Inactive	The status changed. Nothing to do.
User activated successfully or User deactivated successfully	The status changed. Nothing to do.
Are you sure you want to deactivate this user? or Are you sure you want to activate this user?	Status changes ask for a confirmation. Confirm to apply the change, or cancel to keep the current status.
Are you sure you want to delete user?	The delete confirmation for one account. Confirm to delete the account and its direct access; deleting cannot be undone.
Failed to update user name	Try again. If it keeps failing, check that your role includes Edit User Name.
User name updated successfully	The name changed. Nothing to do.
Invalid image with Please upload a JPEG, PNG, WebP, or GIF image.	Choose a photo in one of these formats.
Invalid image with Image is too large. Maximum size is 5 MB.	The photo is larger than 5 MB. Choose a smaller file.
You can only modify your own avatar	You can change only your own photo. To change another user's photo, your role needs Edit User Name.
Profile photo updated. or Profile photo removed.	The photo change was saved. Nothing to do.
User permissions updated successfully	The custom permissions were saved. Nothing to do.
Failed to save user permissions	The custom permissions were not saved. Try again. If it keeps failing, check that your role includes Edit User Permissions.
Failed to update ClickHouse memory limit	The query memory limit was not saved. Enter a valid value and try again. See Passwords, locks and limits for a user.
This account's ClickHouse memory settings cannot be changed.	The built-in admin account has a locked memory limit. Nothing to do; its limit stays as it is.
You do not have permission to change the memory limit.	Your role cannot change users, so the memory control is read-only. Ask for Modify User Name or Modify User Permissions.
Unknown user or not recorded on the Activity timeline	The timeline cannot resolve the actor's name, or a timestamp is missing. Nothing to do; times show in your local time zone.

Passwords, locks and two-factor authentication

You see	What it means and what to do
Cannot reset password on your own account.	To change your own password, use Change password in your profile.
No active email integration configured	The password reset email could not be sent because no Email channel is active; the failed send is recorded in the notification log. Configure an Email channel in Notifications, or hand the password to the user another way.
This account authenticates via SSO and has no password to reset.	The user signs in with SSO, so there is no password to reset.
Password login is disabled on this instance; platform passwords cannot be managed.	SSO-only login is on, so password actions are unavailable. Users sign in with SSO.
A password is already set for this account. Use change password instead.	The account has a password. Use Change password, not Set up password.
Existing password is incorrect	The current password you entered is wrong. Enter the correct one.
You can't set the same password	The new password must differ from the current one. Choose another.
Old password is required	Fill in Old Password.
Your password has been updated. or Your password has been set successfully.	The change worked. Nothing to do.
A new temporary password will be generated. The current password will be invalidated immediately.	Confirms the password reset. Continue if the user needs a new temporary password; copy it from Copy Password before closing.
Permissions will be pushed to the reporting system and credentials will be refreshed.	Confirms Resynchronize & reset. Confirm when the user's roles and permissions should be re-synced for reporting too.
Click to copy password or Password copied!	The copy bar in the Copy Password dialog. Select it to put the password on the clipboard; the label resets after two seconds. If you lose it, reset again.
User unlocked successfully	The account is unlocked. Nothing to do.
User is not locked	The unlock request found nothing to unlock, because the lock already ended or was cleared. Nothing to do.
Unlock user? with This will unlock `<name>`'s account and allow them to log in again.	Confirms unlocking a locked account. Confirm to restore sign-in; the product then shows User unlocked successfully.
Failed to unlock user	Try again. If it keeps failing, check that your role includes Activate/Deactivate Users.
Cannot unlock your own account	Ask another administrator to unlock your account.
Global 2FA is disabled	Two-factor authentication is off for the platform. Set Global 2FA to Optional, then require 2FA for the user.
You cannot require 2FA on your own account	Ask another administrator. Or turn on 2FA for yourself from your profile.
Failed to update 2FA requirement	Try again. If it keeps failing, check that your role includes Require 2FA For Others.
Two-factor authentication is now required for this user	The per-user requirement was saved. The user was signed out and sets up 2FA at their next sign-in. See Two-factor authentication for users.
Two-factor requirement removed	The requirement was removed. Nothing to do.
2FA requirement cannot be removed while 2FA is required platform-wide.	Global 2FA is set to Required, so individual requirements cannot be removed. Set Global 2FA to Optional first. See Sign-in security.
Reason is required	Enter a reason before you reset 2FA.
Two-factor authentication has been reset. The user must enroll again.	The 2FA setup was cleared. Tell the user to set up 2FA at their next sign-in.
This will invalidate `<name>`'s two-factor setup. They must enroll again on next login.	Confirms the 2FA reset. Continue if the user cannot sign in; they set up 2FA again at their next sign-in.
User does not have 2FA enabled	The user never turned on 2FA, so there is nothing to reset.
Failed to reset two-factor authentication	The 2FA reset did not go through. Try again; if it keeps failing, check your permissions.
Failed to regenerate recovery codes	The new recovery codes were not created. Try again.
New recovery codes generated. Your previous codes no longer work.	The recovery codes were replaced by a new set. Save the new codes; the old set is void.
Invalid 2FA code, again and again	Check that the device clock is set to automatic time. Code checking allows almost no difference between the device clock and the server clock, so a clock that is off rejects every code. Enter the newest code, or use a recovery code. See Two-factor authentication.
Two-factor authentication is disabled for this platform.	2FA cannot be set up while Global 2FA is off. An administrator must turn it on.
2FA cannot be disabled because it is required platform-wide.	Global 2FA requires 2FA for everyone, so you cannot turn it off.
2FA cannot be disabled because it is required for your account.	Your account must keep 2FA on. Ask an administrator to remove the requirement.

Sign-in

You see	What it means and what to do
Invalid email or password	The email or password is wrong. Try again. If you cannot remember the password, ask an administrator to reset it.
Invalid email or password. One more failed attempt will lock your account.	The next wrong attempt locks the account. Ask an administrator to reset your password instead of guessing.
Account is temporarily locked due to multiple failed login attempts	Too many wrong attempts locked the account. Wait for the lock to end, or ask an administrator to Unlock account.
Account is temporarily locked due to multiple failed attempts	Too many wrong codes locked the account during the 2FA step. Wait for the lock to end, or ask an administrator to unlock it.
Account is deactivated	An administrator deactivated the account. Ask an administrator to activate it.
All your roles are inactive, contact your administrator	None of your roles is active. Ask an administrator to activate a role or assign an active one.
Password login is disabled on this instance, sign in with SSO	SSO-only login is on, and your account must sign in with SSO. Use Sign in with SSO. See Single sign-on (SSO).
You were signed out due to inactivity. Please sign in again. or Session expired due to inactivity	Idle logout ended your session. Sign in again; activity in any open tab prevents this.
Are you still there? with `You will be signed out in <n> seconds due to inactivity.`	You are about to be signed out. Select Stay signed in to keep working.

