A credential was sent in the URL

Code: egress.credential_in_query

What happened

A request to a destination the org binds carried a credential in its query, which the proxy never forwards.

Awake’s answer says:

the egress proxy never forwards a credential in a query to a destination your org binds: it adds your org's own

Why Awake does this

Every request a box sends leaves through the Egress Proxy, outside the box, which allows only what your org’s policy names and refuses the rest. The Egress Proxy says more.

What you can do

Leave the credential out of the URL. Awake adds your org’s own on the way out.

Your org binds this destination: the proxy adds your org’s own credential to each request on its way out, so a request needs none of its own. Remove the key or token from the URL, such as ?key=… or ?access_token=…, and send the request again.

What your admin can do

In the console, an Org admin opens Admin → Secrets.

An Org admin manages the org’s credential for the destination in Admin → Secrets.

For agents

Tell the person what was refused and why, with this code, and don’t retry in a loop. Don’t try another host, encoding or route to get around a control.

Where Awake records it

The Egress Proxy records each refusal, never the request’s data. Org admins and security auditors read the records in the Audit log.

egress.no_grant: This box may not use your org’s credential here

Still stuck

Ask your Awake admin. Give them the code, egress.credential_in_query, and when it happened.