The INTERNAL_SERVER_ERROR code on an HTTP 200 response is the default code our API puts on an authorization refusal, so it does not indicate a server-side crash. It means the token you used is not authorized for at least one of the fields in that query.

What a token can read depends on its scope. A project token, sent with the Project-Access-Token header, is limited to its own project and environment. A workspace token is bound to a single workspace. An account token, created with "No workspace" selected, covers every workspace you belong to. The Scope column at railway.com/account/tokens shows which kind each token is.

You can also check a Bearer token's reach with query { apiToken { workspaces { id name } } }. For a project token, use query { projectToken { projectId environmentId } }. If the deployments or volumes you're querying sit outside what that returns, use a token whose scope includes them: a workspace token for that workspace, or an account token if the inventory spans several workspaces.