AFW-511 — Collector token rejected

Area: Cloud sync · All support codes · Reference table

Why this happened

The cloud refused the collector's enroll token (missing, rotated, or revoked). The collector keeps enforcing its last-synced policy but receives no updates.

Fix

Re-enroll the collector: generate a fresh enroll token on the Collectors page and update AGENTFW_CLOUD_TOKEN in the collector's .env, then restart it.

---

If the fix doesn't resolve it, file a support ticket from the console — your workspace's diagnostics snapshot is attached automatically, so this code reaches support with its context.