Endevor zowe cli list command failed wtih RRC=20, RSN=17

Products

• Endevor

Issue/Introduction

Endevor web services up and running, unable to use zowe cli to list ENV, stage or elements. Got return code 20 reason code 17. 

Run the curl rest API call to list ENV, also got the same error:

{"returnCode":"0020","reasonCode":"0017","reports":{"APIMSGS":"/reports/1665172804-3031717392460895-APIMSGS","C1MSGS1":"/reports/1665172804-3031717392460895-C1MSGS1","C1MSGSA":"/reports/1665172804-3031717392460895-C1MSGSA"},"data":[],"messages":["EWS1117I Request processed by SysID CL1QTEL2, STC CAIWSSTC - STC17270"]}

Spawn task log shows: 

ACCESS DENIED FOR MAP ROUTE FROM ENVIRONMENT DEV7     TO ENVIRONMENT MODEL                                                          
0BC1PINIT FAILURE, RC=0000.                                                                                                          
0ENAPI000: F000 ABEND CODE=INIT NUMBER=0001                                

Environment

Release : 18.1

Cause

RRC=20, RSN=17 is probably the outcome of internal Endevor logic flow after the bad RACROUTE RC.

Adding Option and ESI trace to spawn task JCL, reproduce the error.

//EN$TROPT DD SYSOUT=* 

//EN$TRESI DD SYSOUT=*  

Option trace shows (DEV7 maps to MODEL)

       ENVIRONMENT NAME........<name>          ENVIRONMENT TITLE.......<title>                   
             Next Env Name...........MODEL         Next Stage ID...........M                                                         

ESI trace shows the user who runs zowe cli (rest API) do not have access to ENVIRONMENT MODEL :

  ENCS101I Scale=0....+....1....+....2....+....3....+....4....+....5....+....6                                                       
  ENCS101I Entity=F1.ENVIRON.MODEL                                                                                                   
  ENCS101I User <userid> access is denied   from SAF                                                                                 
  ENCS101I RACROUTE RC=0008 RACHECK RC=0008 Reason=0000       

Resolution

Show the ESI trace with the access failure to site's Mainframe security team.

Once the security access issue for is fixed, user can successfully run zowe cli list elements, list ENV command.