Skip to main content
This page covers the common errors you might encounter when sending requests to the APIs.
This is usually caused by the selected modules in the Journey builder not having the needed credentials. In this case, the journey completes with a 201 status code but returns no module results.To confirm this, send a POST request to the /journey/state/fetch endpoint. You will receive a response showing the GET_CREDENTIALS_ERROR code.To resolve this, contact your GBG Go account manager to update the credentials for your modules.
When you call the /journey/state/fetch endpoint and receive a “COMPLETED” status (rather than a credentials error), this means that the journey has been successfully finished and no further action is required.
If you are a new user who attempts to log in to GBG Go with valid credentials but is immediately logged out, this might be because your organization hasn’t been created in the system yet. The account exists, but without an associated organization, the system cannot direct you to your dashboard and automatically logs you out.To resolve this, contact your GBG Go account manager for help troubleshooting the issue.

​
Symptom

When you request an access token, the token endpoint returns a 401 response with error set to unauthorized_client:
JSON
The error_description depends on the cause. For example, a wrong client secret returns Invalid client or Invalid client credentials.

​
Cause

The token endpoint won’t issue a token for the credentials in your request. This usually happens for one of the following reasons:
  • The client secret is wrong, or someone regenerated it. Regenerating a secret stops the old secret from working.
  • The request uses a grant type that your API client doesn’t support.
It might also happen if your API client doesn’t have a role assigned.

​
Resolution

To resolve the error:
  1. Check the client secret in your request. Copy it again from where you stored it, and check for extra spaces.
  2. If you’ve lost the secret or someone regenerated it, then generate a new one. This stops the old secret from working, so update every system that uses it. For the steps, see Manage API clients.
  3. Check that the grant type matches your API client:
    • API clients you created in the Account management portal: Send grant_type=client_credentials and scope=gbg.token.
    • API clients that GBG issued with a username and password: Send grant_type=password with your client ID, client secret, username and password.
  4. Check that your API client has the Go API Access role. A customer administrator assigns roles in the Roles tab of the API client in the Account management portal.
  5. Request a new token.
A valid request for an API client that you created in the Account management portal looks like this:
cURL
If the error continues, then contact GBG support. Include the time of the request, your client ID and the full error response. Don’t include your client secret or password.
The Webhook module is a variant, so when the webhook fires, the journey technically hasn’t completed yet. Calling /journey/state/fetch immediately after receiving the webhook can return a state that doesn’t yet reflect journey completion.To handle this:
  • Implement a short delay before calling /journey/state/fetch after receiving the webhook.
  • Implement a retry mechanism on your /journey/state/fetch call to handle cases where the state isn’t yet finalised.

​
Symptom

You submit a full street address in the PEPs and Sanctions request, but the screening results only appear to consider the subject’s name, date of birth, and country. This leads to more false positive matches than expected, particularly in ongoing monitoring (OGM).

​
Cause

The PEPs and Sanctions screening service only uses country and city (locality) when matching an address.It does not use street-level detail. This is by design, the service compares submitted details against watchlist records, which themselves typically only hold country and city-level address data.You can see this in the available hit types. The most granular address-based match codes are Full name, DOB, city and country matched and Full name, city and country matched.There is no match type that includes street name or building number.For details, see the PEPs and Sanctions module reference.The input payload reflects this, the currentAddress object only accepts locality and country:
JSON

​
Resolution

To improve match accuracy and reduce false positives, always populate both currentAddress.locality (city or town) and currentAddress.country when they are available.Providing the city in addition to the country gives the screening service more identity elements to match against, which narrows results and lowers the false positive rate. Street-level fields are not used and do not need to be sent.