Fixing Amazon Connect “acceptContact API Request Failed: Network Failure” — Complete Troubleshooting Guide

Contents

What Is This Error? {#what-is-this-error}

Amazon Connect acceptContact API request failed Network Failure – If you manage or support an Amazon Connect contact center, you may have run into a situation where agents click Accept on an incoming call and nothing happens — the call simply falls to a missed call state. When you dig into the CCP logs, you find entries like these:

ccp ERROR 'acceptContact' API request failed: [object Object]
ccp TRACE AWSClient: < Operation 'acceptContact' failed: {"message":"Network Failure","code":"NetworkingError","time":"...."}

This is the Amazon Connect acceptContact API request failed: Network Failure error. It means the Contact Control Panel (CCP) tried to communicate with Amazon Connect’s API endpoints — which are hosted through Amazon CloudFront — but the network blocked or dropped that connection before a response came back.

The result: the agent sees the incoming call notification, clicks Accept, but the CCP never successfully completes the handshake with the Amazon Connect backend. After a timeout, the call is marked as missed.

This is one of the most disruptive CCP errors because it directly prevents agents from answering calls, and it can happen sporadically, making it hard to diagnose. Importantly, this is a networking issue, not a browser bug — even though the symptom shows up inside a browser window.

Quick Fix Checklist

If you need to get agents back online fast, work through this list in order:

Run the Amazon Connect Endpoint Test Utility to confirm which endpoints are blocked from the agent’s machine.
Allowlist all required domains over TCP port 443 (see the full list in Step 2 below).
Disable VPN temporarily and test whether the error goes away. If it does, VPN split-tunneling or proxy bypass rules need to be updated.
Check firewall rules to confirm outbound TCP 443 traffic is allowed to Amazon Connect and CloudFront domains.
Clear the browser cache and cookies, then log out and log back into the CCP.
Close all extra CCP tabs or windows — only one CCP session per browser is supported.
Verify the agent’s workstation meets the minimum system requirements for the CCP.
If the issue persists after all of the above, submit an AWS Support ticket and include the CCP logs.

What Causes the acceptContact API Network Failure? {#root-cause}

The Amazon Connect CCP relies on two separate categories of connections to function properly:

1. API Endpoints (CloudFront — TCP 443) The CCP makes API calls, including acceptContact, over HTTPS (TCP port 443) to endpoints hosted through Amazon CloudFront. When an agent receives a call, the CCP calls getAgentSnapshot every 30 seconds to check agent status, and acceptContact is fired the moment the agent clicks Accept. If your firewall, proxy, or network configuration blocks traffic to these CloudFront-hosted endpoints — even momentarily — the acceptContact API call fails with a NetworkingError.

2. Softphone Media Endpoints (UDP 3478) Separately, the audio stream itself travels over UDP port 3478 to Amazon’s TURN/NLB media endpoints. A blockage here causes audio to stop mid-call, which is a different (but related) problem.

The acceptContact API Network Failure is specifically about the API endpoint connection, not the audio stream. This means TCP 443 is being blocked or interrupted when the agent tries to accept the call.

Common root causes include:

Firewall rules blocking outbound TCP 443 to CloudFront or Amazon Connect domains
Proxy or VPN interception of HTTPS traffic that breaks the WebSocket or HTTPS connection to Amazon Connect API endpoints
Missing domain allowlist entries — if your organization uses domain-based allowlisting and certain CloudFront or Amazon Connect domains are not included
Unstable network connections — a brief interruption during the acceptContact API call is enough to cause a failure
Multiple CCP windows open — this can exhaust WebSocket connections and cause API calls to fail

How to Read the CCP Logs to Confirm the Error {#read-ccp-logs}

Before you start changing firewall rules, confirm that acceptContact is actually the failing call in the logs. Amazon Connect CCP logs are available directly in the browser.

To download CCP logs:

Open the CCP in Google Chrome or Firefox.
Click the gear icon (⚙) in the upper right corner of the CCP.
Click Download logs.
Open the downloaded log file in a text editor or upload it to the CCP Log Parser (available on GitHub) to convert raw logs into a readable format.

What to look for in the raw logs:

Search for the string acceptContact. You should see entries similar to:

ccp ERROR 'acceptContact' API request failed: [object Object]
ccp TRACE AWSClient: < Operation 'acceptContact' failed: {"message":"Network Failure","code":"NetworkingError"}

Also look at the Snapshots section of the CCP Log Parser. If you see large gaps (longer than 30 seconds) between Available status entries, followed by a MissedCallAgent state, that confirms a networking disruption prevented the getAgentSnapshot API call from returning — which is the same category of API endpoint connectivity failure.

Once you have confirmed the error, proceed with the troubleshooting steps below.

Step-by-Step Troubleshooting Guide {#step-by-step}

Step 1: Run the Amazon Connect Endpoint Test Utility

The Amazon Connect Endpoint Test Utility is the single most useful first step. It tests connectivity from the agent’s workstation to all required Amazon Connect endpoints, including API, signaling, and media endpoints.

