Errors

Every error the API returns is the error envelope, a JSON object whose code says what went wrong. This page lists every code the server defines, generated from the API's error schemas, with what it means and the operations that can return it. An operation's error set, the codes it can return, is generated from the server's code.

The API document ties no code to an HTTP status: branch on code, not on the status.

Too many requests

These operations declare a 429 Too Many Requests response, with the error envelope as its body (rate limits):

Projects: Create project (POST /projects), Query projects (POST /projects/query), Get claim status (GET /projects/{project_id}/claim/status), Complete a project claim (POST /projects/{project_id}/claim/complete), Get the claim window for a project (GET /projects/{project_id}/claim/window)
Teams: Create team (POST /teams), Query teams (POST /teams/query)
Grants: Create grant (POST /grants)

Without a namespace

`internal`

An unexpected error occurred.

Every operation can return it.

`not_implemented`

This feature is not implemented yet.

Every operation can return it, except:

Projects: Get the claim window for a project (GET /projects/{project_id}/claim/window)
System: Check server liveness (GET /livez), Check server readiness (GET /readyz)

`unavailable`

The service could not complete the request right now. Try again.

Every operation can return it, except:

Projects: Get the claim window for a project (GET /projects/{project_id}/claim/window)
System: Check server liveness (GET /livez), Check server readiness (GET /readyz)

`att`

`att.already_completed`

The auth attempt is already completed and can no longer be changed.

No operation's error set includes it.

`att.already_handed_off`

The auth attempt was already handed off. No new handoff can be created and the previous token will only be returned if the same Idempotency-Key header is provided.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Issue a factor challenge (POST /auth_attempts/{attempt_id}/challenges), Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify), Complete authentication and create handoff token (POST /auth_attempts/{attempt_id}/handoff)
Users: Begin passkey registration (POST /users/{user_id}/passkeys/registrations), Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id})

`att.invalid_proof`

The proof or request is invalid.

Returned by:

Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id})

`att.invalid_request`

Invalid request.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Create a new authentication attempt (POST /auth_attempts), Issue a factor challenge (POST /auth_attempts/{attempt_id}/challenges), Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Begin passkey registration (POST /users/{user_id}/passkeys/registrations), Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id})

`att.invalid_state`

The auth attempt is in an invalid state for the intended change.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Issue a factor challenge (POST /auth_attempts/{attempt_id}/challenges), Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify), Complete authentication and create handoff token (POST /auth_attempts/{attempt_id}/handoff)
Users: Begin passkey registration (POST /users/{user_id}/passkeys/registrations), Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id})

`att.not_completed`

The auth attempt must be completed for any further action.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Complete authentication and create handoff token (POST /auth_attempts/{attempt_id}/handoff)

`att.not_found`

The auth attempt was not found.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Get authentication attempt state (GET /auth_attempts/{attempt_id}), Issue a factor challenge (POST /auth_attempts/{attempt_id}/challenges), Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify), Complete authentication and create handoff token (POST /auth_attempts/{attempt_id}/handoff)
Sessions: Exchange handoff token for a session (POST /sessions/exchange)
Users: Begin passkey registration (POST /users/{user_id}/passkeys/registrations), Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id})

`att.proof_rejected`

The proof was rejected.

Returned by:

Flows: Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id})

`att.sso_state_invalid`

The SSO state is not valid.

No operation's error set includes it.

`att.stale_challenge`

The challenge is stale or was re-issued.

Returned by:

Flows: Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id})

`auth`

`auth.csrf_invalid`

The request failed cross-site request forgery validation.

Returned by:

Sessions: Revoke my session (DELETE /sessions/me)
Identity providers: Query identity provider connections (POST /idps/query)
Policies: Evaluate a policy (POST /policies/evaluate)
Releases: Revoke a release (POST /releases/{release_id}/revoke)
Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)
Projects: Update project (PATCH /projects/{project_id}), Complete a project claim (POST /projects/{project_id}/claim/complete), Add an origin pattern (POST /projects/{project_id}/origins), Remove an origin pattern (POST /projects/{project_id}/origins/remove)
Teams: Create team (POST /teams), Query teams (POST /teams/query), Update team (PATCH /teams/{team_id})
Users: Create user (POST /users), Query users (POST /users/query), Update user by ID (PATCH /users/{user_id}), Delete user by ID (DELETE /users/{user_id}), Update my user information (PATCH /users/me)
Grants: Create grant (POST /grants), Query grants (POST /grants/query), Revoke grant (DELETE /grants/{id})

`auth.unauthorized`

The request lacks valid authentication credentials.

Every operation can return it, except:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Projects: Create project (POST /projects), Get the claim window for a project (GET /projects/{project_id}/claim/window)
System: Check server liveness (GET /livez), Check server readiness (GET /readyz)

`brnd`

`brnd.invalid`

Branding: invalid.

Returned by:

Branding: Publish a new branding revision (POST /branding)

`brnd.missing_project_id`

Branding: missing project id.

