{"record":{"id":"f933c1b388fe37f7","repo":"git-ecosystem/git-credential-manager","slug":"failed-to-create-pat","errorCode":null,"errorMessage":"Failed to create PAT","messagePattern":"Failed to create PAT","errorType":"exception","errorClass":"Trace2Exception","httpStatus":null,"severity":"error","filePath":"src/Microsoft.AzureRepos/AzureDevOpsRestApi.cs","lineNumber":151,"sourceCode":"                {\n                    if (response.IsSuccessStatusCode)\n                    {\n                        if (TryGetFirstJsonStringField(responseText, \"token\", out string token))\n                        {\n                            return token;\n                        }\n                    }\n                    else\n                    {\n                        if (TryGetFirstJsonStringField(responseText, \"message\", out string errorMessage))\n                        {\n                            throw new Trace2Exception(_context.Trace2, $\"Failed to create PAT: {errorMessage}\");\n                        }\n                    }\n                }\n            }\n\n            throw new Trace2Exception(_context.Trace2, \"Failed to create PAT\");\n        }\n\n        #region Private Methods\n\n        private async Task<Uri> GetIdentityServiceUriAsync(Uri organizationUri, string accessToken)\n        {\n            const string locationServicePath = \"_apis/ServiceDefinitions/LocationService2/951917AC-A960-4999-8464-E3F0AA25B381\";\n            const string locationServiceQuery = \"api-version=1.0\";\n\n            Uri requestUri = new UriBuilder(organizationUri)\n            {\n                Path = UriHelpers.CombinePath(organizationUri.AbsolutePath, locationServicePath),\n                Query = locationServiceQuery,\n            }.Uri;\n\n            _context.Trace.WriteLine($\"HTTP: GET {requestUri}\");\n            using (HttpRequestMessage request = CreateRequestMessage(HttpMethod.Get, requestUri, bearerToken: accessToken))\n            using (HttpResponseMessage response = await HttpClient.SendAsync(request))","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Microsoft.AzureRepos/AzureDevOpsRestApi.cs#L133-L169","documentation":"This Trace2Exception is thrown by CreatePersonalAccessTokenAsync when the Azure DevOps REST API call fails to produce a Personal Access Token. It is the final fallback after all failure paths have already attempted to surface a specific error message; reaching it means no PAT was generated and no more specific error was extracted from the HTTP responses. The caller cannot proceed with Azure Repos authentication without a PAT.","triggerScenarios":"Calling CreatePersonalAccessTokenAsync when the location service and/or identity service respond in a way that does not yield a PAT (e.g. HTTP 500 responses from either service where no errorMessage could be extracted, or an unexpected response shape).","commonSituations":"Azure DevOps service outages or degraded instances returning 5xx; organizational issues where the identity service rejects token creation; transient network errors producing non-success responses without a parseable error body.","solutions":["Retry the operation; HTTP 500s from the location/identity services are often transient Azure DevOps issues","Check Azure DevOps service health/status for your region","Verify the organization URL and access token passed in are valid and not expired","Inspect Trace2 logs for the more specific 'Failed to create PAT: {errorMessage}' variant emitted earlier for the actual API error","Update Git Credential Manager to the latest version in case of API contract changes"],"exampleFix":"// before\nvar pat = await AzureDevOpsRestApi.CreatePersonalAccessTokenAsync(...);\n// after\ntry {\n    var pat = await AzureDevOpsRestApi.CreatePersonalAccessTokenAsync(...);\n} catch (Trace2Exception ex) when (IsTransient(ex)) {\n    // retry with backoff or surface actionable guidance\n}","handlingStrategy":"retry","validationCode":"// C#\nif (!uri.Host.Equals(\"dev.azure.com\", StringComparison.OrdinalIgnoreCase) && !uri.Host.EndsWith(\".visualstudio.com\", StringComparison.OrdinalIgnoreCase))\n    throw new ArgumentException(\"Not a valid Azure DevOps organization URL\");","typeGuard":null,"tryCatchPattern":"try {\n    pat = await AzureDevOpsRestApi.CreatePersonalAccessTokenAsync(orgUri, accessToken, ...);\n} catch (Trace2Exception ex) {\n    _log.Error(ex, \"PAT creation failed\");\n    throw new InvalidOperationException(\"Could not create PAT; check Azure DevOps service health and credentials\", ex);\n}","preventionTips":["Retry transient failures with exponential backoff","Monitor Azure DevOps status page for outages","Keep access tokens fresh and scopes correct","Capture Trace2 output to see the more specific underlying error message"],"tags":["azure-devops","http","pat","authentication"],"backgroundTag":"api-error-response","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}