TL;DR: After an Atlas Organization Service Account secret expired (standard 2-secret rotation pattern), all $vectorSearch queries on the cluster started returning PlanExecutor error during aggregation :: caused by :: Authentication failed for every user (atlasAdmin, per-tenant readWrite, etc). Other operations (find, count, listSearchIndexes) worked normally with the same credentials. The fix turned out to be an explicit DELETE of the expired SA secret via Admin API. Atlas's automatic HOST_MONGOT_RESTARTED events triggered by the expiration did NOT resolve it — mongot (the Search process) was still caching the expired secret internally. Full Q&A on Stack Overflow (with reproducer + curl commands): https://stackoverflow.com/questions/79945813/atlas-search-vectorsearch-returns-plane xecutor-authentication-failed-for-a Misleading symptom: getSearchIndexes() returns the index with status: READY, queryable: true. You'd think the index is fine. It is — it's the SA cache that isn't.…