Please review a Cloudflare 1010 block affecting our read-only backup automation and confirm the supported client configuration or an appropriate exception.

Time: 2026-10-29 02:25:27 UTC

Client: Python urllib, default User-Agent, GitHub-hosted Ubuntu 24.04 runner.

POST https://backboard.railway.com/graphql/v2

Headers: Content-Type: application/json; Project-Access-Token: [REDACTED]

Body: {"query":"query { projectToken { projectId environmentId } }","variables":{}}

Response: HTTP 403; "error code: 1010".

We checked the endpoint, method, JSON, header, secret injection, and whitespace handling. The dashboard shows the token scoped to production; API authentication remains unverified because this query is blocked. Full app/configuration backups cannot complete. The application remains online.

Is an application-specific User-Agent the supported configuration for this endpoint, and could it resolve this 1010 response, or does the blocking rule need review? We have not tested that change and have stopped retries.

No secrets or private repository links are included; resource IDs can be supplied privately.