> ## Documentation Index
> Fetch the complete documentation index at: https://docs.symmetry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API returns 401

> Why the CBS API rejects a request with 401, and how to fix it.

The CBS API returns **HTTP 401** for every authentication and key problem (there is no `403`). The body is `{ "message": "…" }`.

| Message                                        | Cause                                                 | Fix                                                                                         |
| ---------------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| `No api key found`                             | The `pcc-api-key` header is missing or blank          | Send your key in the header on every request (the root/listing endpoint requires it too).   |
| `Invalid api key`                              | The key isn't recognized                              | Double-check the value. Need one? See [Getting support](/symmetry/support/getting-support). |
| `Profile has been disabled`                    | The key is disabled                                   | Contact Symmetry.                                                                           |
| `Profile does not have access to this product` | The key isn't entitled to CBS                         | Ask Symmetry to enable CBS for the key.                                                     |
| `Failed security check`                        | The request origin isn't on the key's allowed domains | Add your domain to the key, or call from an allowed origin.                                 |
| `API rate limit has been exceeded.`            | A trial key is over its cap                           | See [Rate limit exceeded](/cbs/api/rate-limit-exceeded).                                    |

<Note>
  Validation problems are **not** 401. A bad or missing body field returns **400**, and malformed JSON or an invalid state parameter returns **422**. See [Error codes and fixes](/cbs/api/error-codes).
</Note>

Authentication details: [Authentication model](/cbs/core-concepts/authentication-model).