Single sign-on

You see	What it means and what to do
Sign-in was cancelled.	You cancelled sign-in at the provider. Try again.
Your sign-in session expired. Please try again.	Sign-in took too long to finish. Try again.
Your email domain isn't authorized for SSO sign-in. Contact your administrator.	The email domain is not in the allowed domains. An administrator must add it.
Your account is inactive. Contact your administrator.	The account is deactivated. An administrator must activate it.
Your email address has not been verified with your identity provider.	Verify your email at your provider, then sign in again.
Single sign-on is not available for this environment.	SSO is not set up completely, for example because there are no allowed domains. Check the SSO configuration.
Single sign-on is not configured, with Ask an administrator with SSO permissions to connect an identity provider.	No SSO configuration exists yet, and you cannot create one. Ask an administrator with SSO permissions to connect an identity provider.
Sign-in failed. Please try again.	Any other SSO failure. Try again. If it keeps happening, check the provider setup.
Issuer URL is required, Must be an absolute https URL, Client ID is required, Add at least one allowed domain or Default role is required	Fill in the field correctly. The issuer must be a full https address.
Client secret is required	A new configuration was saved without a client secret. Paste the secret from your provider; when editing, leaving the field blank keeps the stored secret.
Message starting Enter a bare domain like	An allowed domain contains a web address, an @ sign or a port. Enter only the domain name.
SSO must be active before SSO-only login can be enabled	Turn on SSO first, then turn on SSO-only login.
Message starting SSO-only login requires at least one active account holding the built-in admin role and a password	No active user with the built-in Admin role has a password, and those are the only accounts that can still sign in with a password. Give one active Admin-role user a password first.
Default role does not exist or is not active	The default role was deleted or deactivated. Pick an active role.
Enable SSO first to test a sign-in	Test sign-in is unavailable while SSO is off. Turn SSO on, then test.
SSO configuration saved., SSO configuration updated., SSO enabled., SSO disabled. or Password login enabled for users.	The change worked. Nothing to do.
Failed to create SSO configuration or Failed to update SSO configuration	The change was not saved. Try again. If it keeps failing, check that your role includes SSO Configuration Manager.

Roles

You see	What it means and what to do
Minimum length is 2 characters	The role name is too short. Use at least 2 characters.
Maximum length is 50 characters	The role name is too long. Use at most 50 characters.
Maximum length is 150 characters	The role description is too long. Use at most 150 characters.
The name field can only contain English letters and underscores	The role name uses a character that is not allowed. Use English letters and underscores only. The name cannot be changed after you create the role.
`The role with the name <name> already exists`	Another role has this name. Choose another name.
The name is reserved, please choose different one	The name uses a prefix reserved by the platform. Choose another name.
Admin role cannot be deactivated	The Admin role always stays active.
Role is already assigned to the user(s), cannot be deleted.	Remove the role from its users first, then delete it.
`<count>` semantic model(s) are owned by this role and will stop working: `<names>`	DataPrism semantic models depend on this role, and deleting it breaks them. Open the named models and check them before you delete the role.
Dependants could not be determined because the check failed. Deleting this role may be unsafe.	The check of dependent DataPrism models failed. Cancel, then try again later.
Role registered successfully, Role updated successfully, Role deleted successfully, Role permissions updated successfully, Role description updated successfully, Role status updated to Active, Role activated successfully or Role deactivated successfully	The change worked. Nothing to do.
Failed to save role permissions	The permission save did not go through. Try again. If it keeps failing, check that your role includes Edit Role Permissions.
Failed to update role status or Failed to update role description	The change was not saved. Try again. If it keeps failing, check your permissions.
Cannot remove role "`<role>`" from permission groups: `<conflicts>`. Remove those tables from the Minds first	A Mind owned by this role uses a table you are removing, so the role cannot lose access without breaking that Mind. Each conflict names a table and the Minds that use it. Remove those tables from those Minds first, or leave the tables ticked, then save again.
Cannot update table permissions for admin role	The built-in Admin role always keeps full table permissions. Use a different role for the access you want to limit.
Failed to load table permissions	The tables editor could not load the role's table list. Select Retry, which reloads the page, then open the editor again.
An error occurred while loading the data. Please try again.	The load failed and no more detail came back; it shows under the load-failure line. Select Retry; if it repeats, reload the page.
An error occurred while saving the changes. Please try again.	The table access was not saved. Try again; your ticks stay in the editor.
Failed to update role users	The role's members were not saved. Try again.
No users available or There are no users that can be assigned to this role.	No account is currently available to assign. Every eligible user may already hold the role, and some names are left out of the list. Reload the editor and try again if you expected someone.

Impersonation

You see	What it means and what to do
Could not act as this user. Please try again.	Viewing as this user failed. Try again. Check that the user is active and has an active role.
User has no active role, so there is nothing to view as	The user has only inactive roles. Assign an active role first.
Users who can impersonate cannot themselves be impersonated	You cannot view as a user who can view as others.
User not found or inactive	The user is deactivated or no longer exists. Activate the user first.
You cannot impersonate yourself	Choose another person; your own account is always left out of the picker and the row action.
SQL execution is disabled while impersonating another user; exit the view to run queries	Queries cannot run under the viewed person's account. Exit the view, then run the query.
Changes cannot be reverted from an impersonated session. or The acceptance mode cannot be changed from an impersonated session.	Model AI actions are unavailable in a view. Exit the view to change them.
Custom visual code cannot be authored while impersonating another user.	Custom visual code cannot be written in a view. Exit the view to author it.
Model Builder actions are not available while you are impersonating another user.	A Model Builder session cannot be started, stopped, continued or answered in a view; sessions stay readable. Exit the view to drive the session.
alerts cannot be created or changed while impersonating another user. or private chats are never accessible while impersonating another user.	A view cannot create or change alerts, and private chats are never readable in a view. Exit the view to do it as yourself.
Nobody to act as	Everyone who could be chosen is excluded: you, inactive users, users with no active role, and anyone who can impersonate. Nothing to fix; only eligible people appear.
No user matches that search	The search found no eligible person. Try a different name or email address.
can no longer be viewed	The viewed person was deactivated or lost access mid-session, and the session shows nothing instead. Select Exit to leave the view.

