agent failed error calling monte carlo API failed 403 forbidden on incident fetch

TL;DR

Read the 403 as a permissions finding, not a retry prompt: the Monte Carlo API refused the incident fetch, so check which account and role the agent uses for the API and whether that role can read incidents for the workspace in question. A 403 means the request was understood and refused. Retrying with the same credentials returns the same refusal, and the fix lives in the role assignment.

agent failed error calling monte carlo API failed 403 forbidden on incident fetch

Use this when

• The check or run fails with this symptom: an agent fails calling the Monte Carlo API with 403 forbidden on incident fetch.
• You are working on an agent workflow reading Monte Carlo incidents through the API and the failure repeats on the same data or configuration.
• You need the failing rows, rule, or stage isolated before changing thresholds or code.

Not for this skill when

• A 403 caused by requesting a workspace the account was never added to, which needs a workspace invite rather than a role change.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Capture the exact request and the account identity it ran under. Verify: the account and workspace are named in the failure record
2. Check the account role in the Monte Carlo workspace. Verify: the role lacks incident read access, or the account is absent from the workspace
3. Assign the least role that includes reading incidents, or switch the agent to the account provisioned for it. Verify: the role change is recorded
4. Repeat the incident fetch. Verify: incidents return for the requested window
5. Store the working account reference in the workflow configuration. Verify: the next run uses the provisioned account

Variant phrasings

agent failed monte carlo API 403 forbidden incident fetch

The shorter phrasing focused on the named failure.

monte carlo api forbidden agent error

The symptom phrasing a searcher tries next.

monte carlo 403 role incident access fix

The variant naming the failing stage or tool directly.

Compatibility: Monte Carlo API and workspace roles, agent API workflows

Why it happens

API keys and accounts in Monte Carlo are scoped by workspace and role. Agents set up against one workspace, or with a role limited to monitors, hit a hard 403 on incident reads, and because the key itself is valid, the failure masquerades as a service problem.

Edge cases / pitfalls

• A valid key with the wrong scope and an invalid key produce different responses; read the response body before changing credentials.
• Do not promote the agent account to admin to clear a 403; scope the role to the reads the workflow performs.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst5VmcayQE9jHUnw6WVmdPg