Returned by:

Branding: Publish a new branding revision (POST /branding)

`brnd.not_found`

Branding: not found.

Returned by:

Branding: List branding revisions (GET /branding), Publish a new branding revision (POST /branding), Get a branding revision by ID (GET /branding/{id})

`brnd.permission_denied`

Branding: requires an operator-grade token bound to the project (project.write or a branding.* scope).

Returned by:

Branding: List branding revisions (GET /branding), Publish a new branding revision (POST /branding), Get a branding revision by ID (GET /branding/{id})

`claim`

`claim.no_personal_team`

The user has no active personal team in the platform project.

Returned by:

Projects: Complete a project claim (POST /projects/{project_id}/claim/complete)

`claim.personal_team_not_active`

The user's personal team in the platform project is not active.

Returned by:

Projects: Complete a project claim (POST /projects/{project_id}/claim/complete)

`claim.session_expired`

The session has expired.

No operation's error set includes it.

`claim.session_not_active`

The session is not active: it has no verified factor or no resolved user.

No operation's error set includes it.

`claim.session_wrong_project`

The session does not belong to the platform project.

No operation's error set includes it.

`claim_challenge`

`claim_challenge.invalid`

The claim challenge is invalid. Expected a non-empty id, project id, and initiating secret hash.

Returned by:

Projects: Initialize a project claim (POST /projects/{project_id}/claim/init)

`claim_challenge.not_found`

Claim challenge not found.

Returned by:

Projects: Get claim status (GET /projects/{project_id}/claim/status), Complete a project claim (POST /projects/{project_id}/claim/complete), Get the claim window for a project (GET /projects/{project_id}/claim/window)

`dep`

`dep.conflict`

Deployment: the deployment it replaces does not match expected_deployment_id.

Returned by:

Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)

`dep.invalid`

Deployment: invalid.

Returned by:

Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)

`dep.not_found`

Deployment: not found.

Returned by:

Deployments: List deployments (GET /deployments), Create a deployment (POST /deployments), Get a deployment by id (GET /deployments/{deployment_id}), Roll back to a deployment (POST /deployments/{deployment_id}/rollback), Get a deployment's variables (GET /deployments/{deployment_id}/variables)
Previews: List previews (GET /projects/{project_id}/previews), Remove a preview (POST /projects/{project_id}/previews/remove)

`dep.permission_denied`

Deployment: requires an operator-grade token bound to the project (project.write or a deployment.* scope).

Returned by:

Deployments: List deployments (GET /deployments), Create a deployment (POST /deployments), Get a deployment by id (GET /deployments/{deployment_id}), Roll back to a deployment (POST /deployments/{deployment_id}/rollback), Get a deployment's variables (GET /deployments/{deployment_id}/variables)
Previews: List previews (GET /projects/{project_id}/previews), Remove a preview (POST /projects/{project_id}/previews/remove)

`dep.variables_missing`

Deployment: the release references variables its kind has no value for.

Returned by:

Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)

`enc_key`

`enc_key.decrypt_failed`

Failed to decrypt data.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Create a new authentication attempt (POST /auth_attempts)
Sessions: Create an anonymous session shell (POST /sessions), Exchange handoff token for a session (POST /sessions/exchange)
Variables: Update variables (PATCH /variables)
Projects: Create project (POST /projects)

`enc_key.encrypt_failed`

Failed to encrypt data.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`enc_key.no_replacement_key`

No replacement key was provided while retiring the current one.

No operation's error set includes it.

`enc_key.not_found`

Encryption key not found.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Sessions: Create an anonymous session shell (POST /sessions), Exchange handoff token for a session (POST /sessions/exchange)
Variables: Update variables (PATCH /variables)
Projects: Create project (POST /projects)

`enc_key.unknown_alg`

Unsupported encryption algorithm.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Create a new authentication attempt (POST /auth_attempts)
Sessions: Create an anonymous session shell (POST /sessions), Exchange handoff token for a session (POST /sessions/exchange)
Variables: Update variables (PATCH /variables)
Projects: Create project (POST /projects)

`env`

`env.not_found`

Environment not found.

No operation's error set includes it.

`env.project_not_found`

Project not found.

Returned by:

Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)
Previews: Remove a preview (POST /projects/{project_id}/previews/remove)