How to use it:

On the affected agent’s machine, open the same browser they use for the CCP (Chrome or Firefox).
Navigate to the Amazon Connect Endpoint Test Utility (search for “Amazon Connect Endpoint Test Utility” in the AWS documentation to find the current link for your region).
Run the full connectivity test.
Review the results — any failed endpoints will be listed clearly.

Pay close attention to failures on TCP port 443 for API or CloudFront-related endpoints, as these directly correspond to the acceptContact API Network Failure error.

If the endpoint test passes for all endpoints, the issue may be intermittent or workstation-specific. If it fails, you have a confirmed network blockage to resolve.

Step 2: Verify Domain Allowlists on TCP Port 443

The acceptContact API Network Failure means the CCP cannot reach Amazon Connect’s API endpoints over HTTPS. AWS recommends using a domain-based allowlist (Option 1) rather than IP address ranges, because CloudFront IPs can change.

The following domains must be allowed outbound over TCP port 443. Replace INSTANCE_NAME with your actual Amazon Connect instance name, and REGION with your AWS region (e.g., us-east-1):

Domain	Purpose
`INSTANCE_NAME.my.connect.aws/ccp-v2`	CCP v2 interface
`INSTANCE_NAME.my.connect.aws/api`	API calls including acceptContact
`*.static.connect.aws`	Static assets
`INSTANCE_NAME.awsapps.com/connect/ccp-v2`	Legacy CCP v2
`INSTANCE_NAME.awsapps.com/connect/api`	Legacy API endpoint
`*.cloudfront.net`	CloudFront CDN (API hosting)
`*.telemetry.connect.REGION.amazonaws.com`	Telemetry
`*.transport.connect.REGION.amazonaws.com`	Signaling (CCP v2)

All of these must be accessible on TCP port 443. If your organization uses a firewall that inspects HTTPS, make sure SSL certificate inspection is not breaking the connection to these domains.

Additionally for audio (separate from the API issue but important for overall CCP health):

Domain	Port/Protocol
`TurnNlb-*.elb.REGION.amazonaws.com`	UDP 3478

Note: If you are using SAML 2.0 / SSO to log in to Amazon Connect (such as U-M Shibboleth as described in your organization’s ITS documentation), you also need to allowlist the AWS SSO endpoints listed in the AWS Sign-In endpoints documentation.

Step 3: Check Firewall and Proxy Settings

Firewall:

Confirm that outbound TCP 443 traffic is allowed from agent workstations to all the domains listed in Step 2.
If your firewall performs SSL/TLS inspection (deep packet inspection), the CloudFront domains used by Amazon Connect must be excluded from inspection. Intercepting the TLS connection can break the persistent WebSocket that the CCP relies on for API calls.
If your organization uses a stateless firewall, you must also open the ephemeral port range (typically 1024–65535) to allow return traffic. Stateful firewalls handle this automatically.

Proxy:

If agents use an HTTP/HTTPS proxy, the proxy must be able to pass WebSocket connections through without terminating or rewriting them.
To isolate the proxy as the cause: temporarily configure the agent’s browser to bypass the proxy for Amazon Connect domains, and test again.
If removing the proxy resolves the error, update your proxy bypass rules to exclude all domains listed in Step 2.

Step 4: Validate IP Address Allowlists (If Not Using Domain Allowlist)

If your organization has chosen to allowlist IP address ranges instead of domains (which AWS does not recommend), you need to ensure the IP ranges are current.

Amazon Connect uses IP addresses from the AWS ip-ranges.json file, which is updated when AWS adds or changes IP address allocations. If your IP allowlist is out of date, some CloudFront-hosted API endpoints may be blocked.

Download the current ip-ranges.json from the AWS IP Ranges page.
Cross-reference your current allowlist against the CLOUDFRONT and AMAZON service entries for your region.
Add any missing ranges over TCP 443.

AWS recommends switching to domain-based allowlisting (Step 2) to avoid this ongoing maintenance burden and reduce the risk of the acceptContact API Network Failure recurring as IP ranges change.

Step 5: Test Without VPN

VPNs are one of the most common culprits behind the acceptContact API Network Failure, especially in hybrid or remote work environments. VPN software can:

Route Amazon Connect API traffic through a corporate network that doesn’t have the required domains allowlisted
Add latency that causes the API call to time out before a response is received
Perform TLS inspection that breaks the connection to CloudFront endpoints

To isolate the VPN:

Have the affected agent temporarily disconnect from the VPN.
Attempt to receive and accept a call.
If the error disappears without the VPN, the VPN configuration is the cause.

Resolution if VPN is the cause:

Work with your network or IT team to configure VPN split tunneling so that traffic to Amazon Connect domains bypasses the VPN and goes directly to the internet. AWS provides guidance on this in the Amazon Connect networking documentation.

Step 6: Confirm Browser and Workstation Requirements

While the acceptContact API Network Failure is a networking issue, an unsupported or misconfigured browser can sometimes mask the real problem or make it worse.

Supported browsers for Amazon Connect CCP:

Google Chrome (latest version)
Mozilla Firefox (latest version)

Mobile browsers are not supported for the softphone.