Security settings

You see	What it means and what to do
Password policy updated.	The policy was saved. Nothing to do.
Failed to update password policy	The policy was not saved. Try again. If it keeps failing, check that your role includes Password Policy Manager.
Enter a whole number of at least 1.	A length value is empty, zero or not a whole number. Enter a whole number of 1 or more.
Enter a whole number of days, at least 1.	The password age is not a whole number of days. Enter 1 or more.
Enter a whole number between 1 and 10.	The maximum login attempts is outside the range. Enter a value from 1 to 10.
Enter a whole number between 1 and 1440.	The lockout duration in minutes is outside the range. Enter a value from 1 to 1440.
Enter a whole number between 1 and 24.	The password history count is outside the range. Enter a value from 1 to 24.
Minimum length cannot be greater than maximum length.	Lower the minimum length, or raise the maximum length.
`Idle logout enabled - users are signed out after <n> minutes of inactivity.` or Idle logout disabled.	The idle logout setting was saved. Nothing to do.
Failed to update idle logout policy	The setting was not saved. Try again; if it keeps failing, check that the role includes System Settings Manager.
Enter a whole number between 5 and 1440 minutes.	The idle timeout is outside the range. Enter a value from 5 to 1440.

AI configuration

You see	What it means and what to do
API Key is required or API Host is required	Fill in both fields before you save.
Connection test successful	The connection works. Save the configuration.
Connection failed, or the reason the server returns	The connection did not work. Check the API key and the API host.
AI model settings added successfully or AI model settings updated successfully	The settings were saved. Nothing to do.
Failed to create AI configuration or Failed to update AI configuration	The settings were not saved. Read the reason shown, then try again.
AI is not configured. Ask an administrator to set it up in Admin > AI Configuration.	An AI feature was used while the AI connection has never been set up. An administrator connects it on AI configuration.
AI configuration is turned off. Ask an administrator to enable it in Admin > AI Configuration.	The AI connection is switched off. An administrator turns it on on AI configuration.
AI is not configured: the API key is empty. Ask an administrator to set it in Admin > AI Configuration.	The stored API key is empty. An administrator enters the key on AI configuration.
Model catalog unavailable	The live model list cannot be reached. You can still remove models, but you cannot add any until it recovers. Select Retry later.
Message starting Model catalog is unavailable that says it cannot validate the allowed model list	Adding models needs the live model list, which is not reachable. Try again shortly.
The live catalog could not be reached.	The model list request failed and the service gave no other reason. Select Retry; models can still be switched off.
`Unknown model(s): <ids>. Pick from the live model catalog.`	The model is not in the live list. Choose a model from the list.
No models match your search.	Nothing matched the search text or the active filter. Clear the search or switch the filter back to All.
No models in the catalog.	The catalogue returned no models. Select Retry to load the list again.
You have unsaved changes	The form has edits that are not saved yet. Select Save, or Cancel to go back to the last saved settings.

DataMind Oda

These messages come from the Oda tab. For what each tab does, see DataMind Oda settings and MCP servers and skills.

You see	What it means and what to do
The Oda settings could not be loaded.	The General tab could not load its values. Reload the page and try again.
Failed to save the Oda settings	The General save did not go through; the reason the server gives appears with the message. Try again. If it keeps failing, check that your role includes Modify DataMind Oda Settings.
Oda settings saved.	All three cards on General saved in one request. Nothing to do; the rules reach Oda users automatically.
Disabled - Oda cannot use its browser	The Browser card is off for the whole company. Switch the Browser card on and Save changes to allow the browser again.
Disabled - scheduled runs are refused	Scheduled tasks is off for the company, so scheduled runs are refused. Switch Scheduled tasks on and Save changes to allow runs again.
Press Enter to add. A site also covers its subdomains.	How the site list works: Enter or a comma adds an entry, and one entry covers the addresses under that site. Nothing to do; add one entry per site.
Message starting Enter a website like	The entry in Allowed sites or Blocked sites is not a bare site name. Enter the site name alone, without `https://`, a path or a port.
Failed to load the MCP servers. or Failed to load the skills.	The list could not load. Click Retry on the panel.
Failed to save the MCP server or Failed to save the skill	The item was not saved. Try again. If it keeps failing, check that your role includes Modify DataMind Oda Settings.
Failed to remove the MCP server or Failed to remove the skill	The item is still there. Try again.
Enter a name.	The Name field in the MCP server or skill dialog is empty. Enter a name; a skill name uses lowercase letters, digits and single hyphens.
Use a server address or a local command, not both.	The server form holds both a Server address and a Local command (stdio). Clear one of the two and save again.
Enter the server address, or a local command under Advanced.	The server has neither an address nor a local command. Fill in one of the two.
Enter the full server address, starting with https://.	The address is incomplete or does not start with https://. Paste the full address the provider gives you.
Headers only work with a server address. Remove them, or clear the local command.	Header rows exist while the server is a local command. Remove the headers on Connection, or clear the local command.
Environment variables only work with a local command. Remove them, or add the command under Advanced.	Environment variable rows exist while the server uses an address. Remove the rows, or add a local command under Advanced.
Enter a name for every value, or remove the empty row.	A header or variable row has a value without a name. Name every row, or delete the empty one.
Use lowercase letters, digits and single hyphens in the name, for example monthly-close.	The skill name does not match the command format. Rename the skill with lowercase letters, digits and single hyphens only.
Enter a description.	The skill Description is empty; Oda uses it to decide when to load the skill. Describe what the skill does and when to use it.
Enter the instructions.	The skill Instructions are empty. Write the steps the skill follows, in Markdown.
The instructions can be at most 100 KB.	The skill instructions exceed the size limit. Shorten the instructions or split the skill.
Pick at least one role.	Only for specific roles is on but no role is selected. Pick one or more roles, or turn the switch off so everyone with Oda gets the item.
No active roles, so nobody gets it	The roles picked for the item are all inactive or gone, so it reaches no one. Open the item, pick active roles and save.
Shared values are sent to every Oda user and can be read on their computer.	At least one header or variable is stored as a Shared value. Switch values that should stay personal to Each user enters.
This change affects Oda users, with Save anyway	The dialog lists what a Managed MCP server edit changes for users. Read the list; confirm with Save anyway, or cancel and adjust the edit.
`<name>` is removed: the values users entered are deleted from their Oda.	This edit deletes a header or variable and the values users typed for it. Continue only if that data loss is intended.
`<name>` becomes a shared value: it replaces the values users entered, which are deleted.	This edit turns a per-user value into a shared one, replacing what users typed. Continue only if that replacement is intended.
The server type changes: Oda restarts it with the new settings for every user.	The edit switches the server between remote and local. Expect Oda on each user's computer to restart the server with the new settings.
`<display name>` saved. Oda users get the change within 10 minutes. or /`<name>` saved. Oda users get the change within 10 minutes.	The MCP server or skill saved and will reach users shortly. Wait out the 10-minute window before troubleshooting a missing item.
`<display name>` removed. or /`<name>` removed.	The item was removed; a Managed removal also takes it away from every user. Nothing to do.
No MCP servers yet. Added servers appear in Oda for the users you pick. or No skills yet. Added skills appear in Oda for the users you pick.	The list is empty. Add an item to get started.

