Troubleshooting overview  |  API Gateway Documentation  |  Google Cloud (2024)

This page provides general troubleshooting information for API Gateway.

Cannot run "gcloud api-gateway" commands

To run the gcloud api-gateway ... commands, you must have updated theGoogle Cloud CLI and enabled the necessary Google services.See Configuring your development environment for more.

Command "gcloud api-gateway api-configs create" says service account does not exist

If you run the gcloud api-gateway api-configs create ... command and receivean error in the form:

ERROR: (gcloud.api-gateway.api-configs.create) FAILED_PRECONDITION:Service Account "projects/-/serviceAccounts/service_account_email" does not exist

Rerun the command but this time include the --backend-auth-service-account option toexplicitly specify the email address of theservice account to use:

gcloud api-gateway api-configs create CONFIG_ID \ --api=API_ID --openapi-spec=API_DEFINITION \ --project=PROJECT_ID --backend-auth-service-account=SERVICE_ACCOUNT_EMAIL

Ensure that you have already assigned the necessary permissions to the service accountas described in Configuring your development environment.

API request returns an HTTP 403 error

If a request to a deployed API returns an HTTP 403 error to the API client,it means the requested URL is valid but access is forbidden for some reason.

A deployed API has the permissions associated with roles granted to theservice account that youused when you created the API config. Typically, the reason for the HTTP 403 erroris that the service account does not have the necessary permissions to access the backend service.

If you defined the API and the backend service in the same Google Cloud Project,ensure that the service account has the Editor role assigned to it,or the role necessary to access the backend service. For example, if the backend serviceis implemented using Cloud Run functions, ensure that the service accounthas the Cloud Function Invoker role assigned to it.

API request returns an HTTP 401 or 500 error

If a request to a deployed API returns an HTTP 401 or 500 error to the API client,there may be a problem using the service account used when you created the API config to call your backend service..

A deployed API has the permissions associated with roles granted to theservice account that you used when you created the API config. The service account is checked tomake sure that it both exists, and can be used by the API gateway when the APIis deployed.

If the service account is deleted or disabled after the gateway isdeployed, the following sequence of events may occur:

1. Immediately after the service account is deleted or disabled, you may see 401HTTP responses in your gateway logs. If the response_code_details field isset to "via_upstream" in the log entry'sjsonPayload, this indicates thatdeleting or disabling the service account is the cause of the error.

2. You may also see an HTTP 500 error without any corresponding log entry in theAPI gateway's logs. If there are no requests to your gateway immediatelyafter the service account is deleted or disabled, you may not see the HTTP 401 responses, but the HTTP 500 errors without corresponding API gateway logsare an indication that the gateway's service account may no longer be active.

High latency API requests

Like Cloud Run and Cloud Run functions,API Gateway is subject to "cold start" latency. If your gateway has not received traffic for 15 to 20 minutes, requests made to your gateway within the first 10 to 15 seconds of the cold start will experience 3 to 5 seconds of latency.

If the issue persists after the initial "warm up" period, check the request logsof the backend service(s) you configured in your API Config. For example, if thebackend service is implemented using Cloud Run functions, checkthe Cloud Logging entries of the associated Cloud Function request log.

Cannot view log information

If your API is responding correctly, but the logs contain no data, it typically means that you have not enabled all of the Google services required by API Gateway.

API Gateway requires that you enable the following Google services:

To confirm that the required services are enabled:

gcloud services list

If you do not see the required services listed, enable them:

gcloud services enable apigateway.googleapis.comgcloud services enable servicemanagement.googleapis.comgcloud services enable servicecontrol.googleapis.com

For more information about the gcloud services, seegcloud services.