Before you begin
- Know the Orchestris Server origin, affected user or key owner, and approximate failure time.
- Use an account authorized for the relevant organization when checking Admin UI diagnostics.
Start with a safe, repeatable check
- 1
Record scope and time
Record the server origin, organization, affected user or API-key prefix, route, model or alias, exact local time, and timezone. Never record the full API key.
- 2
Check public process health
Request GET /health on the same origin. HTTP 200 with {"status":"ok"} confirms the API process is answering; it does not prove the database, provider, catalog, license, or a specific model is healthy.
- 3
Capture the structured error
Keep the HTTP status, response x-request-id header, error code or type, and error_id when present. Redact prompts, message content, tokens, credentials, and personal data.
- 4
Narrow the affected layer
Check /ops, /provider-errors, /catalog-health, and /usage as your role permits. Reproduce once with the smallest safe request.
curl --fail-with-body --silent --show-error \
"https://chat.example.com/health"Read the response envelope
Native Orchestris routes use the native envelope below. Errors produced inside an authenticated OpenAI-compatible handler use the OpenAI-style envelope. Authentication, request-size, and rate-limit middleware can reject an /openai/v1 request before that handler runs, so a compatible client must safely handle either structured shape. Use the HTTP status together with structured fields; do not parse the human-readable message.
{
"error": {
"code": "quota_exceeded",
"message": "Quota exceeded"
},
"request_id": "550e8400-e29b-41d4-a716-446655440000",
"error_id": "0198..."
}{
"error": {
"message": "Request limit exceeded.",
"type": "too_many_requests"
}
}HTTP status reference
| Status | Current meaning | First action |
|---|---|---|
| 400 Bad Request | Invalid field, header, validation, assignment version, or pagination input | Correct the named parameter; do not retry the same body |
| 401 Unauthorized | Missing, invalid, or expired authentication | Refresh sign-in or replace the Bearer key |
| 402 Payment Required | Native /v1 usage quota, API-key count quota, or license request limit | Use the error code to check the daily user/group model quota, daily API-key token or cost budget, API-key count, or license entitlement; this is not transport throttling |
| 403 Forbidden | Role, group/model access, API-key policy, feature gate, or license state blocks access | Check the exact error code and the owner's organization access |
| 404 Not Found | Route or resource is absent in the current scope | Verify the origin, route, identifier, and organization |
| 408 Request Timeout | The server timed out while sending to the client | Check the connection and retry only when the operation is safe |
| 409 Conflict | The resource changed, an invite is already accepted, or another state conflicts | Refresh current state before retrying |
| 413 Payload Too Large | Request or attachment exceeds a configured limit | Reduce the payload; repeated retries will not help |
| 422 Unprocessable Entity | Missing synchronized attachments or a pagination limit violation | Complete required uploads or reduce the requested page |
| 429 Too Many Requests | Transport/concurrency throttling; OpenAI-compatible routes also normalize usage quota failures to 429 | Honor Retry-After when present and reduce request rate or concurrency |
| 500 Internal Server Error | Unexpected server failure | Capture correlation IDs and inspect operator logs |
| 501 Not Implemented | The requested operation is not implemented | Stop retrying and use a documented supported route |
| 502 Bad Gateway | Provider request or provider authentication failed | Check /provider-errors and the provider configuration |
| 503 Service Unavailable | Temporary service, refresh, cache-invalidation, or lock condition | Honor Retry-After when present, then retry with backoff |
| 504 Gateway Timeout | The upstream model provider timed out | Retry with backoff and inspect provider latency/errors |
- Status
- 400 Bad Request
- Current meaning
- Invalid field, header, validation, assignment version, or pagination input
- First action
- Correct the named parameter; do not retry the same body
- Status
- 401 Unauthorized
- Current meaning
- Missing, invalid, or expired authentication
- First action
- Refresh sign-in or replace the Bearer key
- Status
- 402 Payment Required
- Current meaning
- Native /v1 usage quota, API-key count quota, or license request limit
- First action
- Use the error code to check the daily user/group model quota, daily API-key token or cost budget, API-key count, or license entitlement; this is not transport throttling
- Status
- 403 Forbidden
- Current meaning
- Role, group/model access, API-key policy, feature gate, or license state blocks access
- First action
- Check the exact error code and the owner's organization access
- Status
- 404 Not Found
- Current meaning
- Route or resource is absent in the current scope
- First action
- Verify the origin, route, identifier, and organization
- Status
- 408 Request Timeout
- Current meaning
- The server timed out while sending to the client
- First action
- Check the connection and retry only when the operation is safe
- Status
- 409 Conflict
- Current meaning
- The resource changed, an invite is already accepted, or another state conflicts
- First action
- Refresh current state before retrying
- Status
- 413 Payload Too Large
- Current meaning
- Request or attachment exceeds a configured limit
- First action
- Reduce the payload; repeated retries will not help
- Status
- 422 Unprocessable Entity
- Current meaning
- Missing synchronized attachments or a pagination limit violation
- First action
- Complete required uploads or reduce the requested page
- Status
- 429 Too Many Requests
- Current meaning
- Transport/concurrency throttling; OpenAI-compatible routes also normalize usage quota failures to 429
- First action
- Honor Retry-After when present and reduce request rate or concurrency
- Status
- 500 Internal Server Error
- Current meaning
- Unexpected server failure
- First action
- Capture correlation IDs and inspect operator logs
- Status
- 501 Not Implemented
- Current meaning
- The requested operation is not implemented
- First action
- Stop retrying and use a documented supported route
- Status
- 502 Bad Gateway
- Current meaning
- Provider request or provider authentication failed
- First action
- Check /provider-errors and the provider configuration
- Status
- 503 Service Unavailable
- Current meaning
- Temporary service, refresh, cache-invalidation, or lock condition
- First action
- Honor Retry-After when present, then retry with backoff
- Status
- 504 Gateway Timeout
- Current meaning
- The upstream model provider timed out
- First action
- Retry with backoff and inspect provider latency/errors
Retry-After is measured in seconds when present. Wait at least that long. For other transient 5xx failures, use bounded exponential backoff and preserve the same safe client correlation ID in your records.
