Every hop. A clearer picture.

These are Oracle’s documented NPA prerequisites. Their presence here does not mean permissions caused this error.

API-user group permission

In the customer tenancy, replace <customer-network-group> with the group containing the API-key user. Check existing grants before adding a policy.

allow group <customer-network-group> to manage vn-path-analyzer-test in tenancy

Oracle NPA service permissions

Oracle recommends these permissions at the customer tenancy root. These statements grant read and inspect access to principals of type vnpa-service.

allow any-user to inspect compartments in tenancy where all { request.principal.type = 'vnpa-service' }
allow any-user to read instances in tenancy where all { request.principal.type = 'vnpa-service' }
allow any-user to read virtual-network-family in tenancy where all { request.principal.type = 'vnpa-service' }
allow any-user to read load-balancers in tenancy where all { request.principal.type = 'vnpa-service' }
allow any-user to read network-security-group in tenancy where all { request.principal.type = 'vnpa-service' }
allow any-user to read zpr-family in tenancy where all { request.principal.type = 'vnpa-service' }

A customer tenancy administrator must review and apply any needed policy. This app does not create IAM policies.