PII detection

You see	What it means and what to do
Saved with PII detection policy updated	The policy was saved. Nothing to do.
Failed to save PII policy	The policy was not saved. Try again.
Failed to update PII detection kill switch or Failed to check PII detection impact	The global switch did not change. Try again.
Are you sure you want to turn it off?	Confirms switching Global PII detection off; PII will no longer be detected in users' prompts to AI. Select Turn off to confirm, or cancel to keep detection on.
Enforced PII column clarification on Excel / CSV uploads will also be turned off for `<n>` Mind(s).	Minds that enforce this on Excel and CSV uploads lose it when the global switch goes off. Nothing further; it turns off together with the switch.
A rule with this label already exists	Another rule has this label. Rename the rule.
Describe the data so the model can detect it accurately.	An AI rule needs a description; it teaches the model what to look for. Describe the shape of the data, for example how an employee badge ID looks.
Pattern does not compile. Note: backreferences and lookaround are not supported.	The pattern is not valid for this detection engine. Simplify it.
RE2 syntax, case-sensitive. Test it against sample text in the Playground tab.	Regex rules are read as case-sensitive patterns. Test the rule in Playground before you rely on it.
`Invalid RE2 pattern for rule "<label>": <reason>`	The platform rejected the pattern when you saved it. Fix the pattern as the reason describes.
`Model rule "<label>" requires a description for zero-shot detection`	The AI rule has no description. Add one.
No built-in rules	The built-in detector list is empty. Nothing to do if you do not need them; add a custom AI rule for your own identifiers.
No regex patterns yet	No regex rule exists yet. Select Add pattern to create one.
PII detection is off platform-wide - enable the global switch to test.	The Playground needs Global PII detection turned on before it can test rules.
No enabled rules for this scope's engine - enable a rule or switch the engine.	The Playground has nothing to run. Enable a rule, or change the engine.
Enter sample text on the left.	There is nothing to scan yet. Paste text into Sample text.
No PII detected, with Your draft looks clean against the platform policy. or Nothing in this text matched the enabled detection rules.	The scan found nothing that the policy treats as personal data. You can send the text or keep the rule as it is. See PII checks in chat.
PII scan failed	The scan could not run. The reason the server gives is shown; if there is none, PII scan failed stands alone. Try again, and quote the message to your administrator if it keeps failing. See PII checks in chat.
Personal information detected with This message was not sent. Edit the highlighted parts to remove or mask them.	Your message contains personal data, so it was blocked. Edit the highlighted parts. If your role allows it and the mode is Warn, Send it anyway also appears.
Your message is back in the input.	Restore put the unsent message back into the message box. Edit the flagged parts and send again.

Notifications

You see	What it means and what to do
Name is required	Enter a name for the integration.
Host is required for email, Port is required for email, Username is required for email, Password is required for email or From address is required for email	Fill in the field for the Email integration.
From address must be a valid email	Enter a valid email address.
Webhook URL is required	Enter the webhook URL for the Slack, Discord or Google Chat integration.
Notification integration created successfully, Notification integration updated successfully or Notification integration deleted successfully	The change worked. Nothing to do.
Provider cannot be changed after creation	In edit mode the channel type picker is locked. Add a new channel of the type you want instead.
This is the default email integration and cannot be deleted. or This is the default email integration and cannot be deactivated.	The default integration cannot be removed or switched off. Select Set default on another Email integration first. The same applies to Slack, Discord and Google Chat.
Set another integration as default first	The channel is the default of its type, so its delete action is unavailable. Hover another channel of the same type, select Set default, then delete this one.
Cannot set an inactive integration as default. Activate it first.	Turn the integration on first, then select Set default.
Delete notification integration with Are you sure you want to delete this integration? This action cannot be undone.	Confirms deleting a channel; the action cannot be undone. Confirm to delete, or cancel; for the default channel, set another channel of the same type as default first.
Failed to update notification integration	The change was not saved. Try again. If the server gives a reason, that reason appears instead.
Failed to save notification integration	A new or edited channel was not saved. Try again.
Failed to delete notification integration	The channel was not deleted. Try again.
Failed to set the default integration	The default did not change. Try again.
Couldn't load subscriptions	The subscriptions list did not load. Reload the page.
Nobody is subscribed yet	No workflow alert subscriptions exist yet. Set up a failure alert on a workflow; see Failure alerts.
`No <type> integrations`, for example No email integrations	No channel of that type exists yet. Select Add on that channel type's panel.
Unknown in the Channel column	The channel behind a subscription cannot be resolved, for example because it was deleted. Check the alert on the workflow and pick a channel again.
Loading integrations	The channels list is loading. Wait for it to finish.

