Troubleshooting

Common issues and how to resolve them. If none of these fit, contact support or email support+cp-word-list@support.neuralconfig.com with your Cloudpath FQDN and roughly when the problem happened. For a feature request or a general comment, the service also has a feedback form at https://wordlist.lanpulse.com/feedback.

My account is stuck “pending review”

Only hosted Cloudpath servers (*.cloudpath.net) are approved automatically. If you entered a self-hosted FQDN, your account waits for an admin to approve it, and outbound calls stay disabled until then. Email support+cp-word-list@support.neuralconfig.com to request review. See Activate your account.

If you entered a hosted *.cloudpath.net FQDN and it’s still pending, double-check the FQDN for typos, re-save it, and confirm it ends in .cloudpath.net.

Test Connection fails

The dashboard’s Test Connection returns the specific reason:

Message	Cause and fix
”Your account is pending admin review.”	The account isn’t active yet — see above.
”No Cloudpath FQDN configured.”	Enter your Cloudpath FQDN and save.
”No Cloudpath credentials configured.”	Enter the Cloudpath API username and password and save.
”Authentication failed: …”	The credentials were rejected by Cloudpath. Re-enter them and confirm the API account is valid and enabled.
”Connection failed: …”	The Cloudpath server couldn’t be reached at that FQDN. Verify the hostname.

The enrollment webhook is failing

If passphrases aren’t changing, the notification step’s call to /api/change-dpsk is likely returning an error. The codes mean:

Code	Meaning and fix
401	The Shared Secret is missing or wrong, or the account isn’t active. Re-copy the request body (or API Call URL) from the dashboard. If you regenerated the secret, the old value stops working — paste the new one.
400	Missing or malformed enrollmentId, or the tenant isn’t fully configured. Confirm the call sends enrollmentId=${GUID} and that your FQDN and credentials are saved.
404	No DPSK was found for the enrollment. Make sure the notification step runs after “Generate a DPSK”.
409	A device is already connected on the DPSK, so the passphrase wasn’t changed. This is expected on re-enrollment and is safe to ignore. Much more rarely, it means three generated phrases in a row collided with existing DPSKs.
502	Cloudpath authentication failed or the server was unreachable. Run Test Connection to confirm your credentials and FQDN.

Reading the activity log

The dashboard’s Activity Logs page is the fastest way to see what the enrollment webhook actually did, 20 entries at a time. Each row carries an event type, the enrollment ID, and — for failures — a machine-readable reason:

Event	Reason in details	What it means
dpsk_changed	—	Success. The DPSK GUID and name of the changed DPSK are recorded.
error	auth_failed	The service could not authenticate to your Cloudpath server. Check the API credentials with Test Connection.
error	enrollment_not_found	Cloudpath had no such enrollment. Usually the notification step ran outside a live enrollment.
error	dpsk_lookup_failed	The DPSK lookup call to Cloudpath failed for some other reason.
error	no_dpsks	The enrollment exists but has no DPSK. The notification step is running before “Generate a DPSK”.
error	device_count_nonzero	A device is already connected on the DPSK, so it was left alone. Expected on re-enrollment.
error	update_failed	Cloudpath rejected the passphrase update. The Cloudpath error message is included.

Note

An empty log means the webhook never got far enough to identify your tenant. Rejections for a missing or wrong Shared Secret (401) and for a malformed enrollmentId (400) are not logged — so if nothing appears at all, suspect the API Call URL or a notification step that isn’t firing.

The passphrase still shows as a random string

• Confirm both workflow steps are present, in order, after “Generate a DPSK”, and that you published the workflow. See Add the enrollment workflow steps.
• Confirm the notification step sends your correct Shared Secret.
• If the service was briefly unreachable, the display page falls back to the original Cloudpath passphrase after 15 seconds — that’s by design, and the passphrase still works because it was never changed.
• If the Activity Logs page shows dpsk_changed for that enrollment, the change succeeded but the display page didn’t get the new phrase in time, so the random string it shows has already been replaced and does not work. Look up the DPSK in Cloudpath for the new word-based passphrase. See How enrollment and fallback work.

The passphrase lookup returns “not found” / expired

/api/get-dpsk mappings are cached for 5 minutes after a change. If a user leaves the display page open longer than that and it retries, the lookup returns 404 — but the new passphrase is already set on the controller and still works. Re-running the enrollment refreshes the mapping.

Passphrase conflicts

If a generated phrase happens to match an existing DPSK in the pool, the service retries with a new phrase up to 3 times. With the full word list this is rare and usually resolves on its own.