availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises
Package: Invicti API Security Standalone or Bundle

NTA troubleshooting

This document provides troubleshooting guidance for common issues when deploying and running Invicti Network Traffic Analyzer (NTA).

Authorization failures

If the NTA can't authorize with Invicti Platform (receiving HTTP 401 responses), it automatically retries the authorization attempt. After 3 failed retries, the NTA gracefully shuts down with an error message indicating the authorization failure.

Common causes of authorization failures:

• Invalid or expired registration token
• Incorrect Invicti Platform credentials (email or license key)
• Network connectivity issues preventing access to Invicti Platform
• You skipped the Save step during token generation

To resolve:

1. Verify your registration token is valid and saved in Invicti Platform - go to Discovery >API configuration >API sources

2. Confirm your Invicti Platform email and license key are correct

3. Ensure network connectivity from your deployment environment to Invicti Platform

4. Generate a new registration token if needed and update your deployment configuration

5. Review the NTA logs for specific error messages:

   For Kubernetes deployments:

   kubectl logs <reconstructor-pod-name> -n <your-namespace>

   For Docker deployments:

   docker logs <container-name>

Token expiry after disconnection

If the NTA is left disconnected from Invicti Platform for an extended period, its session token expires and can no longer refresh. When this happens, the NTA starts returning 401 Unauthorized heartbeat errors:

{"level":"error","message":"Heartbeat returned non-OK response","statusCode":401,"status":"401 Unauthorized"}
{"level":"warn","message":"Heartbeat failed; will retry on next tick","statusCode":401}

This is expected behavior. Common triggers include leaving a dev environment idle overnight or the host machine going to sleep.

To restore the connection (Docker Compose):

1. Generate a new registration token in Invicti Platform. For instructions, see Generate a new registration token.

2. Open docker-compose.yml and replace the value of APIHUB_CONFIG with the new token:

   environment:
     APIHUB_CONFIG: YOUR_NEW_REGISTRATION_TOKEN_HERE

3. Force-recreate the reconstructor container to apply the change:

   docker compose -f docker-compose.yml up -d --force-recreate reconstructor

4. Confirm the connection is restored:

   docker compose logs -f reconstructor

   Look for Heartbeat completed successfully in the output.

Pod/container status issues

If NTA components are in CrashLoopBackOff or Error states, review the logs for specific error messages and verify:

• The registration token is valid and properly configured
• Network policies allow outbound connections to Invicti Platform
• Resource limits are appropriate for your traffic volume
• You've set all required environment variables correctly

Review pod status (Kubernetes):

kubectl get pods -n <your-namespace>

Review container status (Docker):

docker ps -a

Network connectivity issues

If the NTA can't reach Invicti Platform:

1. Verify firewall rules allow outbound HTTPS connections

2. Review proxy configurations if using a corporate proxy

3. Ensure Domain Name System (DNS) resolution works for Invicti Platform endpoints

4. Test connectivity from your deployment environment:

   curl -I https://platform.invicti.com

No APIs appearing in API Inventory

If the NTA is running but APIs aren't appearing in your API Inventory:

1. Verify traffic is actually flowing through the monitored interfaces/endpoints
2. Verify that traffic matches the capture criteria (HTTP methods, status codes)
3. Confirm the NTA has successfully authorized (review logs)
4. Wait a few minutes - API reconstruction and sync may take time
5. Review the reconstructor logs for processing errors

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center