`evt`

`evt.invalid`

Event: invalid.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Create a new authentication attempt (POST /auth_attempts), Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify), Complete authentication and create handoff token (POST /auth_attempts/{attempt_id}/handoff)
Sessions: Create an anonymous session shell (POST /sessions), Exchange handoff token for a session (POST /sessions/exchange), Revoke session (DELETE /sessions/{session_id}), Revoke my session (DELETE /sessions/me)
Flow definitions: Create a new flow definition (POST /flow_definitions)
Schemas: Create new schema (POST /schemas)
Branding: Publish a new branding revision (POST /branding)
Identity providers: Create or revise an identity provider connection (POST /idps)
Policies: Publish a policy (POST /policies)
Variables: Update variables (PATCH /variables), Delete a variable (DELETE /variables/{variable_name})
Releases: Create a release (POST /releases), Build a release from files (POST /releases/build), Revoke a release (POST /releases/{release_id}/revoke)
Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)
Previews: Remove a preview (POST /projects/{project_id}/previews/remove)
Projects: Create project (POST /projects), Update project (PATCH /projects/{project_id}), Complete a project claim (POST /projects/{project_id}/claim/complete), Add an origin pattern (POST /projects/{project_id}/origins), Remove an origin pattern (POST /projects/{project_id}/origins/remove)
Teams: Create team (POST /teams), Update team (PATCH /teams/{team_id}), Delete team (DELETE /teams/{team_id})
Users: Create user (POST /users), Update user by ID (PATCH /users/{user_id}), Delete user by ID (DELETE /users/{user_id}), Begin passkey registration (POST /users/{user_id}/passkeys/registrations), Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id}), Set user password (PUT /users/{user_id}/password), Update my user information (PATCH /users/me)
Grants: Create grant (POST /grants), Revoke grant (DELETE /grants/{id})
Events: List events (GET /events), Get event by ID (GET /events/{id})

`evt.not_found`

Event: not found.

Returned by:

Events: List events (GET /events), Get event by ID (GET /events/{id})

`evt.permission_denied`

Event: permission denied.

Returned by:

Events: List events (GET /events), Get event by ID (GET /events/{id})

`flow`

`flow.completed`

Flow has already completed.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id})

`flow.cookie_expired`

Flow cookie has expired.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`flow.cookie_invalid`

Flow cookie is missing or invalid.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`flow.integrity`

Flow state integrity violation.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`flow.invalid_action`

Action is not allowed on the current step.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`flow.invalid_purpose`

Unknown or unsupported flow purpose.

Returned by:

Flows: Start a new flow (POST /flow)

`flow.not_found`

Flow not found.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`flow.restart_required`

The flow must be restarted.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`flow.session_conflict`

Flow session version conflict.

No operation's error set includes it.

`flow.sso_unavailable`

Identity provider is unavailable.

No operation's error set includes it.

`flow.unsupported`

Flow feature is not supported.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`flowdef`

`flowdef.invalid`

Flow definition: invalid.

Returned by:

Flow definitions: List flow definitions (GET /flow_definitions), Create a new flow definition (POST /flow_definitions)
Releases: Build a release from files (POST /releases/build)

`flowdef.missing_id`

Flow definition: missing id.

Returned by:

Flow definitions: Get a flow definition by id (GET /flow_definitions/{id})

`flowdef.missing_project_id`

Flow definition: missing project id.

Returned by:

Flow definitions: List flow definitions (GET /flow_definitions), Get a flow definition by id (GET /flow_definitions/{id})

`flowdef.not_found`

Flow definition: not found.

Returned by:

Flows: Start a new flow (POST /flow)
Flow definitions: List flow definitions (GET /flow_definitions), Create a new flow definition (POST /flow_definitions), Get a flow definition by id (GET /flow_definitions/{id})

`flowdef.permission_denied`

Flow definition: the flow definition management API requires the project secret.

Returned by:

Flow definitions: List flow definitions (GET /flow_definitions), Create a new flow definition (POST /flow_definitions), Get a flow definition by id (GET /flow_definitions/{id})

`flowdef.purpose_mismatch`

Flow definition: does not serve requested purpose.

Returned by:

Flows: Start a new flow (POST /flow)

`flowdef.revision_conflict`

Flow definition: another revision of the same flow was created at the same instant.

Returned by:

Flow definitions: Create a new flow definition (POST /flow_definitions)

`flowdef.schema_fetch_failed`

Flow definition: failed to fetch schema.

Returned by:

Flow definitions: Create a new flow definition (POST /flow_definitions)
Releases: Build a release from files (POST /releases/build)

`grant`

`grant.already_exists`

An unrevoked grant with this principal and relation already exists on the project.

Returned by:

Grants: Create grant (POST /grants)

`grant.invalid`

The grant request is invalid.

Returned by:

Grants: Create grant (POST /grants), Query grants (POST /grants/query)

`grant.not_found`

Grant not found.

Returned by:

Grants: Create grant (POST /grants), Query grants (POST /grants/query), Get grant (GET /grants/{id}), Revoke grant (DELETE /grants/{id})

`grant.permission_denied`

Insufficient permissions to manage grants.

Returned by:

Grants: Create grant (POST /grants), Query grants (POST /grants/query), Get grant (GET /grants/{id}), Revoke grant (DELETE /grants/{id})

`grant.principal_not_found`

The principal could not be resolved.

Returned by:

Grants: Create grant (POST /grants)

`idp`

`idp.discovery_failed`

Identity provider connection: discovery failed.

No operation's error set includes it.

`idp.endpoint_cleartext`

Identity provider connection: an endpoint is not https.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`idp.endpoints_partial`

Identity provider connection: the endpoints are partially set.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Identity providers: Create or revise an identity provider connection (POST /idps)

`idp.exchange_failed`

Identity provider connection: the code exchange failed.

