A2A troubleshooting
Every message you might see when connecting to or calling a partner agent through Veefore, what it means, and how to fix it.
Find the message, then follow the fix. Messages appear in the console (as a notice, or under Send a test call) or in the error your agent's code receives. Every call that reached Veefore is listed under Actions with the check that decided it.
#Connecting
| Message | What it means | Fix |
|---|---|---|
| The sample partner is not available here | This Veefore has no public HTTPS address (for example, it runs on your laptop). | Use the hosted Veefore at console.veefore.com, or connect a partner of your own. |
| The address must be a public HTTPS URL | The partner's address is http://, localhost or a private network address. |
Ask the partner for their public https:// address. Veefore never calls private addresses. |
| The local agent is not registered for the A2A protocol. | The agent you chose cannot use A2A. | Use Connect a partner, which switches it on for you, or create a new agent with A2A ticked. |
| That A2A connection already exists. | This agent already has a connection to this partner. | Open it from the A2A list. |
| That is not a passport export | The pasted text is not what Copy for a partner produces. | Ask the partner to copy it again from Agents → their agent → Passport → Copy for a partner, and paste all of it. |
| Passport invalid — Signature verification failed | The passport was not signed by the key you entered. | Check you have the right public key from the partner, update it under Connection settings, then verify again. |
| Passport invalid — Passport subject mismatch | The passport is for a different agent id than the one on the connection. | Check the partner's agent id. |
| Passport expired | The partner's passport is out of date. | Ask the partner for a new one and verify it under Verify the remote passport. |
| The connection stays Pending | The passport has not been verified yet. | Paste it under Verify the remote passport on the connection. |
| The peer identifies as "…" but this connection is registered to "…" | The partner's Agent Card names a different agent. | Make sure you are connecting to the right address; the passport check decides. |
| Capabilities list is empty | The Agent Card could not be read, or lists nothing. | Click Fetch the partner's Agent Card, or add a capability by name under Capabilities. |
| Skipped …: Veefore capability names look like resource.action | The partner names a capability in a way Veefore cannot use. | Ask the partner, or use a capability with a name like shipment.query. |
#Calling
When Veefore refuses a call, the partner is never contacted.
| Message | What it means | Fix |
|---|---|---|
| No capability is enabled on this A2A connection yet. | Nothing is switched on. | Under Capabilities, click Enable on what you need. |
| Capability "…" is not permitted on this A2A connection. | That capability is off. | Enable it under Capabilities, if you want it used. |
| The connection is blocked. | Someone blocked this partner. The reason is shown on the connection. | If it is safe, click Allow again. |
| The remote passport has not been verified for this connection yet. | The connection is Pending. | Verify the partner's passport on the connection. |
| The presented passport is … | The partner's passport no longer checks out (revoked, expired, or a different key). | Ask the partner what changed, then verify a new passport. |
| No A2A tool is registered for capability "…" | The capability was allowed by hand, without its tool. | Click Disable then Enable on it under Capabilities; enabling sets the tool up. |
| The agent does not hold the capability "…" | Your agent was not given the capability. | Disable and enable it under Capabilities, which grants it again. |
| Blocked by your rules — your rule's reason | A rule in your policy refused it. | Open the call in Actions to see which rule, then change the rule or the request. |
| Waiting for a person to approve it | A rule needs a person. | Approve it under Approvals. From code, see Handle approvals. |
| The partner refused or failed — the partner's reason | Veefore allowed it, and the partner said no (for example "Cancellations go through support.") or did not answer. | Take it up with the partner; the reason is theirs. |
#It ran when it should have been stopped
The environment is in Observe mode, which every new account starts in. Your rules are recorded, not applied. Switch to Enforce under Admin → Settings → Gateway enforcement. The connection's own checks — passport, enabled capabilities, block — apply in every mode.
#Still stuck
Open the call in Actions: its stages show which check stopped it. If it is not there, the request never reached Veefore — check the connection id and the agent's keys. Then see Support.