When a model or alias is missing
- 1
Check the provider
At /providers, confirm the organization provider is active and its credentials and endpoint verify successfully.
- 2
Check the organization model
Confirm the model is present and active. Discovery alone does not grant access.
- 3
Check member access
Organization and server administrators see the full organization catalog. A regular member needs an active group grant for the model.
- 4
Check the alias
At /model-aliases, confirm the alias points to one active backing model. An alias is not an automatic fallback rule.
- 5
Check the API key
For agent requests, confirm the key is active, unexpired, owned by the expected subject, and permits that model or alias.
Collect normal logs before changing log levels
Start with the logs your installation already produces. Capture the shortest window that includes the failure and its x-request-id, then redact it before sharing. Enable temporary debug logging only when the normal output is not enough.
| Deployment | Normal log location | How to collect it |
|---|---|---|
| Community Edition on Windows | %LOCALAPPDATA%\Orchestris\logs\orchestris-api.*.log and orchestris-admin.*.log | Open the tray menu and choose Status to confirm the log directory, or read the files with PowerShell |
| Community Edition on macOS | ~/Library/Application Support/Orchestris/logs | Choose View Logs from the Orchestris menu; inspect launcher.log, supervisor.log, api.log, and admin.log |
| Community Edition on Linux | The systemd journal for orchestris-api.service and orchestris-admin.service | Use journalctl for a short time window |
| Community Edition with Docker | The orchestris-ce container's standard output | Use docker logs with the container name from the Docker installation guide |
| Hosted web Chat | Browser developer console | Capture only the relevant errors; the web build does not create orchestris_chat.log |
| Native Orchestris Chat | The operating system's Documents folder under logs/orchestris_chat.log | ORCHESTRIS_LOG_DIR can override the directory; Linux protects the directory and file with private permissions |
- Deployment
- Community Edition on Windows
- Normal log location
- %LOCALAPPDATA%\Orchestris\logs\orchestris-api.*.log and orchestris-admin.*.log
- How to collect it
- Open the tray menu and choose Status to confirm the log directory, or read the files with PowerShell
- Deployment
- Community Edition on macOS
- Normal log location
- ~/Library/Application Support/Orchestris/logs
- How to collect it
- Choose View Logs from the Orchestris menu; inspect launcher.log, supervisor.log, api.log, and admin.log
- Deployment
- Community Edition on Linux
- Normal log location
- The systemd journal for orchestris-api.service and orchestris-admin.service
- How to collect it
- Use journalctl for a short time window
- Deployment
- Community Edition with Docker
- Normal log location
- The orchestris-ce container's standard output
- How to collect it
- Use docker logs with the container name from the Docker installation guide
- Deployment
- Hosted web Chat
- Normal log location
- Browser developer console
- How to collect it
- Capture only the relevant errors; the web build does not create orchestris_chat.log
- Deployment
- Native Orchestris Chat
- Normal log location
- The operating system's Documents folder under logs/orchestris_chat.log
- How to collect it
- ORCHESTRIS_LOG_DIR can override the directory; Linux protects the directory and file with private permissions
Get-Content "$env:LOCALAPPDATA\Orchestris\logs\orchestris-api.stderr.log" -Tail 200
Get-Content "$env:LOCALAPPDATA\Orchestris\logs\orchestris-api.stdout.log" -Tail 200sudo journalctl -u orchestris-api.service -u orchestris-admin.service --since "30 minutes ago" --no-pagerdocker logs --since 30m orchestris-ceIf the normal logs do not explain the failure, temporarily set ORCHESTRIS_LOGGING__LEVEL to orchestris_api=debug,orchestris_core=debug,orchestris_providers=debug. On Windows, edit %LOCALAPPDATA%\Orchestris\orchestris.env and choose Restart Server from the tray. On macOS, edit ~/Library/Application Support/Orchestris/orchestris.env and choose Restart from the Orchestris menu. On Linux, add the override to /etc/orchestris/orchestris.env.local and restart orchestris.target. For Docker, stop and remove only the orchestris-ce container, then repeat the Docker guide's Run Community Edition command with the extra environment option below. The named orchestris-data volume keeps the deployment state.
ORCHESTRIS_LOGGING__LEVEL=orchestris_api=debug,orchestris_core=debug,orchestris_providers=debug-e ORCHESTRIS_LOGGING__LEVEL="orchestris_api=debug,orchestris_core=debug,orchestris_providers=debug" \sudo systemctl restart orchestris.targetORCHESTRIS_LOGGING__LEVEL=infoEscalate with useful, safe evidence
- Orchestris Chat version and platform, or Server version/deployment method
- Server origin without credentials, affected organization, and affected role
- Exact timestamp with timezone and whether the issue is repeatable
- HTTP method and route, status, structured error code or type, x-request-id, and error_id
- Model or alias identifier and only the API-key prefix when an agent request is involved
- A minimal reproduction and a short, redacted log window around the same request ID