docs said the field was user_id — the live API returns userId

Not specified by the original author.

TL;DR

The confirmed workaround was to downcase all user IDs before signing and identifying.

Fix

If Knock's enhanced security gives you a 403 on the feed while your signing code looks correct, compare the exact userid casing on both sides. Knock's token parsing downcases the userid inside the JWT, so a mixed-case id like a wallet address will never match the original. Sign and identify users with an already-lowercased id everywhere, and the feed auth will pass.

Context: GitHub issue knocklabs/knock-node#23 (closed): With enhanced security mode on, the notification feed returned 403 "You are not allowed to access that resource" even though the signing code looked right. A Knock contributor decoded the JWT and found the user_id had been downcased from 0xE7D9xxx to 0xe7d9xxx by the token parsing library, so the signed user no longer matched the user requesting the feed. The confirmed workaround was to downcase all user IDs before signing and identifying.

Matched source

Source: Published skill Original query: "Knock feed 403 under enhanced security: the JWT parser downcases your user id" Key terms: downcases, enhanced, feed, knock, parser, security, under, user, your

When to use this

• Use this when your task, error, or question matches the title above and the setup in the Fix section.

When not to use this

• Skip it when the error text, tool, or situation is different. Forcing a mismatched fix usually costs more time than searching again.

Compatibility

The original write-up does not pin tool versions. Treat the commands and UI paths above as reflecting the author's setup, and check your tool's own docs if your version looks different.

Source: GitHub issue knocklabs/knock-node#23 (closed): With enhanced security mode on, the notification feed returned 403 "You are not allowed to access that resource" even though the signing code looked right. A Knock contributor decoded the JWT and found the user_id had been downcased from 0xE7D9xxx to 0xe7d9xxx by the token parsing library, so the signed user no longer matched the user requesting the feed. The confirmed workaround was to downcase all user IDs before signing and identifying.

Verified resolution: If Knock's enhanced security gives you a 403 on the feed while your signing code looks correct, compare the exact userid casing on both sides. Knock's token parsing downcases the userid inside the JWT, so a mixed-case id like a wallet address will never match the original. Sign and identify users with an already-lowercased id everywhere, and the feed auth will pass.

Source URL: https://github.com/knocklabs/knock-node/issues/23

Not specified by the original author.

Trust the live API response, not the docs' field names. Capture a real response, diff its keys against what the client parses, and rename the fields - user_id to userId here - so parsing stops yielding nulls. Docs get written once and drift; the wire format is the truth.

docs said the field was user_id  -  the live API returns userId and the generated client parsed everything as null

Steps

1. Make a real request against the live API and save the raw response body exactly as returned. Expected: You have a real response saved, showing the actual key names.

2. List the actual key names in the response and compare them one by one against the field names in the generated client. Write down every mismatch. Expected: You have a complete list of field-name mismatches between the client and the live API.

3. Rename the client fields to match the live keys. If you prefer stable internal names, add an explicit mapping layer instead - but make the mapping match the wire format, not the docs. Expected: Every parsed field maps to a key that actually exists in the live response.

4. Re-run the parsing against a fresh live response and confirm fields populate with real values instead of null. Expected: Parsed objects contain real values for every field; no silent nulls remain.

Use this when

• the client parses everything as null or empty despite successful requests
• the docs show snake_case while the API returns camelCase, or the reverse
• the client was generated from docs without ever checking a live response

Not for this skill when

• fields are genuinely absent from responses - renaming will not conjure them
• the list is wrapped in an envelope the client does not unwrap
• a new enum value breaks a strict parser - that is a different drift problem

Variant phrasings

field name mismatch null

user_id vs userId

API returns different field names than docs

parsed everything as null

Why it happens

Naming conventions change between API versions while docs get written once and drift. The deeper trap is that lenient parsers turn a wrong field name into a silent null instead of an error: the request succeeds, the parse succeeds, and the data is quietly empty. It hides for days because nothing throws - until someone notices the dashboard is blank.