System settings and branding

You see	What it means and what to do
Are you sure you want to disable the scheduler? Scheduled workflows will not execute. or Are you sure you want to enable the scheduler? Scheduled workflows will resume.	Confirms the Workflow Scheduler switch. Confirm to pause or resume scheduled runs and automatic retries.
Are you sure you want to disable health checks? System monitoring will be paused. or Are you sure you want to enable health checks? System monitoring will resume.	Confirms the health checks switch. While it is off, no service checks are recorded; those days read No data in Live Metrics.
`Up to <n> ANY API tables now load at once.`	The concurrency limit was saved. Nothing to do.
Failed to update ANY API concurrent loads	The limit was not saved. Try again.
Enter a whole number between 1 and 25.	The ANY API Concurrent Loads value is outside the allowed range. Enter a value from 1 to 25.
Charts that plot latitude and longitude will stop showing their data until coordinates are allowed again. or Charts that draw a Geometry field will stop showing their data until shapes are allowed again.	Confirms turning a map setting off; the affected visuals stop until it is back on. Confirm only if intended.
`<setting name>` become available to every DataPrism Map visual in the organization.	Enabling a map setting makes its fields available to every map visual. Confirm to proceed.
The map setting's name followed by allowed. or turned off.	The map setting was changed. Nothing to do.
Failed to update the map settings	The map setting was not saved. Try again.
Changing a connector's host, URL, account or username will clear its stored password or key, so it must be typed again. Continue? or Editing a connector will reuse its stored password or key even when the host, URL, account or username changes. Continue?	Confirms the connector-secret setting. Confirm; connector forms then clear or keep the stored secret when those fields change.
Enter a host pattern	Enter a host before you add it.
Enter a valid host, like example.com, .example.com, or	The host is not valid. Enter a domain, a wildcard domain or *.
Note is too long	Shorten the note.
That host pattern is already on the allowlist.	The host is already allowed.
*Enter a valid host pattern, like example.com, .example.com, or .*	The server rejected the host pattern. Correct it and try again.
Visuals will no longer be able to reach `<pattern>`. This cannot be undone.	Confirms removing a host row. Select Remove only if the host should really be gone; re-add it if needed.
`<pattern>` added to the allowlist. or `<pattern>` removed.	The host change worked. Nothing to do.
No hosts on the allowlist yet.	The list is empty. Add the hosts custom visuals need.
Failed to load the allowed hosts.	The list did not load and a Retry button appears. Select Retry; if it keeps failing, reload the page.
Failed to add host or Failed to remove host	The change was not saved. Try again.
Invalid image with Please upload a JPEG, PNG, WebP, or GIF image.	Choose a logo in one of these formats.
Invalid image with Image is too large. Maximum size is 5 MB.	The logo is larger than 5 MB. Choose a smaller file.
Invalid image with `Image is <w>×<h> px. Maximum is 8000×8000 px.`	The logo is too large in pixels. Use an image up to 8000×8000 px.
Invalid image with This image could not be read. Use a JPEG, PNG, WebP, or GIF up to 8000×8000 px.	The file is damaged or unsupported. Use a valid image up to 8000×8000 px.
Light theme logo updated. or Dark theme logo updated.	The logo for that variant was uploaded. Nothing to do; the slot now shows Uploaded.
Failed to upload `<label>` logo or Failed to remove `<label>` logo	The logo upload or removal did not go through. Try again; check the file type, size and pixel dimensions.
Company name updated.	The name was saved. Nothing to do.
Failed to update company name	The name was not saved. Try again.
Name already taken or You already have a theme with this name. Choose a different name or edit the existing theme.	Another theme has this name. Choose another name, or edit the theme that already has it.
Name required or Give your theme a name before saving.	Name the theme before you save it.
Saved, with Updated your existing theme with this name.	Saving a new theme reused a name you already have, so that theme was updated instead of a second one being created. Nothing to do if that was intended.
Could not save or Update failed	The theme was not saved. Try again.
Could not build palette with Confirm all `<N>` color picks are valid hex values.	A colour pick is not a valid hex value, so the theme cannot be saved. Re-pick the colours in the editor, then save again.
Could not delete	The theme was not deleted. Try again.
Built-in themes cannot be modified	Built-in themes are read-only. Create a theme of your own instead.
Theme applied, with Your custom palette is now active across the app.	A custom theme was applied to your interface. Nothing to do.
Default restored, with Using the standard system palette again., or `<standard palette name>` applied, with Using the standard system palette across the app.	A built-in palette is now in use, or the applied custom theme was cleared. Nothing to do.
Others can now discover and use this theme. (toast Published)	The theme was published. Nothing to do.
Theme is now private. (toast Unpublished)	The theme was unpublished; people already using it keep their colours. Nothing to do.

Platform

You see	What it means and what to do
No control plane behind the gateway	The platform manager is not part of this installation. Select Retry once the installation is checked; on an installation DataMind manages, these controls are not available at all.
Control plane can't reach its backend	The platform manager is up but the part behind this view is not answering. Select Retry; if it persists, ask the person who runs the installation to check the platform services.
Control plane not reachable	The platform manager is not answering. Select Retry. If it still fails, ask the person who runs the installation to check the platform services.
Services and updates are managed by DataMind	This installation is managed for you, so Services and Updates are hidden and only Logs remains; the notice also shows the running version. Nothing to do; updates arrive through DataMind.
Updates are managed by DataMind	A services or updates address was opened on an installation without the platform controls, so those routes are not available. Ask your administrator whether the installation includes them.

