{"record":{"id":"ef2147cee829c737","repo":"git-ecosystem/git-credential-manager","slug":"failed-to-create-pat-errormessage","errorCode":null,"errorMessage":"Failed to create PAT: {errorMessage}","messagePattern":"Failed to create PAT: (.+?)","errorType":"exception","errorClass":"Trace2Exception","httpStatus":null,"severity":"error","filePath":"src/Microsoft.AzureRepos/AzureDevOpsRestApi.cs","lineNumber":145,"sourceCode":"            {\n                _context.Trace.WriteLine($\"HTTP: Response {(int)response.StatusCode} [{response.StatusCode}]\");\n\n                string responseText = await response.Content.ReadAsStringAsync();\n\n                if (!string.IsNullOrWhiteSpace(responseText))\n                {\n                    if (response.IsSuccessStatusCode)\n                    {\n                        if (TryGetFirstJsonStringField(responseText, \"token\", out string token))\n                        {\n                            return token;\n                        }\n                    }\n                    else\n                    {\n                        if (TryGetFirstJsonStringField(responseText, \"message\", out string errorMessage))\n                        {\n                            throw new Trace2Exception(_context.Trace2, $\"Failed to create PAT: {errorMessage}\");\n                        }\n                    }\n                }\n            }\n\n            throw new Trace2Exception(_context.Trace2, \"Failed to create PAT\");\n        }\n\n        #region Private Methods\n\n        private async Task<Uri> GetIdentityServiceUriAsync(Uri organizationUri, string accessToken)\n        {\n            const string locationServicePath = \"_apis/ServiceDefinitions/LocationService2/951917AC-A960-4999-8464-E3F0AA25B381\";\n            const string locationServiceQuery = \"api-version=1.0\";\n\n            Uri requestUri = new UriBuilder(organizationUri)\n            {\n                Path = UriHelpers.CombinePath(organizationUri.AbsolutePath, locationServicePath),","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Microsoft.AzureRepos/AzureDevOpsRestApi.cs#L127-L163","documentation":"After the Azure DevOps PAT creation HTTP call, if the response is unsuccessful and the JSON body contains a 'message' field, CreatePersonalAccessTokenAsync surfaces that server message wrapped in a Trace2Exception ('Failed to create PAT: <server message>'). If no message field is parseable, a generic 'Failed to create PAT' is thrown instead.","triggerScenarios":"The identity/location service returned a non-success HTTP status whose body parses as JSON with a 'message' string - e.g. expired/insufficient access token, HTTP 500 from the location service, or authorization failures.","commonSituations":"Access token lacking required scopes to mint a PAT; Azure DevOps service outage (500s); organization URL pointing to a deleted/renamed organization; expired OAuth token.","solutions":["Read the server message after the colon and fix the underlying issue it describes (usually authentication or permissions).","Refresh/renew the access token used for the PAT request and ensure it has the required scopes (e.g. token minting scope).","Verify the organization URI is correct and the Azure DevOps service status is healthy, then retry."],"exampleFix":"// before (insufficient scope)\nvar scopes = new[] { \"openid\" };\n// after\nvar scopes = new[] { \"499b84ac-1321-427f-aa17-267ca6975798/.default\" }; // Azure DevOps resource + required scopes","handlingStrategy":"try-catch","validationCode":"// Ensure the access token has ADO scope before minting a PAT\nif (!accessTokenScopes.Any(s => s.Contains(\"499b84ac-1321-427f-aa17-267ca6975798\")))\n  throw new InvalidOperationException(\"Access token lacks Azure DevOps resource scope; PAT creation will fail\");","typeGuard":null,"tryCatchPattern":"try {\n  var pat = await restApi.CreatePersonalAccessTokenAsync(orgUri, accessToken);\n} catch (Trace2Exception ex) when (ex.Message.StartsWith(\"Failed to create PAT:\")) {\n  logger.Error(\"Azure DevOps rejected PAT creation: {0}\", ex.Message);\n  // refresh token / check org exists, then retry once\n}","preventionTips":["Acquire access tokens with the Azure DevOps resource scope before calling the API","Check Azure DevOps service health before bulk PAT operations","Log the full server message (text after the colon) - it usually names the exact permission or org problem"],"tags":["azure-devops","pat","api-error"],"backgroundTag":"api-error-response","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}