compliance-ownerengineer

Troubleshooting

Was this page helpful?

"My SBOM uploaded but no alert appeared."

This is almost always expected, not a bug. Two common reasons:

Zero purls matched. If your SBOM's components don't carry a resolvable purl, or none of them match anything in the current advisory feeds, there's nothing to alert on.
Every match was Tier B or C. Only Tier A raises an alert, by design. Tier B shows in your inventory and the weekly digest; Tier C shows in your inventory only. Check your product's component list for matches that didn't reach Tier A before assuming the upload failed.

See Understand your first alert for how tiers are assigned.

"My case shows overdue but I already filed."

A stage can only be marked submitted with an SRP reference number or a note explaining an offline filing. If you filed but didn't enter one of those two things, the case has no way to know the filing happened, and keeps showing overdue.

Fix: open the case and enter the missing SRP reference or offline-filing note — not a support ticket. See What to do if you're already overdue.

"A VEX statement I filed didn't close my alert."

Expected if the alert was already open before the VEX statement arrived. Declara deliberately does not let a VEX statement retroactively close an open alert, even one with status not_affected or fixed — see Why VEX suppresses a match but never an open alert for why. Close the alert through its own triage flow instead of resubmitting the statement.

"I need to correct a report I already submitted."

A stage marked submitted is not edited in Declara: what was filed stays as it was filed. Correct it on the reporting platform, which keeps a notification editable until the final report is submitted, then record what you changed under the stage's On the platform panel. If the coordinating CSIRT marked it invalid, record that first, with its note; the correction returns it to submitted. See Track a filing. Anything new can also go into the next stage's report, which carries fields forward and lets you update them.

"The release gate stays `pending`."

pending means the gate will not answer on partial data. It stays there while:

the version has no SBOM yet,
the newest upload has not finished parsing, or
matching has not run since that upload was parsed.

Matching runs after each upload is parsed, and every six hours for the whole workspace. A pipeline should poll, as the CI examples do; never treat pending as a pass. Recording a decision in the app is refused until it clears, with "Matching has not run on this version's latest SBOM yet."

"The gate says `latestUploadFailed: true`."

The newest SBOM for the version did not parse, so the answer is about the SBOM before it. Open the product: the version shows the failed upload and the reason. Fix the document, usually its format or a file that is empty or only lists cryptographic assets, and upload it again. Until then the gate keeps answering on the older inventory.

Both public links give that same answer for every refusal, so the page cannot be used to learn which links exist. For a shared SBOM link it covers: an expired or revoked link, a version outside the link, a paused or archived product, a disclosure page that is not published, and a plan that no longer includes SBOM sharing. For a supplier request it also covers a request that has already been answered.

The recipient cannot tell which applies; you can. Check the link's status in the app, since a refused attempt on a link that exists is logged against it. Send a new link if it expired or was revoked.

A 429 with "Too many requests from this address. Try again in a few minutes." is the rate limit on these pages, counted per visitor address before the link is looked at. Wait the number of seconds in Retry-After.

"A Dependency-Track project is not syncing."

Open Settings → Integrations. The Dependency-Track panel shows each project's last result: imported, unchanged (the BOM matches the last upload, so nothing new was recorded) or error with a reason. Common reasons:

"Dependency-Track refused the API key (401)" or "(403)": check the key and that its team can view the portfolio and the project.
"Dependency-Track has no such project (404), or the key cannot see it.": check the UUID and, with portfolio access control on, the team's access.
"The Dependency-Track project has no version, or one Declara cannot use.": set a version such as 4.2.0 on the project.
A redirect: give the API server's own URL; redirects are not followed.
"Dependency-Track could not be reached." or did not answer within 30 seconds: the server must be reachable over HTTPS from the internet, and an address on a private network is refused. For an on-premises server, use the push script in Connect Dependency-Track.
"Your plan no longer includes integrations.": the import needs the Growth or Partner plan.
"Not reached in this run": the run stopped before that project; it continues the next day or on Sync now.

Syncs run once a day. Sync now queues one straight away; refresh after a minute.

"My AI assistant gets 401 or 403 from MCP."

The MCP endpoint authenticates exactly like the REST API.

401: no bearer token, a token that does not start with dcl_, or a key that is unknown ("That key is not valid."), revoked or expired. Create a new key; a lost secret cannot be shown again.
403: the key does not carry products:read, which is needed to connect at all, or the workspace is closed. Create a key with products:read; scopes cannot be added to an existing key.
A single tool refusing, with the others working, means the key lacks that tool's scope. The refusal names it. See the tool and scope list.

"My Trust Center page returns 404."

A Trust Center page answers "not found" whenever it should not be public, in the same words as an address that never existed. Check, in this order:

the product's Trust Center is published, not unpublished,
your disclosure page is published,
the product is active or marked end of support, not paused or archived,
the address has not changed since the link was shared,
the plan includes the Trust Center (Starter, Growth or Partner), and
the workspace is running: trialing, active or in its payment grace period. A read-only or cancelled workspace keeps its settings, but nothing is public.

Public pages refresh within moments of a change; a cached copy can linger briefly. See Publish a product's Trust Center.