No operation's error set includes it.

`idp.field_immutable`

Identity provider connection: the field is fixed for the life of the connection.

Returned by:

Identity providers: Create or revise an identity provider connection (POST /idps)
Releases: Build a release from files (POST /releases/build)

`idp.id_token_invalid`

Identity provider connection: the id_token is invalid.

No operation's error set includes it.

`idp.not_found`

Identity provider connection: not found.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id})
Identity providers: Create or revise an identity provider connection (POST /idps), Query identity provider connections (POST /idps/query), Get an identity provider connection by id (GET /idps/{id}), List the revisions of an identity provider connection (GET /idps/{id}/revisions), Get one revision of an identity provider connection (GET /idps/revisions/{revision_id})
Releases: Build a release from files (POST /releases/build)

`idp.permission_denied`

Identity provider connection: the caller's project role does not allow this operation.

Returned by:

Identity providers: Create or revise an identity provider connection (POST /idps), Query identity provider connections (POST /idps/query), Get an identity provider connection by id (GET /idps/{id}), List the revisions of an identity provider connection (GET /idps/{id}/revisions), Get one revision of an identity provider connection (GET /idps/revisions/{revision_id})

`idp.protocol_block_missing`

Identity provider connection: the protocol block is missing.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`idp.revision_conflict`

Identity provider connection: another revision of the same connection was created at the same instant.

Returned by:

Identity providers: Create or revise an identity provider connection (POST /idps)

`idp.scopes_missing_openid`

Identity provider connection: OIDC scopes must contain openid.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)

`idp.subject_invalid`

Identity provider connection: the subject claim is absent or not a string or number.

No operation's error set includes it.

`idp.userinfo_failed`

Identity provider connection: the userinfo request failed.

No operation's error set includes it.

`origin`

`origin.invalid`

Origin: must be scheme://host[:port], lowercase, with no path.

Returned by:

Projects: Create project (POST /projects), Add an origin pattern (POST /projects/{project_id}/origins), Remove an origin pattern (POST /projects/{project_id}/origins/remove)

`origin.kind_conflict`

Origin: the pattern is already stored with a different kind.

Returned by:

Projects: Create project (POST /projects), Add an origin pattern (POST /projects/{project_id}/origins)

`origin.not_found`

Origin: not found.

Returned by:

Projects: Add an origin pattern (POST /projects/{project_id}/origins), Remove an origin pattern (POST /projects/{project_id}/origins/remove)

`origin.permission_denied`

Origin: permission denied.

Returned by:

Projects: Add an origin pattern (POST /projects/{project_id}/origins), Remove an origin pattern (POST /projects/{project_id}/origins/remove)

`origin.primary_not_exact`

A primary origin is an exact URL, no wildcard.

Returned by:

Projects: Create project (POST /projects), Add an origin pattern (POST /projects/{project_id}/origins)

`origin.unbounded`

Origin: a wildcard on a shared host needs a literal label of your own beside the host.

No operation's error set includes it.

`pol`

`pol.invalid`

Policy: invalid.

Returned by:

Policies: Publish a policy (POST /policies), Evaluate a policy (POST /policies/evaluate)
Releases: Build a release from files (POST /releases/build)

`pol.not_found`

Policy: not found.

Returned by:

Policies: List policies (GET /policies), Publish a policy (POST /policies), Evaluate a policy (POST /policies/evaluate), Get a policy (GET /policies/{policy_id}), List the revisions of a policy (GET /policies/{policy_id}/revisions), Get a policy revision (GET /policies/revisions/{revision_id})

`pol.permission_denied`

Policy: the caller's project role does not allow this operation.

Returned by:

Policies: List policies (GET /policies), Publish a policy (POST /policies), Evaluate a policy (POST /policies/evaluate), Get a policy (GET /policies/{policy_id}), List the revisions of a policy (GET /policies/{policy_id}/revisions), Get a policy revision (GET /policies/revisions/{revision_id})

`pol.revision_conflict`

Policy: another revision of the same policy was published at the same instant; retry.

Returned by:

Policies: Publish a policy (POST /policies)
Releases: Build a release from files (POST /releases/build)

`proj`

`proj.already_claimed`

The project is already claimed by a team.

Returned by:

Projects: Initialize a project claim (POST /projects/{project_id}/claim/init), Complete a project claim (POST /projects/{project_id}/claim/complete)

`proj.claim_expired`

The claim challenge has expired.

Returned by:

Projects: Get claim status (GET /projects/{project_id}/claim/status), Complete a project claim (POST /projects/{project_id}/claim/complete)

`proj.claim_window_expired`

The project was not claimed within 14 days of creation and can no longer be claimed.

Returned by:

Projects: Initialize a project claim (POST /projects/{project_id}/claim/init), Get claim status (GET /projects/{project_id}/claim/status), Complete a project claim (POST /projects/{project_id}/claim/complete)

`proj.last_owner`

This user is the last active member of the team that owns a project. Add another member to that team, then try again.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Users: Delete user by ID (DELETE /users/{user_id})

`proj.mismatch`

The project named in the request is not the one the credential belongs to.