Platform updates

You see	What it means and what to do
Registry error	The image could not be compared with its registry. Hover the badge to read the reason, then select Check again.
Not pulled	The image is not on this host yet, so there is nothing local to compare. Use Pull images to download it ahead of an update.
Update available	A newer image is published for a service that is already on the host. Run Update DataMind OS to pull and recreate it.
Up to date	The running image is the newest published one. Nothing to do.
Every service is on its latest image.	The check found no newer images. Nothing to do; re-check after a new version is published.
Wait for the running job to finish first or Already on the newest image	An update is already running, or the Installer is already newest. Wait for the job to finish, then check again.
Could not start the DataMind OS update	The update did not start. Read the Logs tab, then try again.
DataMind OS update started	The update job started. Follow it on the Updates tab or in Logs; you can leave the page while it runs.
This includes the frontend: the page will reload on its own once the update finishes.	The interface is part of the update, so the page reloads when it is replaced. Let the reload happen, or cancel the countdown and reload later.
Critical services affected: `<names>` - expect a short outage for everyone.	A critical service is in the update set. Read the list and warn users before confirming.
DataMind OS update failed	The update stopped with an error. Read the Logs tab, then try again.
DataMind OS update cancelled	The job was cancelled before it finished. Start the update again when ready.
Fetching manifest, Pulling images or Recreating services	The three deploy phases shown in the update stepper. Follow along; nothing to do.
No images to pull - every target is already local.	The pull phase has nothing to download. Nothing to do.
failed, pulled or `<percent>%`	Per-image pull states in the update view; a percentage caps at 99 until the download completes. Watch for failed; the job output names what went wrong.
Wave `<n>` · `<healthy>`/`<total>` healthy	Service health per recreation wave. Watch for red crosses; an unhealthy service fails the update and is named in the output.
Waiting for services to be recreated…	The first wave has not reported yet. Wait.
The update did not finish.	The job failed or was cancelled and carries no message. Read the job output in the update view.
DataMind OS updated with reloading in `<countdown>`s or reload to get the new version	The update finished and the page reloads to run the new frontend. Cancel stops the countdown, Reload now reloads at once.
Update finished. Reload to run the new frontend.	The update is complete and the interface was replaced. Select Reload now, or wait for the countdown.
You are now on the new version.	The page reloaded after the update. Nothing to do.
Updated: `<services>`	The named services moved to their newest images and no reload is needed. Nothing to do.
The frontend image was unchanged - no reload needed.	The interface was in the update set but was not actually replaced. Nothing to do.
Update job no longer tracked, the toast Update job lost or The Installer no longer tracks this update job	The Installer no longer keeps this job's record, so the page cannot say how it ended. Check the service states on the Services tab, then click Check again on Updates.
Updating DataMind OS	An update is running; the banner's View opens the Updates tab. Nothing to do.
Image pull started	The newer images are downloading. Follow the job in the Services tab job list.
Could not start the pull	The download did not start. Try again.
Checking the registry for a newer Installer…	The Installer card is checking the registry. Wait.
Running `<digest>` or Latest `<digest>`, or unknown	The Installer's running and published image versions; unknown appears when a value cannot be read. Nothing to do.
Its compose file changed too	The Installer's deployment files changed as well. Nothing to do.
Last update still in progress, Last update completed or Last update failed	The outcome of the previous Installer update. Nothing to do for a completed one; read the detail for a failed one.
Update the Installer? with The Installer pulls its new image and is recreated by a helper container. DataMind OS keeps running, but service controls and DataMind OS updates are unavailable for up to five minutes while it comes back.	Confirms the Installer self-update. Continue only when a short window without service controls is acceptable.
Installer update started	The Installer is being replaced and goes offline for a few minutes; service controls and updates are unavailable while it comes back.
Installer is up to date	Nothing was started; the Installer is already newest. Nothing to do.
Could not start the Installer update	The Installer update did not start. Try again.
Installer update unconfirmed	The Installer has not confirmed the update in its wait window. Check the Updates tab once it answers again.
Installer update failed	The update did not finish; the reason appears with the message, or the message says The Installer rolled back to its previous image. Try again later.
Installer updated	The Installer is back on its new image, and service controls work again. Nothing to do.
Updating the Installer with Service controls and DataMind OS updates are unavailable until the Installer comes back, usually under five minutes.	The notice shown while the Installer is replaced. Wait; retry what failed afterwards.

Platform services

You see	What it means and what to do
Restart started or Stop started	The service action started, and the job is in Jobs. The row usually moves to Starting straight away.
Could not start the restart or Could not start the stop	The action did not start; the reason appears with the message. Try again, and check that your role holds Restart Platform Services or Stop Platform Services.
Service groups unavailable: `<message>`	The group list could not load, so the page shows the reason in a strip; the rest of the panel may still be usable. Select Retry on the strip.
Kept open while something in this group needs attention	The group holds a service that is not up or completed, so it cannot be collapsed. Wait for the service to settle.
Only completed init containers here - toggle "Show completed init" to see them.	Every row in this group is a finished one-off setup service, and those rows are hidden by default. Turn on Show completed init in the strip.
Deployment files incomplete on the host	The installation reports its deployment files as incomplete, so parts of the page can be limited. The list still shows what is running; ask the person who runs the installation to review the deployment.
Service schema unavailable - groups are approximate	The group definition could not be read, so every service is shown in one group. Select Refresh to try again.
No jobs yet.	No maintenance job has been recorded. Jobs appear after a restart, a stop, an update or an image pull, and stay for an hour.
Loading platform services or Loading jobs	The panel or its job list is loading. Wait; if nothing appears, reload the page.
Not deployed	The service has no container on this installation. Nothing to do unless you expected it here; it is not an error by itself.
Waiting for output… or No output was recorded for this job.	The running job has not produced output yet, or nothing was recorded. Wait, or read the banner outcome.
Reconnecting…	The live job-output stream dropped and the page is reconnecting on its own. Keep the page open; output resumes when it reconnects.
Docker restart count	Shown on hover beside a row's condition badge: the number of times the container has restarted. Nothing to do; check the service if it keeps rising.

Platform logs

You see	What it means and what to do
No container has logged in this window	The window has no logged containers you can read. Widen the range or clear the filter; a container outside your readable set never appears.
Logs are kept for 30 days. The page still shows the newest lines of the window.	A window older than retention shows its newest available lines. Pick a window within the last 30 days.
Loading logs, Loading older lines… or Loading activity	The log list, its history or the chart above it is loading. Wait.
No log lines in this window.	The selected window has no lines. Widen the range or clear the search and filters.
Waiting for new lines…	Live is on and nothing has arrived yet. Wait; check that the Live dot is green.
Could not load older lines: `<message>`	An older page failed; the lines already loaded stay on screen. Select Retry; if it keeps failing, narrow the range.
10,000-line limit reached - narrow the range or click a bar in the chart above for older lines	The scroll-up history cap is reached. Narrow the range or click a bar to reach further back; downloads are not bound by the cap.
Start of the selected time range	The oldest line of the window is in view. Widen the range or click a bar to go further back.
Scroll up for older lines or line limit reached	More history is available above. Scroll up to load it, or narrow the range if the limit is reached.
`<n>` new lines	Lines arrived while you were scrolled up in Live. Select the pill to jump back to the newest line.
Access denied. You do not have permission to read logs for `<container>`	The view names a container outside your readable set. Ask an administrator for the permission covering it, such as View Sensitive Container Logs.
No readable containers have logs in the selected window	Nothing you may read logged in the window. Widen the range; ask for wider log permissions if you expect more containers.
Download failed	A log download did not save. The reason appears with the message. Try again, and check that your role includes Export Container Logs. See Read container logs.

Row-level security

These messages come from the Row Level Security step of a table popup.

