Hi Team, we are having a major outage affecting all our workspaces, with this message, could we have some assistance

The browser console in your screenshot shows CORS errors: requests from

https://learnamptesting.learnamp.com

to

https://learnamp.cloud.gooddata.com

are being blocked because no

Access-Control-Allow-Origin

header is present. This is a CORS configuration issue, not a platform-wide outage. What to do right now 1. Add your domain to the allowed origins list Go to your GoodData homepage → Developer settings → Cross-origin resource sharing (CORS) → Manage, then add

https://learnamptesting.learnamp.com

exactly as it appears. [CORS setup docs] Alternatively, you can do this via the API:

curl -v -X PATCH -H 'Content-type: application/vnd.gooddata.api+json' \
    -H "Authorization: Bearer <token>" \
    -d @organization.json $HOST_URL/api/v1/entities/admin/organizations/<organization_id>

where

organization.json

contains:

{
  "data": {
    "attributes": {
      "allowedOrigins": [
        "https://learnamptesting.learnamp.com"
      ]
    },
    "id": "<organization_id>",
    "type": "organization"
  }
}

[CORS setup docs] 2. Things to double-check • The origin URL must be exact — no trailing slash, correct subdomain. • Use PATCH, not PUT, when updating via the API. • If you want to cover multiple subdomains (e.g.,

*.learnamp.com

), wildcards are supported but only match third-level and consecutive subdomains. [CORS troubleshooting] • Verify your organization ID is correct — using an incorrect ID will return a 404. A similar case was resolved quickly by updating CORS settings. [past CORS incident] If the issue persists after updating the CORS settings, please open a support ticket at https://support.gooddata.com with your organization ID, the failing URLs, and any Trace IDs from the Network tab in your browser dev tools. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups. 👀 Our Support team monitors all messages and will jump in if needed.

we already have CORS set up, and this was running for a long time, and literally started breaking yesterday without any changes

Hi Jhonatan, I'm really sorry to hear about this issue. Would you be able to record a HAR file for me please?

yep, here it is

are you using jwt?

yes, and I have just confirmed that the token is still valid

we are on it, I'll update you asap

an AI analysis of the HAR and our codebase This is NOT a CORS issue. It's a 401 authentication failure. The timeline: 1. 104554.439Z — JWT successfully obtained from /good_data/jwts 2. 104554.770Z — tigerBackend.js loaded (304 cached) 3. 104555.170Z — Workspace JS loaded (304 cached) 4. 104555.678Z — All API calls fire with NO auth headers → 401 The CORS preflight (OPTIONS) requests all succeed with 200, proving the origin https://riseto.staging-learnamp.com IS in GoodData's allowed origins. The problem is: Every single API request is sent without cookies AND without an Authorization header. The TigerJwtAuthProvider is either: 1. Not being initialized before the gd-insight web components fire their API requests (race condition) 2. Broken in the current version of the GoodData SDK — it's not injecting the Authorization: Bearer <jwt> header This is likely a GoodData SDK issue, not a codebase change. The SDK's tigerBackend.js is served from GoodData's CDN and may have been updated on their end. The TigerJwtAuthProvider that used to work may no longer be injecting auth headers properly, or the web components are initializing and making requests before setContext() completes.

can you please re-try now?

nice, it's working now

definitely, I'll update the ticket once we gather all the information