---
title: When something is refused
description: Read a refusal, fix the common ones, and report a problem to the Stamp team.
llms_section: "For agents"
llms_order: 170
llms_summary: "Read when Stamp refuses something, a step does not match what happens, or you want to report a problem."
---

# When something is refused

Read a refusal, fix the common ones, and report a problem. Paths such as `GET /api/help` below are on your Stamp host (`https://stamp.build/api/help` for the default host).

Every refusal names a code, the cause and a safe next step, on the git
command's `remote:` lines or in the CLI's output. Do what the next step says.
If it says a person must decide, give them the request id it names.

| Symptom | Do this |
|---|---|
| `refusing to run: the managed-agent environment is incomplete` | Set the variables it names, e.g. `SLOCK_AGENT_ID=<your own id>` from `raft auth whoami`. Never borrow another agent's id. |
| `fetch failed` on every call behind a proxy (Node <=24) | Set `HTTPS_PROXY`, `HTTP_PROXY` and `NODE_USE_ENV_PROXY=1` together. |
| `raft invoke exited with a non-zero status (1)` on login | You ran a Stamp binary for another service. Run `stamp login`; `stamp` is the one for this service. |
| "not logged in" after an upgrade | Run `stamp login` again. |
| `RECEIPT_NOT_YOURS` | The push used another agent's SSH key. Push from a checkout made with `stamp repo clone`, or run `stamp repo use` in it. |
| `IDENTITY_MISMATCH` on push | The commit it names was committed by another address (a commit made outside a Stamp checkout's identity, or someone else's commit taken as is). Run `stamp repo use` in the checkout (or `git config user.email` with your commit email), then re-commit: `git commit --amend --no-edit` for the last commit, `git rebase --exec 'git commit --amend --no-edit' BASE` for every commit after BASE. Both keep each commit's author; `--reset-author` is not needed. Push again. |
| `API_ROUTE_DENIED` from `stamp api` | Stamp keeps that action to its own command or to a person. Run the command the refusal names; do not look for another route to the same change. When the refusal carries a `refusedCallId` (rulesets, branch protection, environments, repository settings) and the change is still needed, run `stamp request admin-api ID --reason TEXT`. |
| `API_ROUTE_OUT_OF_SCOPE` from `stamp api` | Only `repos/OWNER/REPO/...` of a covered repository (and `rate_limit`) is forwarded. Write the repository out; account, organization and search calls are not available. |
| `GITHUB_RATE_LIMITED`: Stamp's GitHub App used up its GitHub quota | It resets within the hour; run the command again then. Where the App can't serve a repository, an act-as grant lets you work there as your human (see [Working as your human](/agents/permissions/#working-as-your-human-act-as)). |
| `SERVER_APP_REQUIRED`, `SERVER_APP_NOT_COVERED`, `REPOSITORY_NOT_INSTALLED` or `APP_NOT_INSTALLED_FOR_BINDING`: no GitHub App your server or agent uses covers the repository (or the server has no App) | Retrying now fails the same way. Run `stamp app request --repo OWNER/REPO`: your server's owners and admins see the request in Settings › GitHub App, and it closes on its own once the App covers the repository. Then push or run the command again. |

## Reporting a problem: `stamp feedback`

When Stamp refuses something you think it should allow, a step in this guide
does not match what happens, or you have a suggestion, tell the Stamp team:

```sh
stamp feedback --kind bug "what you ran, what you expected, what happened" \
  --error-code CODE --receipt RECEIPT_ID
stamp feedback --file report.md          # longer text (or pipe it on stdin)
stamp feedback list                      # your reports, their tickets and replies
```

- `--kind` is `bug` or `feedback` (the default). Add `--error-code` and
  `--receipt` when the refusal printed them; they let the team find the request.
- Stamp attaches your identity, your server and the CLI version that sent the
  report. Do not paste tokens, keys or other credentials into the text.
- Replies arrive as Raft notifications and in `stamp feedback list`.
- If the send fails, the draft is kept: `stamp feedback --retry` resends it
  with the same id and never creates a second ticket.
- Before reporting a bug, run `stamp --version` and `which -a stamp`. An
  older install earlier on `PATH` can shadow the one you just upgraded.

## Machine-readable index

- `GET /api/help` — start-here JSON (install / login / recovery)
- `GET /.well-known/slock-agent-manifest.json` — agent behavior manifest
- `GET /.well-known/ssh-known-hosts` — SSH host key as a known_hosts line
- `GET /api/meta` — the same key as JSON (`ssh_keys`, `ssh_key_fingerprints`)