Returned by:

Authentication attempts: Create a new authentication attempt (POST /auth_attempts)
Sessions: Exchange handoff token for a session (POST /sessions/exchange)

`proj.missing_id`

Project: missing id.

Returned by:

Sessions: Query sessions (POST /sessions/query)
Projects: Query projects (POST /projects/query), Update project (PATCH /projects/{project_id}), List project admins (GET /projects/{project_id}/admins), Add an origin pattern (POST /projects/{project_id}/origins), Remove an origin pattern (POST /projects/{project_id}/origins/remove)

`proj.name_invalid`

The project name is invalid. Expected a non-empty string.

Returned by:

Projects: Create project (POST /projects), Update project (PATCH /projects/{project_id})

`proj.not_found`

Project not found.

Returned by:

Flows: Start a new flow (POST /flow)
Variables: Update variables (PATCH /variables)
Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)
Projects: Query projects (POST /projects/query), Get project (GET /projects/{project_id}), Update project (PATCH /projects/{project_id}), List project admins (GET /projects/{project_id}/admins), Initialize a project claim (POST /projects/{project_id}/claim/init), Get claim status (GET /projects/{project_id}/claim/status), Complete a project claim (POST /projects/{project_id}/claim/complete), Add an origin pattern (POST /projects/{project_id}/origins)

`proj.origin_not_allowed`

The request origin is not an origin of this project.

Returned by:

Flows: Start a new flow (POST /flow), Submit step data and advance (POST /flow/{id}/submit)
Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)

`proj.password_hash_invalid`

The password hashing method is invalid.

Returned by:

Projects: Update project (PATCH /projects/{project_id})

`proj.permission_denied`

The project management API requires the project secret.

Returned by:

Projects: Query projects (POST /projects/query), Get project (GET /projects/{project_id}), Update project (PATCH /projects/{project_id}), List project admins (GET /projects/{project_id}/admins), Initialize a project claim (POST /projects/{project_id}/claim/init), Get claim status (GET /projects/{project_id}/claim/status)

`proj.preview_not_live`

No live preview for this origin; run zitadel preview on this branch.

Returned by:

Flows: Start a new flow (POST /flow), Submit step data and advance (POST /flow/{id}/submit)

`rel`

`rel.in_use`

Release: still served by an origin.

Returned by:

Releases: Revoke a release (POST /releases/{release_id}/revoke)

`rel.invalid`

Release: invalid.

Returned by:

Releases: Create a release (POST /releases), Build a release from files (POST /releases/build)

`rel.not_deployed`

Nothing is deployed to this origin.

Returned by:

Flows: Start a new flow (POST /flow)

`rel.not_found`

Release: not found.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Releases: List releases (GET /releases), Create a release (POST /releases), Build a release from files (POST /releases/build), Get a release by id (GET /releases/{release_id}), Revoke a release (POST /releases/{release_id}/revoke)
Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)

`rel.permission_denied`

Release: requires an operator-grade token bound to the project (project.write or a release.* scope).

Returned by:

Releases: List releases (GET /releases), Create a release (POST /releases), Build a release from files (POST /releases/build), Get a release by id (GET /releases/{release_id}), Revoke a release (POST /releases/{release_id}/revoke)

`rel.project_not_found`

Release: project not found.

Returned by:

Releases: Create a release (POST /releases), Build a release from files (POST /releases/build), Revoke a release (POST /releases/{release_id}/revoke)

`rel.revision_not_found`

Release: pinned revision does not exist.

Returned by:

Releases: Create a release (POST /releases)

`rel.revision_unpinnable`

Release: pinned revision declares no handle.

Returned by:

Releases: Create a release (POST /releases), Build a release from files (POST /releases/build)

`rel.revoked`

The release this attempt runs on was revoked.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Sessions: Exchange handoff token for a session (POST /sessions/exchange)
Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)

`rel.unresolved_reference`

Release: handle is not in the release.

Returned by:

Releases: Create a release (POST /releases), Build a release from files (POST /releases/build)

`req`

`req.invalid`

The request is invalid and fails base validation (missing required fields, wrong types, failed regex, etc.). Check the details for more information.

Every operation can return it.

`req.method_not_allowed`

The operations at this path do not accept this method.

No operation's error set includes it.

`req.not_found`

No API operation matches this path.

No operation's error set includes it.

`sch`

`sch.already_exists`

A schema with the given id already exists.

Returned by:

Schemas: Create new schema (POST /schemas)

`sch.fetch_denied`

The schema URL resolves to an address blocked by the egress policy.

Returned by:

Schemas: Create new schema (POST /schemas)
Releases: Build a release from files (POST /releases/build)

`sch.fetch_downgrade`

Fetching the schema URL was redirected from https to http, which is not allowed.

