Troubleshooting

Work through this list before you open a support ticket. Most failures are IAM, a disabled API, or an excluded project.

Test connection failsCopy Anchor Link

• Confirm the JSON is a Google service account key, not an OAuth client file.
• Confirm the key is not disabled in IAM & Admin → Service Accounts → Keys.
• Confirm required APIs are enabled on the home project.

Common messages:

• Invalid service account key: Google could not verify the private key. Download a new JSON key and paste it again.
• Service account not found: the service account or its key was deleted in GCP. Create a new one.
• Permission denied: the service account is missing a necessary permission. Compare it with the IAM list.
• No GCP projects have all necessary IAM permissions: no project the key can see is green yet. Grant the role on the projects you want scanned (or the org role, for Organization level), then test again.

Project is redCopy Anchor Link

Expand the card. Grant every necessary permission that shows ✕. Re-test. Do not save until at least one project is green and selected.

Common misses:

• Custom role created but never bound on that project
• Bound Job User instead of the atomic custom role (missing Storage Read or tables.list)
• Bound the role on folder A while the dataset lives in project B

List of projects is too shortCopy Anchor Link

Grant resourcemanager.projects.get at folder or org, or bind the necessary role on each project and test using a key that can see that project. Project search is optional. With many projects, pick Organization level access instead. See Project or organization access.

Scan finished but dashboard is emptyCopy Anchor Link

• No jobs in the window (new project). Storage findings can still appear.
• All found regions are excluded on the connection (“All discovered regions are disabled”). Remove an entry under Excluded regions in the Settings tab on Connections.
• No regions were found (“No BigQuery regions were found for this connection yet”). Check that the key can list datasets (bigquery.datasets.get), then run the scan again.
• You excluded every project after test.

The scan did not finishCopy Anchor Link

A failed scan is retried with a growing delay, up to 5 attempts, and resumes from the last query it saved. After that it stays failed until the next scheduled scan. The cause is usually a revoked role or a disabled API: run Test connection on Connections, fix any red row, and the next scan picks it up.

"A scan is already queued or running for this connection."Copy Anchor Link

A scan is already in progress for this connection. Wait for it to finish.

Lineage, tags, catalog, or audit emptyCopy Anchor Link

Those features need optional APIs and optional IAM. Core scans skip them instead of failing.

SERVICE_DISABLEDCopy Anchor Link

Open the enable URL on the error card, enable the API, wait 1 to 2 minutes, test again.

Permission probe says “could not check” or shows a dashCopy Anchor Link

• ? Could not check: Google did not answer the probe (for example a disabled API or an access error). It is not a deny. Fix the API or access problem, then test again.
• – Not checkable on this project: the permission is granted above the project (folder or organization), so it cannot be tested on one project. This is expected for Organization level access.

dbt graph missingCopy Anchor Link

Upload a manifest.json or connect dbt Cloud. Option A comments alone do not build the full DAG. See dbt.

A page shows a lockCopy Anchor Link

Your plan does not include that feature. Hover the lock in the sidebar to see which plan has it. See Plan limits.

"Choose a plan first"Copy Anchor Link

The account has no plan yet. Pay for a plan, or wait for the free trial to be approved. Until then, changes are not saved. See 30-day trial.

The app is read-only and scans stoppedCopy Anchor Link

The trial or the paid plan ended. Choose a plan in Settings → Billing. If Settings → Billing says your plan is on hold, a payment failed: update the card in Manage billing instead. Your data is kept for 30 days after the end. See 30-day trial and If a payment fails.

"You used all of this month's AI usage"Copy Anchor Link

Your plan's monthly AI usage is used up. It resets on your billing date, the day your plan started. The message shows the reset date. See Plan limits.

I cannot give a teammate accessCopy Anchor Link

All seats are in use. Set someone to No access, or upgrade. See Seats.

A banner says spend is above $50kCopy Anchor Link

Your analyzed BigQuery spend was above $50k in two full months in a row. Nothing is blocked. See Enterprise and the spend band.

AI DBA does nothingCopy Anchor Link

• Check that the policy is Enabled and not Paused.
• Check that the action type is turned on in the policy.
• For BigQuery changes: check the operator key status. Missing permissions are listed.
• For pull requests: check that the GitHub App is installed and the repo is mapped to the dbt project.
• For AI-written fixes: check both Allow AI-written fixes and Send SQL to the LLM.
• Open the action. Policy decision says why it waits or was blocked.

See Set up the AI DBA.

Still stuckCopy Anchor Link

Contact us with the service account email (not the private key), the project id, and a screenshot of the expanded permission card.