Workload Distributor App

Q&A
, , , ,
1

I have built an app that distributes SIM-T tickets to admins automatically, by assessing their individual workload as well. I am encountering an issue though when the app tries to assign tickets to admins. The app sees the tickets to assign in the queue but fails to assign. The app is connected to SIM-T New Connector. This is what it returns

Access denied on EVERY ticket — even ticket 89aacec0 which is already assigned to machajsd and your team has full access to.

This confirms the problem is not per-ticket — it’s a blanket access issue with the connector’s OAuth session. The listTickets action works (probably uses a different API endpoint or permission scope), but getTicket and updateTicket are both denied across the board.

Root Cause

The connector’s OAuth client (max_core_agents_service_prod) authenticating through idp.federate.amazon.com likely has limited scopes — it can list/search tickets but cannot read individual tickets or write to them. This is a connector-level configuration issue, not an app issue.

What Needs to Happen

This needs to be fixed by whoever manages the SIM-T_New connector (the connector owner):

  1. Check the OAuth scopes — the max_core_agents_service_prod client at idp.federate.amazon.com needs scopes that allow individual ticket read AND write (not just list)
  2. Check the API Gateway config — the base URL https://79ii7gze68.execute-api.us-east-1.amazonaws.com/prod/oauth/ticket/ might have different IAM policies for list vs get/update endpoints
  3. All tickets are marked isPrivate: true — there may be a separate permission needed to access private tickets individually vs listing them

Can you reach out to the connector owner and share this finding? The key evidence:

  • :white_check_mark: listTickets → works
  • :cross_mark: getTicket → “Access denied” on every ticket
  • :cross_mark: updateTicket → “Access denied” on every ticket

14:05:57 Cycle complete: 0 assigned, 1 failed

14:05:57 :cross_mark: Failed 435a57a9… → klkortus: Both primary and fallback CALL_TOOL operations failed for endpoint: https://79ii7gze68.execute-api.us-east-1.amazonaws.com/prod/oauth/ticket/. Primary error: Error executing tool: Failed to update ticket: Unknown error. Response: {“error”: {“code”: “200”, “message”: “Error updating ticket: Access denied for ticket update”, “requestId”: null, “timestamp”: null}, “ok”: false, “ticketId”: null}. Fallback error: Client failed to initialize by explicit API call

Is anyone able to help?

2

Hi @Eros.Santoni,

Thank you providing all the details you;ve found. That diagnosis sounds right to me. Since this is a connector-level permissions issue with the SIM-T New Connector’s OAuth client, this needs to be resolved by whoever owns/manages that connector internally.

I’d recommend reaching out to the SIM-T connector owner within your organization and sharing the evidence you’ve laid out here (list works, get/update denied on all tickets). Since this is a public-facing community, we unfortunately don’t have access to internal connector configurations or the ability to route this to specific internal teams.

Hope you get it resolved quickly and feel free to update the community with new developments.

3

Hi Cesar, Others is specified under Ownership. Do you know how I can find the POC for this Connector?