Returned by:

Schemas: Create new schema (POST /schemas)
Releases: Build a release from files (POST /releases/build)

`sch.fetch_timeout`

Fetching the schema URL timed out.

Returned by:

Schemas: Create new schema (POST /schemas)
Releases: Build a release from files (POST /releases/build)

`sch.fetch_too_large`

The fetched schema document exceeds the configured size limit.

Returned by:

Schemas: Create new schema (POST /schemas)
Releases: Build a release from files (POST /releases/build)

`sch.fetch_too_many_redirects`

Fetching the schema URL exceeded the redirect limit.

Returned by:

Schemas: Create new schema (POST /schemas)
Releases: Build a release from files (POST /releases/build)

`sch.invalid_request`

Invalid request.

Returned by:

Schemas: Create new schema (POST /schemas)
Projects: Create project (POST /projects)

`sch.not_found`

Schema not found.

Returned by:

Flow definitions: List flow definitions (GET /flow_definitions), Create a new flow definition (POST /flow_definitions)
Schemas: List all schemas (GET /schemas), Create new schema (POST /schemas), Get schema by ID (GET /schemas/{id})
Releases: Build a release from files (POST /releases/build)

`sch.permission_denied`

The schema management API requires the project secret.

Returned by:

Flow definitions: List flow definitions (GET /flow_definitions)
Schemas: List all schemas (GET /schemas), Create new schema (POST /schemas), Get schema by ID (GET /schemas/{id})

`sch.revision_conflict`

Another revision of the same object type was created at the same instant.

Returned by:

Schemas: Create new schema (POST /schemas)

`sess`

`sess.exchange_conflict`

The exchange resulted in a conflict. Either the target session was revoked or verified factors could not be promoted consistently.

Returned by:

Sessions: Exchange handoff token for a session (POST /sessions/exchange)

`sess.invalid_handoff_token`

The handoff token is invalid. Either the token does not exists, was already consumed or has expired.

Returned by:

Sessions: Exchange handoff token for a session (POST /sessions/exchange)

`sess.invalid_ttl`

The session TTL is invalid. It must be positive and not exceed the configured maximum.

Returned by:

Sessions: Exchange handoff token for a session (POST /sessions/exchange)

`sess.not_found`

The session was not found.

Returned by:

Sessions: Query sessions (POST /sessions/query), Exchange handoff token for a session (POST /sessions/exchange), Get session state (GET /sessions/{session_id}), Revoke session (DELETE /sessions/{session_id}), Get my session state (GET /sessions/me), Revoke my session (DELETE /sessions/me), Get my session's CSRF token (GET /sessions/me/csrf)
Projects: Complete a project claim (POST /projects/{project_id}/claim/complete)

`sess.permission_denied`

Session: requires a session scope bound to the project.

Returned by:

Sessions: Query sessions (POST /sessions/query), Get session state (GET /sessions/{session_id}), Revoke session (DELETE /sessions/{session_id})

`sess.project_mismatch`

The session belongs to a different project.

Returned by:

Sessions: Get my session state (GET /sessions/me), Revoke my session (DELETE /sessions/me), Get my session's CSRF token (GET /sessions/me/csrf)
Projects: List the projects I can act on (GET /users/me/projects)
Users: Get my user information (GET /users/me), Update my user information (PATCH /users/me), List the provider accounts linked to me (GET /users/me/identity_links), List my passkeys (GET /users/me/passkeys), Get my password state (GET /users/me/password), Get my user schema (GET /users/me/schema), List the teams I belong to (GET /users/me/teams)

`sess.token_creation_failed`

The session token could not be created.

Returned by:

Sessions: Create an anonymous session shell (POST /sessions), Exchange handoff token for a session (POST /sessions/exchange)

Teams: Create team (POST /teams), Update team (PATCH /teams/{team_id})

`team.name_invalid`

The team name is invalid. Expected a non-empty string of at most 200 characters.

Returned by:

Teams: Create team (POST /teams), Update team (PATCH /teams/{team_id})

`team.owns_project`

The team still owns a project and cannot be deactivated while it does.

Returned by:

Teams: Delete team (DELETE /teams/{team_id})

`team.permission_denied`

The team management API requires the project secret.

Returned by:

Teams: Create team (POST /teams), Query teams (POST /teams/query), Get team (GET /teams/{team_id}), Update team (PATCH /teams/{team_id}), Delete team (DELETE /teams/{team_id})
Grants: Query grants (POST /grants/query), Get grant (GET /grants/{id})

`team.project_not_found`

Project not found.

Returned by:

Teams: Create team (POST /teams), Query teams (POST /teams/query), Update team (PATCH /teams/{team_id})

`team.team_not_found`

Team not found.

Returned by:

Teams: Create team (POST /teams), Query teams (POST /teams/query), Get team (GET /teams/{team_id}), Update team (PATCH /teams/{team_id}), Delete team (DELETE /teams/{team_id})

`tkn`

`tkn.invalid`

The token is not valid.