You see	What it means and what to do
RLS enabled successfully	The protection switch was turned on and applies straight away, not when the step is saved. Every permission group now sees only the rows its rules allow.
RLS disabled successfully	Protection was turned off and applies straight away. Every permission group can read all rows again until it is turned back on.
Failed to toggle RLS	The change was not applied and the switch returned to its previous position. Try again; if it keeps failing, close and reopen the table popup and retry.
RLS is off - all permission groups can read every row. Turn protection on to start defining access rules.	Protection is off, so the step shows only the switch and this message. Turn protection on to get the rules builder and the SQL view.
RLS settings saved successfully.	The step was saved on a table you are still creating. Nothing to do; continue with the next step.
RLS settings updated successfully.	The step was saved on an existing table. The whole rule set now matches what you saved.
RLS saved successfully	The step was saved on a staging table. Nothing to do; the whole rule set now matches what you saved.
Failed to save RLS settings. or Failed to save RLS settings	The save did not go through; the toast carries the server's reason when there is one. Nothing was stored, so your edits are still in the step.
Discard unsaved changes? with You have unsaved RLS changes. Close without saving?	You are closing the expanded workspace while its draft differs from what the step holds. Select Discard to close and drop the draft, or stay and Save to keep it.
Are you sure you want to proceed with this change? This may affect your data integrity.	You are switching the editor to Manual while rule blocks exist; the visual rules stop applying to the script until you switch back. Confirm only if you intend to write the SQL by hand.
Are you sure you want to proceed with this change? Your manual script will be lost.	You are switching back to Auto while your script differs from the generated result. Copy the SQL elsewhere if you need it, then confirm.
Failed to generate RLS script: unexpected API response	The SQL preview could not be generated; the pane empties instead of showing a script. Retry by changing a rule or reopening the popup.
No access rules yet	The Rules view has no rule blocks. Select New Query to add one, or turn protection on if the step shows the off message.
Visual rules unavailable	The editor is in Manual mode with no rule blocks, so there is nothing for the visual builder to edit. Switch to Auto, or open the SQL view.
Permission Groups Required	The table has no permission group yet, so row level security cannot be configured. Select Go to General and add at least one permission group, then return.

Columns and fields

You see	What it means and what to do
System columns cannot be edited.	The cell belongs to a system column the platform maintains. Leave it as it is; edit your own columns instead.
This column is locked.	The column is locked as a whole, even when its row could otherwise be edited. The column stays read-only while it is locked.
This row is locked and cannot be edited.	The whole row is locked, so no field on it accepts edits. Work on another row, or check why this row is locked.
Foreign key columns cannot be edited.	The column is defined by a foreign key to another table. The foreign key defines the column.
This field cannot be edited.	The field cannot be edited in its current state; this is the fallback reason when no more specific one applies. The cell stays read-only.
Please add at least one custom column.	The table has no user-defined column, and the grid needs at least one to save. Add a custom column and save again.
At least one user-defined column must be marked as a Primary Key.	A Static table requires one user-defined column marked as its primary key. Tick PK on one of your custom columns.
Column name cannot be empty (Row ID: `<n>`)	One column has no name; the row id in the message points to it. Give the column a name and save again.
System reserved names found: `<names>`	A user-defined column reuses a name from the system column list; capitals are ignored in the check. Rename the column; the message lists the offending names.
Duplicate column names found: `<names>`	Two columns share a name; capitals are ignored. Rename one of the duplicates.
Dots are risky in column names - Consider renaming. SQL reads them as table.column.	The column name contains a dot, which SQL reads as a table qualifier. Rename it before saving if you can; a dot is allowed but risky.
Keep in mind that dot was used for column name(s) which is tricky and usually better to avoid as SQL reads them as table.column.	A saved column name contains a dot; the note repeats the caution after saving. Nothing required; avoid dotted names for future columns.

Table selection

You see	What it means and what to do
Loading available tables...	The panel is fetching the tables you can choose. Wait; the list fills in on its own.
No Warehouse tables available	No Warehouse table can be chosen in the panel. Deploy a Warehouse table first, then reopen the panel.
No Lake tables available	No Lake table can be chosen in the panel. Deploy a Lake table first, then reopen the panel.
No matches	The search in the source systems popover found no source system. Clear the search, or check the table's source systems.
Filter to unmapped rows only	The tooltip on the Unmapped toggle while it is off. Select the toggle to show only unmapped rows.
Showing unmapped rows only - click to show all	The Unmapped filter is on and the view shows only unmapped rows. Select the toggle to show all rows again.

Deploy and delete

These messages come from the table popup's Deploy step, the Dependants tab and the delete and drop confirmations.

You see	What it means and what to do
This dictionary is not deployed. Deploy to enable preview and statistics.	The Dictionary is saved but not created in the Warehouse yet, so preview and statistics are unavailable. Use Deploy on the strip; the label shows Deploying while it runs.
Dictionary Not Deployed	The full-card title for the same state in the Settings tab; the body says to deploy the dictionary to access preview and statistics. Deploy the table, then reopen the tab.
This Dimension table is not deployed. Deploy to enable statistics and transformation runs.	The same state for a Dimension table (a Fact reads the same sentence with Fact). Deploy the table; the card title reads Dimension Table Not Deployed.
This static table is not deployed. Deploy to enable preview and statistics.	The same state for a Static table. Deploy the table; the card title reads Static Table Not Deployed.
Primary key required. Define a primary key column before this table can be deployed.	The table has no primary key column, so a deploy would be refused. Select Go to Columns and mark a primary key column in the grid.
Primary key required. Define a primary key column before this view can be deployed.	The same check for a View. Define the primary key in the View's Columns step.
Partially Success	A deploy finished, but some of the tables it covered failed. Read each failed table's error message, fix the cause and deploy again.
Failed	The table did not deploy. Read the table's error message, fix the cause and deploy again.
No dependants found	The dependants check ran and nothing uses the table. Nothing to do; if you expected dependants, check again later, because an undetermined result never means no dependants.
DataPrism dependants could not be determined because the check failed.	The DataPrism part of the dependants check could not run, so semantic models may be missing from the list. Treat the list as incomplete, never as empty; check again later.
`<n>` presentations you cannot access	That many dependants exist but sit outside your access; names are never shown. Ask their owners before changing or removing the table. The same pattern applies to semantic models and Minds.
Error (toast title)	A dependant row could not be opened. Try again.
ANY API data access	An ANY API connector may read this table's data through a data-access grant. Treat it as a consumer; the row has no page to open.
Checking what depends on this...	The delete confirmation is checking what depends on the selected tables; the confirm button is unavailable while it runs. Wait for the check, then read the result.
You are about to delete "`<name>`" that is still being used by the object(s) below.	The check found dependants, listed below; the confirm button reads Delete anyway. For a multi-table selection the line says something instead of a name. Review the list before you continue.
`<n>` more selected table(s) were not checked.	The selection is larger than the 20-table check budget, so only the first 20 tables were checked. Treat the list as partial; delete in smaller batches so every table is checked.
`<n>` are not visible to you.	Some dependants sit outside your access and appear as counts, never names. Ask the owners of those objects before you delete.
Could not load every dependant, so the list may be incomplete.	At least one part of the check failed to load. Treat the list as partial; cancel and run the check again later if it matters.
Dependants could not be determined because the check failed. Deleting may be unsafe.	The check did not finish, so the list is short by an unknown amount. Cancel and try again later.
Anything that depends on it is not dropped and will break until you fix it or redeploy the table.	The Drop confirmation loads no dependant list and always shows this warning. Check the Dependants tab before dropping; fix or redeploy afterwards.
No dependencies selected	The Dependencies step has nothing chosen yet; this is its empty state, not an error. Select Manage Dependencies to pick tables.

