git-ecosystem/git-credential-manager · error · Trace2Exception

Failed to create PAT

Error message

Failed to create PAT: {errorMessage}

What it means

After the Azure DevOps PAT creation HTTP call, if the response is unsuccessful and the JSON body contains a 'message' field, CreatePersonalAccessTokenAsync surfaces that server message wrapped in a Trace2Exception ('Failed to create PAT: <server message>'). If no message field is parseable, a generic 'Failed to create PAT' is thrown instead.

Solutions

  1. Read the server message after the colon and fix the underlying issue it describes (usually authentication or permissions).
  2. Refresh/renew the access token used for the PAT request and ensure it has the required scopes (e.g. token minting scope).
  3. Verify the organization URI is correct and the Azure DevOps service status is healthy, then retry.

Example fix

// before (insufficient scope)
var scopes = new[] { "openid" };
// after
var scopes = new[] { "499b84ac-1321-427f-aa17-267ca6975798/.default" }; // Azure DevOps resource + required scopes
Defensive patterns

Strategy: try-catch

Validate before calling

// Ensure the access token has ADO scope before minting a PAT
if (!accessTokenScopes.Any(s => s.Contains("499b84ac-1321-427f-aa17-267ca6975798")))
  throw new InvalidOperationException("Access token lacks Azure DevOps resource scope; PAT creation will fail");

Try / catch

try {
  var pat = await restApi.CreatePersonalAccessTokenAsync(orgUri, accessToken);
} catch (Trace2Exception ex) when (ex.Message.StartsWith("Failed to create PAT:")) {
  logger.Error("Azure DevOps rejected PAT creation: {0}", ex.Message);
  // refresh token / check org exists, then retry once
}

Prevention

When it happens

Trigger: The identity/location service returned a non-success HTTP status whose body parses as JSON with a 'message' string - e.g. expired/insufficient access token, HTTP 500 from the location service, or authorization failures.

Common situations: Access token lacking required scopes to mint a PAT; Azure DevOps service outage (500s); organization URL pointing to a deleted/renamed organization; expired OAuth token.

Related errors

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/ef2147cee829c737. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.AzureRepos/AzureDevOpsRestApi.cs:145

            {
                _context.Trace.WriteLine($"HTTP: Response {(int)response.StatusCode} [{response.StatusCode}]");

                string responseText = await response.Content.ReadAsStringAsync();

                if (!string.IsNullOrWhiteSpace(responseText))
                {
                    if (response.IsSuccessStatusCode)
                    {
                        if (TryGetFirstJsonStringField(responseText, "token", out string token))
                        {
                            return token;
                        }
                    }
                    else
                    {
                        if (TryGetFirstJsonStringField(responseText, "message", out string errorMessage))
                        {
                            throw new Trace2Exception(_context.Trace2, $"Failed to create PAT: {errorMessage}");
                        }
                    }
                }
            }

            throw new Trace2Exception(_context.Trace2, "Failed to create PAT");
        }

        #region Private Methods

        private async Task<Uri> GetIdentityServiceUriAsync(Uri organizationUri, string accessToken)
        {
            const string locationServicePath = "_apis/ServiceDefinitions/LocationService2/951917AC-A960-4999-8464-E3F0AA25B381";
            const string locationServiceQuery = "api-version=1.0";

            Uri requestUri = new UriBuilder(organizationUri)
            {
                Path = UriHelpers.CombinePath(organizationUri.AbsolutePath, locationServicePath),

View on GitHub (pinned to e8ce762cd0)