---
title: A2A troubleshooting
description: Every message you might see when connecting to or calling a partner agent through Veefore, what it means, and how to fix it.
---

Find the message, then follow the fix. Messages appear in the console (as a
notice, or under **Send a test call**) or in the error your agent's code
receives. Every call that reached Veefore is listed under **Actions** with the
check that decided it.

## Connecting

| Message | What it means | Fix |
| --- | --- | --- |
| **The sample partner is not available here** | This Veefore has no public HTTPS address (for example, it runs on your laptop). | Use the hosted Veefore at console.veefore.com, or connect a partner of your own. |
| **The address must be a public HTTPS URL** | The partner's address is `http://`, `localhost` or a private network address. | Ask the partner for their public `https://` address. Veefore never calls private addresses. |
| **The local agent is not registered for the A2A protocol.** | The agent you chose cannot use A2A. | Use **Connect a partner**, which switches it on for you, or create a new agent with A2A ticked. |
| **That A2A connection already exists.** | This agent already has a connection to this partner. | Open it from the A2A list. |
| **That is not a passport export** | The pasted text is not what **Copy for a partner** produces. | Ask the partner to copy it again from **Agents → their agent → Passport → Copy for a partner**, and paste all of it. |
| **Passport invalid** — *Signature verification failed* | The passport was not signed by the key you entered. | Check you have the right public key from the partner, update it under **Connection settings**, then verify again. |
| **Passport invalid** — *Passport subject mismatch* | The passport is for a different agent id than the one on the connection. | Check the partner's agent id. |
| **Passport expired** | The partner's passport is out of date. | Ask the partner for a new one and verify it under **Verify the remote passport**. |
| The connection stays **Pending** | The passport has not been verified yet. | Paste it under **Verify the remote passport** on the connection. |
| **The peer identifies as "…" but this connection is registered to "…"** | The partner's Agent Card names a different agent. | Make sure you are connecting to the right address; the passport check decides. |
| Capabilities list is empty | The Agent Card could not be read, or lists nothing. | Click **Fetch the partner's Agent Card**, or add a capability by name under **Capabilities**. |
| **Skipped …: Veefore capability names look like resource.action** | The partner names a capability in a way Veefore cannot use. | Ask the partner, or use a capability with a name like `shipment.query`. |

## Calling

When Veefore refuses a call, **the partner is never contacted**.

| Message | What it means | Fix |
| --- | --- | --- |
| **No capability is enabled on this A2A connection yet.** | Nothing is switched on. | Under **Capabilities**, click **Enable** on what you need. |
| **Capability "…" is not permitted on this A2A connection.** | That capability is off. | Enable it under **Capabilities**, if you want it used. |
| **The connection is blocked.** | Someone blocked this partner. The reason is shown on the connection. | If it is safe, click **Allow again**. |
| **The remote passport has not been verified for this connection yet.** | The connection is Pending. | Verify the partner's passport on the connection. |
| **The presented passport is …** | The partner's passport no longer checks out (revoked, expired, or a different key). | Ask the partner what changed, then verify a new passport. |
| **No A2A tool is registered for capability "…"** | The capability was allowed by hand, without its tool. | Click **Disable** then **Enable** on it under **Capabilities**; enabling sets the tool up. |
| **The agent does not hold the capability "…"** | Your agent was not given the capability. | Disable and enable it under **Capabilities**, which grants it again. |
| **Blocked by your rules** — your rule's reason | A rule in your policy refused it. | Open the call in **Actions** to see which rule, then change the rule or the request. |
| **Waiting for a person to approve it** | A rule needs a person. | Approve it under **Approvals**. From code, see [Handle approvals](/build/handle-approvals). |
| **The partner refused or failed** — the partner's reason | Veefore allowed it, and the partner said no (for example *"Cancellations go through support."*) or did not answer. | Take it up with the partner; the reason is theirs. |

## It ran when it should have been stopped

The environment is in **Observe** mode, which every new account starts in. Your
rules are recorded, not applied. Switch to **Enforce** under **Admin → Settings
→ Gateway enforcement**. The connection's own checks — passport, enabled
capabilities, block — apply in every mode.

## Still stuck

Open the call in **Actions**: its stages show which check stopped it. If it is
not there, the request never reached Veefore — check the connection id and the
agent's keys. Then see [Support](/support).