Sync, preview and export

You see	What it means and what to do
Conditions saved successfully	The sync WHERE clause was saved and the next synchronisation will use it. Nothing to do.
Failed to save conditions	The clause was not saved. Check it, correct it and save again; the toast shows the product's reason when there is one.
No data preview available	No query result exists yet for the preview window. Run the query, then read the window.
No data available	The query ran but returned no rows. Adjust the query if you expected rows.
Loading history...	The query versions are being fetched. Wait; the list fills in.
No query history yet	No version has been recorded for this query. Nothing to do; versions appear as the query is validated.
Query Validation Error	The query failed validation; the window shows the error and Fix with AI with an optional context box. Read the error, add context if useful, then Fix with AI and review the diff before Apply Changes.
Query Difference Checker	The AI-suggested query is shown as a diff against the current one. Apply Changes accepts it, or Close keeps the current query.
Error Details	The full error text, opened from a popup error strip through View details. Copy Error (Copied after the click) takes the full text elsewhere.
Error Stack Trace or Runner Diagnostics	The full error stack, with the loader's report shown above it when both exist. Copy takes the stack text and the report together; fix the cause and run again.
Load failed or Load finished with warnings	The headline outcome of a loader report on a Sync Log row. Read the fields below for the cause; for warnings, check the affected records.
`<n>` invalid UTF-8 sequences replaced in `<m>` records	The loader replaced invalid UTF-8 byte sequences in the source and the run continued; the Sync Log counts them. Open the report to see which records were affected; the data still loaded.
[hidden: no data access]	The record keys in a loader report are hidden because you may not read the table's data. Ask someone who can read the table if the values matter.
Abort Synchronization with Are you sure you want to abort this running synchronization?	The confirmation shown before a running synchronisation is stopped from its log row. Confirm to stop the run; the log row settles.
Delete Log Entry with Are you sure you want to delete this log entry? This action cannot be undone.	The confirmation shown before a log row is removed. Confirm only if the log entry is no longer needed; deletion cannot be undone.
No synchronization logs found	The Sync Log grid has no rows yet. Runs appear in the list as they happen.
Stop, tooltip Stop validation	A query validation is running; Stop cancels the validation itself, not only the waiting screen. Select it to cancel, or wait for the result; a cancelled check can be validated again.

Server and connection messages

These can appear anywhere in Administration when a request fails before the screen can explain it.

You see	What it means and what to do
Internal server error	An unexpected error stopped the request, and the platform hides the details. Try again. If it repeats, report it with the steps you took.
Unknown error occurred, or An unknown error occurred	The request failed without a reason the platform can name; the shorter form is also the fallback when the audit report download fails and the server says nothing. Try again; if it repeats, report it with the steps you took.
Network error - no response received from server	The connection dropped before an answer arrived. Check your network, then try again.
HTTP `<status>` error	The server refused the request with that status. Try again; if it repeats, report it with the steps you took.
Request setup error: `<message>`	The request could not be prepared and did not reach the server. Try again.
A message from the database, such as a ClickHouse error	The data layer refused the request, and its own wording is shown as written. Check the query or the table it names, then try again.
A message like User not found or Role not found, sometimes with This user may have been removed or you may not have access. or This role may have been removed or you may not have access.	The item was deleted or is no longer open to you. Reload the page and pick another item.

Denied actions

When the platform refuses an action, the message names what is missing. A refusal is usually a permission answer, so keep the message text when you ask for access. See How access works and the permission reference.

You see	What it means and what to do
Access denied. You do not have permission to `<action>` this `<object>`	Your role does not include the permission for this action. Ask an administrator to add it.
Access denied. Required permission(s): `<names>`	The message names the permission or permissions you need. When any one of several is enough, the names are joined by OR; when all are needed, they are joined by AND. Ask an administrator for exactly those permissions.
Authentication required	Your sign-in is missing or has expired. Sign in again and repeat the action.

Access and pages

You see	What it means and what to do
Access Denied with Sorry, you don't have permission to access this page. Please sign in or contact your administrator.	Your role does not include the view permission for this page. Select Go Back to return, or Sign In to sign out and sign in again with an account that has access. Ask an administrator for the permission that opens the page; see Administration for the permission each tab needs.
You do not have permission to view user details	Opening a member of a role needs the View Users permission. Ask an administrator for it.
Failed to load the permission catalog. Please try again.	The permission editor could not load its list. Try again, and reload the page if it keeps failing.
Loading permissions	The permission editor is loading its list. Wait; if it never finishes, reload the page.

Questions, answered

Why does a toast say only "Error"?

The text under the title is the reason. Find that text in the tables above. If there is no text under the title, try the action again.

Why can I not open a member of a role?

Opening a role member's details needs View Users. Without it, you see You do not have permission to view user details. Ask an administrator to add a permission that includes View Users, such as Users Viewer, to your role.

Why did users stop receiving emails?

Account emails, Observability alerts, and DataPrism and Slides email subscriptions all send through the default Email integration. Open Notifications and check that the Email integration is active and set as the default. To see what was sent, open Audit, sign-in and notification logs.

Why did everyone get signed out at once?

Turning on SSO-only login revokes every session, including yours. The confirmation button reads Enable and sign out. Setting Global 2FA to Optional or Required also signs out the users who must use 2FA and have not set it up yet. See Single sign-on (SSO) and Sign-in security.

Why does sign-in say "Account is deactivated"?

An administrator deactivated the account. An administrator must activate it again in Users. If you sign in with SSO, the message reads Your account is inactive. Contact your administrator.

What does "Internal server error" mean?

An unexpected error stopped the request, and the platform hides the details on purpose. Try again. If it repeats, report the message with the steps you took and the time it happened.