Returned by:

Flows: Start a new flow (POST /flow), Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Sessions: Create an anonymous session shell (POST /sessions), Exchange handoff token for a session (POST /sessions/exchange)
Variables: Update variables (PATCH /variables)
Projects: Create project (POST /projects)

`tkn.invalid_tknid`

Token identifiers do not match token type.

Returned by:

Flows: Start a new flow (POST /flow)
Sessions: Create an anonymous session shell (POST /sessions), Exchange handoff token for a session (POST /sessions/exchange)
Projects: Create project (POST /projects)

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Create user (POST /users), Update user by ID (PATCH /users/{user_id}), Update my user information (PATCH /users/me)

`user.attributes_invalid`

The user's attributes do not satisfy the user schema.

No operation's error set includes it.

`user.conflict`

The user was modified concurrently, retry the request.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Users: Update user by ID (PATCH /users/{user_id}), Set user password (PUT /users/{user_id}/password), Update my user information (PATCH /users/me)

`user.invalid`

User invalid.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Create user (POST /users), Update user by ID (PATCH /users/{user_id}), Begin passkey registration (POST /users/{user_id}/passkeys/registrations), Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id}), Set user password (PUT /users/{user_id}/password), Update my user information (PATCH /users/me)

`user.not_found`

User not found.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Create user (POST /users), Query users (POST /users/query), Get user by ID (GET /users/{user_id}), Update user by ID (PATCH /users/{user_id}), Delete user by ID (DELETE /users/{user_id}), List the provider accounts linked to a user (GET /users/{user_id}/identity_links), List user passkeys (GET /users/{user_id}/passkeys), Begin passkey registration (POST /users/{user_id}/passkeys/registrations), Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id}), Get user password state (GET /users/{user_id}/password), Set user password (PUT /users/{user_id}/password), List the teams a user belongs to (GET /users/{user_id}/teams), Get my user information (GET /users/me), Update my user information (PATCH /users/me), List the provider accounts linked to me (GET /users/me/identity_links), List my passkeys (GET /users/me/passkeys), Get my password state (GET /users/me/password), Get my user schema (GET /users/me/schema), List the teams I belong to (GET /users/me/teams)

`user.password_empty`

The password must not be empty.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id}), Set user password (PUT /users/{user_id}/password)

`user.password_invalid`

The password provided is invalid.

No operation's error set includes it.

`user.password_policy_violation`

The password does not meet the password policy.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id}), Set user password (PUT /users/{user_id}/password)

`user.password_too_long`

The password is too long for the project's password hashing method.

Returned by:

Flows: Get current step (re-render) (GET /flow/{id}), Submit step data and advance (POST /flow/{id}/submit)
Authentication attempts: Verify a factor proof (POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify)
Users: Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id}), Set user password (PUT /users/{user_id}/password)

`user.permission_denied`

The user management API requires the project secret.

Returned by:

Users: Create user (POST /users), Query users (POST /users/query), Get user by ID (GET /users/{user_id}), Update user by ID (PATCH /users/{user_id}), Delete user by ID (DELETE /users/{user_id}), List the provider accounts linked to a user (GET /users/{user_id}/identity_links), List user passkeys (GET /users/{user_id}/passkeys), Begin passkey registration (POST /users/{user_id}/passkeys/registrations), Finish passkey registration (POST /users/{user_id}/passkeys/registrations/{registration_id}), Get user password state (GET /users/{user_id}/password), Set user password (PUT /users/{user_id}/password), List the teams a user belongs to (GET /users/{user_id}/teams)
Grants: Query grants (POST /grants/query), Get grant (GET /grants/{id})

Deployments: Create a deployment (POST /deployments), Roll back to a deployment (POST /deployments/{deployment_id}/rollback)

`var.expansion_too_large`

Variable: substitution exceeds the expansion budget.

No operation's error set includes it.

`var.invalid_name`

The name of the variable is invalid.

Returned by:

Variables: Update variables (PATCH /variables)

`var.invalid_value`

The value of the variable is invalid.

Returned by:

Variables: Update variables (PATCH /variables)

`var.limit_exceeded`

The variables of this kind would not fit in one deployment.

Returned by:

Variables: Update variables (PATCH /variables)

`var.no_project_id`

A variable must be owned by a project.

Returned by:

Variables: Update variables (PATCH /variables)

`var.not_found`

Variable: not found.

Returned by:

Variables: Get variables (GET /variables), Update variables (PATCH /variables), Get a variable (GET /variables/{variable_name}), Delete a variable (DELETE /variables/{variable_name})
Deployments: Get a deployment's variables (GET /deployments/{deployment_id}/variables)

`var.permission_denied`

Variable: permission denied.

Returned by:

Variables: Get variables (GET /variables), Update variables (PATCH /variables), Get a variable (GET /variables/{variable_name}), Delete a variable (DELETE /variables/{variable_name})
Deployments: Get a deployment's variables (GET /deployments/{deployment_id}/variables)

`var.secret_not_whole_value`

Variable: a secret can only be referenced as an entire value.

