VCSA 9.1.0 com.vmware.vapi.std.errors.Unauthorized: Unauthorized (com.vmware.vapi.std.errors.unauthorized)

Products

• VMware vCenter Server

Issue/Introduction

When running operation such as running vCenter VAMI backup or placing host in maintenance mode VAPI error is present in the vCenter logs.


/var/log/vmware/applemgmt/backup.log

2026-07-19T11:11:11.00Z INFO __main__ 744760 [vc@## requestId="#####" processName="ComponentScriptsBackup" module="ComponentScripts" funcName="ComponentScriptsBackup" fileName="ComponentScripts.py" lineNum="108"] Dispatching stream.
2026-07-19T11:11:11.00Z ERROR __main__ 744760 [vc@## requestId="########" processName="ComponentScriptsBackup" module="Log" funcName="run" fileName="Log.py" lineNum="66"] {challenge : None, messages : [LocalizableMessage(id='vapi.security.authentication.invalid', default_message='Unable to authenticate user', args=[], params=None, localized=None)], data : None, error_type : UNAUTHENTICATED}

 

Visible in vSphere Interface:

Failed to enter namespaces maintenance mode due to Error: com.vmware.vapi.std.errors.unauthenticated Messages: vapi.security.authentication.invalid<Unable to authenticate user>

 

/var/log/vmware/wcp/wcpsvc.log

2026-07-19T11:11:11.000Z WARNING wcp #### [vc@##] [vcrestlib/helper.go:176] [opID=hok-auth-handler] Request to service failed; POST, url: http://localhost:1080/rest/vcenter/tokenservice/token-exchange, Code: 500, Body: '{"type":"com.vmware.vapi.std.errors.internal_server_error","value":{"error_type":"INTERNAL_SERVER_ERROR","messages":[{"args":["com.vmware.vcenter.tokenservice.token_exchange.exchange"],"default_message":"Error in aggregator invocation of provider method: com.vmware.vcenter.tokenservice.token_exchange.exchange","id":"vapi.provider.aggregator.invokemethod.exception"}]}}'    

 

/var/log/vmware/vapi/endpoint/endpoint.log

2026-07-19T11:11:11.00Z ERROR VapiEndpoint ## [vc@## logger="ProviderAggregation" opId="<##opID-uuid##>"] Error while invoking operation 'com.vmware.vcenter.tokenservice.token_exchange.exchange'
java.lang.RuntimeException: Cannot load session
 at ...
...
Caused by: com.vmware.vapi.std.errors.Unauthorized: Unauthorized (com.vmware.vapi.std.errors.unauthorized) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = vapi.authz.error.no.privs,
    defaultMessage = The following (object: com.vmware.cis.local.sessions.resolve privileges: System.Read) privileges are insufficient to user,
    args = [object: com.vmware.cis.local.sessions.resolve privileges: System.Read],
    params = <null>,
    localized = <null>
}],
    data = <null>,
    errorType = UNAUTHORIZED,
    challenge = <null>
}
 at com.vmware.vapi.std.errors.Unauthorized._newInstance2(Unauthorized.java:253)

Environment

vCenter Server 9.1.0.0100, build 25417926

Cause

VapiEndpointUser, was removed from the appliance's authorization database. A known issue in vCenter 9.1.0. build 25417926.

Resolution

1. In the vSphere Client, go to Administration → Access Control → Global Permissions → Add.
2. Search for the principal vapi-endpoint-<Machine-ID> (The last part is the machine ID.)
   
   • Retrieve the machine ID by running /usr/lib/vmware-vmafd/bin/vmafd-cli get-machine-id --server-name localhost as root on the appliance).
     
     
3. assign role VapiEndpointUser, check "Propagate to children," and save.
   
   
4. No service restart or reboot is required — the next token-exchange call succeeds immediately.