The "Cannot activate repository due to invalid status" error typically occurs when the repository hasn't been properly validated yet. Here are the key points to check: Repository Validation Process After configuring your repository with the POST request, you need to verify that new branches were created before attempting activation (1) . The branches should be named following the format

permit/generated/<env_id>

. 2FA and Deploy Keys Regarding your 2FA concern - the documentation specifically states that deploy keys should be set up *without Two-Factor Authentication (2FA) * to allow the Permit server unrestricted read and write access to your repository . While 2FA on your account doesn't directly affect deploy keys, this requirement suggests ensuring the deploy key has unimpeded access. Activation Steps The activation process requires two separate API calls : 1. First, the POST request to configure the repository:

curl -X POST "<https://api.permit.io/v2/projects/<your-project-id-or-key>/repos>" -H "Content-Type: application/json" -H "Authorization: Bearer {API_KEY from step 4}" --data-binary @"path/to/your/json"

2. Then, after validating the policy branches exist, the PUT request to activate:

curl -X PUT "<https://api.permit.io/v2/projects/<your-project-id-or-key>/repos/<your-repo-id-or-key>/activate>" -H "Authorization: Bearer <your-permit-api-key>"

Common Issues to Check 1. ​*Branch Creation*​: Verify that the

permit/generated/<env_id>

branches were created in your repository after the initial POST request 2. ​*SSH Key Format*​: Ensure your private key uses proper newline replacement with

\n

using:

awk -v ORS='\\n' '1' <private-key-file>

3. ​*Deploy Key Permissions*​: Confirm the deploy key has "Allow write access" toggled on in GitHub 4. ​*Repository State*​: The repository needs a default branch with at least one commit on the remote Try checking your repository for the generated branches first. If they don't exist, the initial configuration may have failed, preventing activation.

To learn more, see the sources I considered: [[1] Git and Permit](https://docs.permit.io/integrations/gitops/github)

If the branches were never created, this indicates the initial POST request to create the repository configuration failed. Here are specific debugging steps: ​*Check Repository Creation Status*​ According to the documentation, the repository is created with status 'pending' and will only be changed to 'active' after a successful attempt to use it (1) . The repository main branch must be present in the remote . ​*Common Configuration Issues to Debug*​ 1. ​*SSH Key Format*​: Ensure your private key is properly formatted with newline replacement :

awk -v ORS='\\n' '1' <private-key-file>

2. ​*JSON Configuration Structure*​: Verify your JSON file has the correct structure :

{
  "url": "<your-ssh-url>",
  "main_branch_name": "<your-default-branch>",
  "credentials": {
    "auth_type": "ssh",
    "username": "git",
    "private_key": "<your-private-key>"
  },
  "key": "<your-custom-id-string-without-spaces>"
}

3. ​*Repository Requirements*​: • The repository needs at least one file committed when using GitOps with a brand-new Git repository that has no commits on the main branch (2) • The repository main branch must be present in the remote (1) ​*API Response Debugging*​ Check the response from your initial POST request - it should return a PolicyRepoRead object if successful (3) (4) . Any 422 error would indicate validation issues with your configuration (3) . ​*Related Known Issues*​ There's a documented case where OPAL failed to checkout a repository due to configuration issues with wrong URL, key, or protocol (5) . The error "policy repo was not found" can occur when OPAL tries checking out your repository and fails . Try running the POST request again and capture the full response to see if there are specific error details about why the repository configuration isn't being accepted.

To learn more, see the sources I considered: [[1] Git and Permit](https://docs.permit.io/integrations/gitops/github) [[2] Create a new Environment](https://docs.permit.io/manage-your-account/creating-environments) [[3] permitio/permit-golang/pkg/openapi/api_policy_git_repositories.go](https://github.com/permitio/permit-golang/blob/master/pkg/openapi/api_policy_git_repositories.go) [[4] permitio/permit-ruby/lib/openapi_client/api/policy_git_repositories_api.rb](https://github.com/permitio/permit-ruby/blob/main/lib/openapi_client/api/policy_git_repositories_api.rb) [[5] Getting a 503 on GET /policy?path=. but no errors anywhere being outputted](https://github.com/permitio/opal/discussions/510)

@Ask Inkeep See previous message

The error shows your repository status is

invalid

rather than

valid

. According to the SDK documentation, a PolicyRepoStatus can have three states (1) :

"invalid",
"pending",
"valid",

Your repository went from

pending

to

invalid

, which means the validation failed. The repository is created with status 'pending' and will only change to 'valid' after successful validation (2) (3) . Since you're experiencing issues with repository validation and the branches weren't created, here's what our engineers need to investigate: 1. ​*Which Workspace / Project / Env are you using?*​ (Please provide the specific IDs or keys) 2. ​*What exact API calls are you making?*​ (Share the full CURL commands with parameters, excluding sensitive tokens) 3. ​*Which PDP version are you running?*​ (If you have a PDP deployed) 4. ​*Can you share relevant logs?*​ Particularly any error messages from when the repository validation fails The

invalid

status indicates the system couldn't successfully connect to or validate your repository. Common causes include SSH key issues, repository access problems, or branch creation failures.

To learn more, see the sources I considered: [[1] https://github.com/permitio/permit-golang/blob/master/pkg/models](https://github.com/permitio/permit-golang/blob/master/pkg/models) [[2] https://github.com/permitio/permit-ruby/blob/main/docs](https://github.com/permitio/permit-ruby/blob/main/docs) [[3] permitio/permit-ruby/lib/openapi_client/api/policy_git_repositories_api.rb](https://github.com/permitio/permit-ruby/blob/main/lib/openapi_client/api/policy_git_repositories_api.rb)

Feel free to tag me with additional questions. I also appreciate feedback, it helps me improve. 👍 button 👎 button