Resource Binding Sync Failures

What It Is

Use this runbook when the API key form shows scopes but no bindable resources such as Socialize brands or Topolo Forecast workspaces.

How It Works

TopoloOne requests bindable resources from Auth. Auth determines the required resource types from service_api_key_scopes.resource_pattern, refreshes the service resource catalog, and returns active rows from service_api_key_resources.

Interfaces

• GET /api/services/:serviceId/api-key-resources
• service_api_key_scopes
• service_api_key_resources

Data Flow

1. TopoloOne requests api-key-resources for a service ID.
2. Auth derives the resource types from scope patterns.
3. Auth sync providers refresh the resource catalog for the org.
4. Auth returns active rows for rendering in the form.

Failure Modes

• no resource_pattern rows for the service
• sync provider missing or failing
• target app owns resources but Auth catalog is empty
• TopoloOne is still calling an app frontend directly instead of Auth

Debugging

• inspect the service’s resource_pattern rows in the Auth seed/catalog
• inspect the Auth repository functions that list and replace resource rows
• confirm the app-specific sync provider exists for the failing resource type
• verify TopoloOne calls Auth, not the product frontend

Change Log / Verification

• Verified against the current centralized bindable-resource model on 2026-03-29