Workstation checks:

Ensure the browser has microphone permission granted for the CCP URL. Without microphone access, calls may go to missed status even before the acceptContact API call can complete.
In Firefox specifically, the CCP tab must be in focus (active/visible) for microphone and audio to pass through. If the agent has another tab open on top of the CCP tab, incoming calls may be missed.
Make sure agents are not logged into CCP in two different browsers simultaneously (e.g., Chrome and Firefox at the same time). This is unsupported and can cause unpredictable API failures.

Step 7: Clear Browser Cache and Re-login

Stale cached data or session cookies can sometimes interfere with the CCP’s connection to Amazon Connect API endpoints. This is a quick step to rule out before escalating.

In Chrome: open Settings → Privacy and security → Clear browsing data → select Cookies and other site data and Cached images and files → Clear data.
In Firefox: open Settings → Privacy & Security → Cookies and Site Data → Clear Data.
After clearing, close the browser completely and reopen it.
Navigate to the Amazon Connect login URL and log in fresh.
When prompted, click Allow to grant microphone access.
Test call acceptance.

Important: As noted in the Amazon Connect Manager Training documentation: if you miss the microphone permission prompt on first login, you need to clear cache and cookies and log back in to be prompted again.

Step 8: Check for Multiple CCP Sessions

The Amazon Connect CCP is designed to run in a single browser tab per agent. Running the CCP in multiple tabs or windows simultaneously causes WebSocket connection conflicts that can result in API call failures, including acceptContact failures.

Check for:

Multiple browser tabs with the CCP open
The CCP open in both a native browser window and embedded inside another application (such as Salesforce) simultaneously
Agents who have not properly logged out at the end of a previous session — the CCP may still be holding an open session in another tab

Fix:

Close all CCP windows and tabs except for one. Log out properly using the CCP’s logout function (not just closing the tab), then log back in. The Amazon Connect Manager Training documentation explicitly notes: “Closing the CCP or the browser will not automatically sign you out” — agents must always use the proper logout process to avoid stale sessions.

Related CCP Errors You Might See Alongside This One {#related-errors}

The acceptContact API Network Failure is part of a broader family of Amazon Connect CCP connectivity errors. If you are troubleshooting this error, you may also encounter:

Missed calls with no incoming call notification The CCP shows missed calls but agents never saw the incoming call ring. This occurs when the getAgentSnapshot API call — which runs every 30 seconds — fails to return a response. The fix is identical: ensure TCP 443 outbound traffic reaches CloudFront and Amazon Connect API endpoints.

“Softphone call failed” / WebRTC issue (Red screen) This error appears when the CCP cannot establish a media channel over UDP 3478. While the root port is different from the acceptContact error, both point to network blockages. If an agent sees both errors, their workstation may have multiple Amazon Connect network paths blocked.

“Initialization failed” This error means the CCP could not establish its initial WebSocket connection on startup. It is caused by the same set of missing domain allowlist entries that cause the acceptContact API failure. Fix it with the allowlist updates in Step 2.

“ice_collection_timeout” This indicates the CCP cannot communicate with the softphone/TURN media endpoint over UDP 3478. It is separate from the acceptContact API issue but can occur simultaneously if both TCP 443 and UDP 3478 are blocked.

When to Escalate to AWS Support {#escalate}

Amazon Connect acceptContact API request failed Network Failure – If you have worked through all steps above and the acceptContact API request failed: Network Failure error persists, it is time to open an AWS Support case. When you do, include the following:

CCP logs from an affected agent’s browser session during a failed call attempt (download from the CCP gear icon → Download logs).
Results from the Amazon Connect Endpoint Test Utility — screenshot or export of which endpoints passed and which failed.
Your network configuration — describe your firewall, proxy, VPN setup, and what is currently on your allowlist.
The affected agent’s browser version and operating system.
The frequency and pattern of the issue — does it affect all agents, some agents, specific locations, specific times of day?

The more detail you provide upfront, the faster AWS Support can diagnose whether the issue is on the network side or within Amazon Connect itself.

Summary {#summary}

The Amazon Connect acceptContact API request failed Network Failure error is a networking problem, not a browser bug. When an agent clicks Accept and nothing happens, it means the CCP could not reach Amazon Connect’s CloudFront-hosted API endpoints over TCP port 443 in the moment the acceptContact call was made.

The most effective path to resolution is:

Confirm the error using CCP logs and the Endpoint Test Utility.
Ensure all required domains are allowlisted over TCP 443.
Verify that firewalls, proxies, and VPNs are not intercepting or blocking those connections.
Follow the Amazon Connect networking best practice of using a domain-based allowlist (not IP ranges) to stay ahead of IP changes.

Agents should also always log out properly at the end of each session and avoid running the CCP in multiple browser tabs simultaneously.

Sources: AWS re:Post Knowledge Center (resolve-amazon-connect-ccp-errors), Amazon Connect Administrator Guide — Contact Control Panel Issues, Amazon Connect Administrator Guide — Set Up Your Network, Amazon Connect Manager Training ITS Documentation.