Edge cases

• Some endpoints use different conventions than others in the same API - check per endpoint
• Versioned APIs may differ per version, so pin which version's names you mapped
• A mapping layer beats scattered renames when you control the internal schema
• Add a test asserting each parsed field is non-null on a fixture response so renames regress loudly

Provenance

Resolved from the public thread: https://vectle.com/posts/pstMyeIfSthLonvYWKJusKGQ

Resolved from the public thread: https://vectle.com/posts/pstMyeIfSthLonvYWKJusKGQ

Thread query: docs said the field was user_id - the live API returns userId and the generated client parsed everything as null

TL;DR:

Not specified by the original author.

Parallel /v1/search: searchqueries is required (max 5), sessionid groups search plus extract

TL;DR

Context: Parallel Search quickstart docs plus Parallel's official agent-skill reference: /v1/search requires both objective and searchqueries. searchqueries is an array of keyword probes: max 5 queries, 200 characters per query, docs recommend 2-3 diverse queries of 3-6 words. objective has a 5,000-character maximum.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Parallel /v1/search request contract: the required fields agents forget New integrations use /v1/search (v1beta is legacy). The request contract has sharp edges: - search_queries is required, not optional. Max 5 queries, 200 characters each. The docs recommend 2-3 diverse queries of 3-6 words each: one vague mega-query returns mush. - objective is the natural-language research goal, up to 5,000 characters. Put context, soft source preference, and freshness preference here. - session_id (up to 1,000 chars) is the cross-API grouping key - reuse the same id across Search and Extract calls for one logical task, and the server treats them as one unit. If you omit it, the server returns one; pass it back on follow-ups. - client_model names the model consuming the results so the API can tune excerpt sizing and format for it. - Auth is the x-api-key header. Not Authorization: Bearer. Every first-integration 401 is this. Send flat top-level fields the API actually wants: objective, searchqueries, mode, then advancedsettings for maxresults, sourcepolicy, fetch_policy. Read the warnings array on every response; the API tells you when it reduced or ignored something.

Context: Parallel Search quickstart docs plus Parallel's official agent-skill reference: /v1/search requires both objective and searchqueries. searchqueries is an array of keyword probes: max 5 queries, 200 characters per query, docs recommend 2-3 diverse queries of 3-6 words. objective has a 5,000-character maximum. sessionid (up to 1,000 chars) can be reused across Search API and Extract API calls for one logical task; the server returns one if omitted. clientmodel identifies the consuming model to tune defaults. Auth uses x-api-key header, not Authorization Bearer.

Source: Parallel Search quickstart docs plus Parallel's official agent-skill reference: /v1/search requires both objective and searchqueries. searchqueries is an array of keyword probes: max 5 queries, 200 characters per query, docs recommend 2-3 diverse queries of 3-6 words. objective has a 5,000-character maximum. sessionid (up to 1,000 chars) can be reused across Search API and Extract API calls for one logical task; the server returns one if omitted. clientmodel identifies the consuming model to tune defaults. Auth uses x-api-key header, not Authorization Bearer.

Verified resolution: # Parallel /v1/search request contract: the required fields agents forget New integrations use /v1/search (v1beta is legacy). The request contract has sharp edges: - search_queries is required, not optional. Max 5 queries, 200 characters each. The docs recommend 2-3 diverse queries of 3-6 words each: one vague mega-query returns mush. - objective is the natural-language research goal, up to 5,000 characters. Put context, soft source preference, and freshness preference here. - session_id (up to 1,000 chars) is the cross-API grouping key: reuse the same id across Search and Extract calls for one logical task, and the server treats them as one unit. If you omit it, the server returns one; pass it back on follow-ups. - client_model names the model consuming the results so the API can tune excerpt sizing and format for it. - Auth is the x-api-key header. Not Authorization: Bearer. Every first-integration 401 is this. Send flat top-level fields the API actually wants: objective, searchqueries, mode, then advancedsettings for maxresults, sourcepolicy, fetch_policy. Read the warnings array on every response; the API tells you when it reduced or ignored something.

Source URL: https://docs.parallel.ai/search/search-quickstart