Troubleshooting
Text in code is the exact message as the product or Salesforce shows it, including Salesforce's own lower-case OAuth errors. Plain text is a symptom.
Access
| You see | Why | Do |
|---|---|---|
You do not have access to Veles. | Your user lacks the Veles Admin permission set. | Assign the packaged set, then reload the page. |
Veles is not enabled on this org. | This production org has no Veles licence. Sandboxes and scratch orgs are covered by their Hub; every production org is licensed on its own. | Contact us. |
Your user has no Veles seat on this org. | The package licence has seats and yours is not one of them. | Setup > Installed Packages > Manage Licenses > Add Users. |
Connection
| You see | Why | Do |
|---|---|---|
| Verification failed on the Setup tab | One of the Step 1 sub-steps is not done. | The panel names the blocker and the sub-step. Every message is on Integration user and ECA. |
user is not admin approved to access this app | Salesforce OAuth error. The integration user's permission set is not in the ECA's pre-authorised list. | Step 1.4. |
External client app is not installed in this org | Salesforce OAuth error. Nearly always a wrong or inactive username, not a missing app. | Step 1.1, including the sandbox suffix. |
| Connection issue or Authorization failed on a row | The last call to that org failed. A failed call never disconnects an org. | Click Check again and read the reason. Fix what it names (user, permission set, ECA, Remote Site Setting), check again. Deploy RSS re-creates a missing Remote Site Setting; Setup Environment re-runs setup and skips finished steps. |
Veles package mismatch | Hub and child run different package versions. | Upgrade the older one. |
Pull is unavailable: this org is not connected to a Hub. | Step 2 of the child's Setup tab is missing, or the Hub revoked the connection. | Save Step 2 again, or reconnect from the Hub. |
Refresh
| You see | Why | Do |
|---|---|---|
| Nothing happened after a refresh | Detection is off, the row is not watched, or the production user cannot sign in. | Check in order: Sandbox Refresh Detection scheduled on the Hub; Auto-Detect Refresh on and Production Environment set on the sandbox row; Last checked on the production row (Check for refreshes now); the production's integration user still signs in (Check again). |
Refresh not started: ... | The production integration user is missing, inactive or not pre-authorised in production. | The Sandbox Refresh row says which. Fix it in production, request again. |
Assigned workflows were not run: <hub> has "Run Workflows After Refresh" off | The sandbox's row on the Hub has that toggle off. | Turn it on for that sandbox and click Run in its Assigned Workflows. |
Self-service refresh is not enabled for this sandbox | Allow Self-Service Refresh is off on the Hub's row. | Turn it on. |
Workflows
| You see | Why | Do |
|---|---|---|
Workflows never run on a production org. | By design. | Pick a sandbox or scratch org. |
This org can run workflows only on its own environment. | A child cannot run workflows elsewhere. | Run them from the Hub. |
A step failed with ... not found in <org> | The Named Credential, External Credential, Flow or profile does not exist on the target org. | Create it there, or fix the name, and run again. |
| Reset Passwords skipped users | Their email still ends in .invalid. | Put Fix Email Addresses before it. |
| Taking longer than expected or Mark as failed | A run is waiting on a step that has not reported back. | See Activity Log. |
Plan limits
| You see | Why | Do |
|---|---|---|
... includes N connected orgs and all of them are in use. | You hit the plan's cap. Existing orgs keep working. | Delete an environment you no longer use, or see Plans and pricing. |
<Feature> is not available on your <Plan> plan. | Custom actions, multi-hub, the audit log and configurable retention need Enterprise. On a child the message names the Hub whose plan applies. | Upgrade the Hub, or stay without that feature. |
Still stuck
Email contact@beyondthecloud.dev with the environment name, the Activity Log row and the exact message. Nothing in the log contains a secret, so it is safe to paste.