When attempting to retrieve a credential managed by the Synchronizer, you receive this error: What is the cause of the issue?

The Conjur API returns an HTTP 404 "Not Found" error for two primary reasons: either the requested secret variable does not exist at the specified path, or the authenticated role (in this case, the host) lacks the necessary permissions to access it. As a security principle to prevent information leakage, Conjur intentionally does not distinguish between these two scenarios for an unauthorized client. Therefore, if the Synchronizer has successfully created the variable in Conjur, the most probable cause for this error is that the host making the API call has not been granted the required read and execute privileges on the secret variable via a Conjur policy.

A. A loss of connectivity between the Conjur Leader and the Synchronizer would prevent updates or new secrets from being synced but would not affect access to secrets already present in the Conjur database.

C. The path Vault/mySafe/myAccount/password is a standard, well-formed Conjur variable path. The error is not indicative of an encoding issue but rather a resource access problem.

D. A crashed Synchronizer would halt the synchronization process. However, the Conjur Leader serves secrets independently from its own database, so it would continue to serve already-synced secrets.

1. CyberArk Conjur Documentation

REST APIs > Secrets: In the documentation for the "Get a Secret" endpoint (GET /secrets/{account}/{kind}/{identifier})

the description for the 404 Not Found response code explicitly states: "A secret with the given identifier does not exist

or the authenticated role does not have read and execute permissions on the secret." This directly supports that a lack of access causes this error.

2. CyberArk Conjur Documentation

Policy > Grant statement: The !grant statement documentation details how roles (like a host) are given privileges (read

execute

update) on resources (like a variable). The 404 error is a direct consequence of the requesting host not being a subject of an appropriate !grant statement for the target secret variable.

3. CyberArk Conjur Documentation

Vault Synchronizer > Troubleshoot the Synchronizer: Troubleshooting guides for the Synchronizer focus on issues like sync failure

which would result in the variable never being created in Conjur. They do not indicate that a Synchronizer failure would cause a 404 for an existing secret being accessed by a client; that is a Conjur Core authorization issue.