navan-common-errors

# Navan Common Errors ## Overview Diagnose and resolve Navan API errors using targeted fix procedures. All errors surface as raw HTTP status codes since Navan has **no public SDK** — this guide covers 401, 403, 404, 429, 500, and 503 with curl-based diagnostics. **Purpose:** Identify the root cause of a Navan API error and apply the correct fix. ## Prerequisites - Navan API credentials configured (see `navan-install-auth`) - `curl` and `jq` available in your terminal - Environment variables set: `NAVAN_CLIENT_ID`, `NAVAN_CLIENT_SECRET`, `NAVAN_BASE_URL` ## Instructions ### Error 401 — Unauthorized (Invalid or Expired OAuth Token) **Root causes:** 1. OAuth token has expired (tokens have a limited `expires_in` window) 2. `client_secret` was rotated in the Navan dashboard but not updated in `.env` 3. Malformed `Authorization` header (missing `Bearer` prefix) 4. Token from a different Navan organization **Diagnostic steps:** ```bash # 1. Verify credentials can still obtain a token curl -s -X POST https://api.navan.com/ta-auth/oauth/token \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=$NAVAN_CLIENT_ID&client_secret=$NAVAN_CLIENT_SECRET" \ | python3 -c "import sys,json; d=json.load(sys.stdin); print('TOKEN OK' if 'access_token' in d else f'FAIL: {d}')" # 2. Check if existing token is expired echo "Token var length: ${#NAVAN_TOKEN}" ``` **Fix:** Re-run the token exchange. If that also returns 401, regenerate cre...