# What to collect before you escalate

> The ids, run header, failed tool calls, connection test and audit entries to gather before you ask for help.

_How-to · Updated 2026-10-17 · Describes release 0.1.164_

When the [Troubleshooting hub](/help/troubleshooting.md) and the page for your area have not solved it, gather these before you contact your platform administrator or support, so whoever picks the request up starts from evidence.

**Before you start:** open the incident in question; the audit entries need `report.view`. **You should see** every item below in hand before you send the request: each one is a question the person who picks it up would otherwise ask first.

## What to collect before you escalate {#what-to-collect-before-you-escalate}

- The incident id and investigation id, from the incident page URL and the investigation header.
- The investigation header line itself: model, token count, cost and any error. `mock` there answers most "why is the analysis generic" questions immediately.
- The tool timeline rows with status `denied` or `error`.
- The datasource name and its last test result, from **Data sources**.
- The relevant **Audit log** entries, which need `report.view`. Tenant-scoped audit is described in [Audit log](/help/audit-log.md).
- Whether a colleague with a different role reproduces it. That one check separates a permission problem from a platform problem.

## Next steps {#next-steps}

- [Troubleshooting hub](/help/troubleshooting.md) — the symptoms, their causes and what to do.
- [Troubleshoot incidents](/help/troubleshoot-incidents.md) — symptoms specific to incidents.
- [Status and error reference](/help/status-and-error-reference.md#http-errors) — every status word and HTTP error the product returns.