---
title: "MGS9010: console file withheld"
description: The server's console mount serves only the app shell without a token; any other path under /console/ is answered 404.
tags: [MGS9010, auth, console, static, "404"]
---

# MGS9010: console file withheld

The server answered `404 not found` for a path under `/console/` that is not
part of the console's app shell.

```text
[MGS9010] the console mount serves only the app shell; read data through the
authenticated API
  see: .../MGS9010.md
```

## Why

`/console/` is served without a token so the app can load and then ask for one.
The console build directory also holds files that are not the shell, such as
the hosted demo's knowledge graph, and those must not reach a caller with no
token. The mount serves an allowlist of shell file types (HTML, scripts,
styles, fonts, images, the manifest) and answers 404 for everything else,
including dotfiles, directory listings, and shell paths that do not exist.

## Resolution

Read workspace data through the authenticated routes (the Connect services and
`/api/v1/`), with a bearer token. A shell asset that should load but gets this
code has an extension outside the allowlist.