No operation's error set includes it.

Errors

Too many requestsCopy Anchor Link

Without a namespaceCopy Anchor Link

internalCopy Anchor Link

not_implementedCopy Anchor Link

unavailableCopy Anchor Link

attCopy Anchor Link

att.already_completedCopy Anchor Link

att.already_handed_offCopy Anchor Link

att.invalid_proofCopy Anchor Link

att.invalid_requestCopy Anchor Link

att.invalid_stateCopy Anchor Link

att.not_completedCopy Anchor Link

att.not_foundCopy Anchor Link

att.proof_rejectedCopy Anchor Link

att.sso_state_invalidCopy Anchor Link

att.stale_challengeCopy Anchor Link

authCopy Anchor Link

auth.csrf_invalidCopy Anchor Link

auth.unauthorizedCopy Anchor Link

brndCopy Anchor Link

brnd.invalidCopy Anchor Link

brnd.missing_project_idCopy Anchor Link

brnd.not_foundCopy Anchor Link

brnd.permission_deniedCopy Anchor Link

claimCopy Anchor Link

claim.no_personal_teamCopy Anchor Link

claim.personal_team_not_activeCopy Anchor Link

claim.session_expiredCopy Anchor Link

claim.session_not_activeCopy Anchor Link

claim.session_wrong_projectCopy Anchor Link

claim_challengeCopy Anchor Link

claim_challenge.invalidCopy Anchor Link

claim_challenge.not_foundCopy Anchor Link

depCopy Anchor Link

dep.conflictCopy Anchor Link

dep.invalidCopy Anchor Link

dep.not_foundCopy Anchor Link

dep.permission_deniedCopy Anchor Link

dep.variables_missingCopy Anchor Link

enc_keyCopy Anchor Link

enc_key.decrypt_failedCopy Anchor Link

enc_key.encrypt_failedCopy Anchor Link

enc_key.no_replacement_keyCopy Anchor Link

enc_key.not_foundCopy Anchor Link

enc_key.unknown_algCopy Anchor Link

envCopy Anchor Link

env.not_foundCopy Anchor Link

env.project_not_foundCopy Anchor Link

evtCopy Anchor Link

evt.invalidCopy Anchor Link

evt.not_foundCopy Anchor Link

evt.permission_deniedCopy Anchor Link

flowCopy Anchor Link

flow.completedCopy Anchor Link

flow.cookie_expiredCopy Anchor Link

flow.cookie_invalidCopy Anchor Link

flow.integrityCopy Anchor Link

flow.invalid_actionCopy Anchor Link

flow.invalid_purposeCopy Anchor Link

flow.not_foundCopy Anchor Link

flow.restart_requiredCopy Anchor Link

flow.session_conflictCopy Anchor Link

flow.sso_unavailableCopy Anchor Link

flow.unsupportedCopy Anchor Link

flowdefCopy Anchor Link

flowdef.invalidCopy Anchor Link

flowdef.missing_idCopy Anchor Link

flowdef.missing_project_idCopy Anchor Link

flowdef.not_foundCopy Anchor Link

flowdef.permission_deniedCopy Anchor Link

flowdef.purpose_mismatchCopy Anchor Link

flowdef.revision_conflictCopy Anchor Link

flowdef.schema_fetch_failedCopy Anchor Link

grantCopy Anchor Link

grant.already_existsCopy Anchor Link

grant.invalidCopy Anchor Link

grant.not_foundCopy Anchor Link

grant.permission_deniedCopy Anchor Link

grant.principal_not_foundCopy Anchor Link

Too many requests

Without a namespace

`internal`

`not_implemented`

`unavailable`

`att`

`att.already_completed`

`att.already_handed_off`

`att.invalid_proof`

`att.invalid_request`

`att.invalid_state`

`att.not_completed`

`att.not_found`

`att.proof_rejected`

`att.sso_state_invalid`

`att.stale_challenge`

`auth`

`auth.csrf_invalid`

`auth.unauthorized`

`brnd`

`brnd.invalid`

`brnd.missing_project_id`

`brnd.not_found`

`brnd.permission_denied`

`claim`

`claim.no_personal_team`

`claim.personal_team_not_active`

`claim.session_expired`

`claim.session_not_active`

`claim.session_wrong_project`

`claim_challenge`

`claim_challenge.invalid`

`claim_challenge.not_found`

`dep`

`dep.conflict`

`dep.invalid`

`dep.not_found`

`dep.permission_denied`

`dep.variables_missing`

`enc_key`

`enc_key.decrypt_failed`

`enc_key.encrypt_failed`

`enc_key.no_replacement_key`

`enc_key.not_found`

`enc_key.unknown_alg`

`env`

`env.not_found`

`env.project_not_found`

`evt`

`evt.invalid`

`evt.not_found`

`evt.permission_denied`

`flow`

`flow.completed`

`flow.cookie_expired`

`flow.cookie_invalid`

`flow.integrity`

`flow.invalid_action`

`flow.invalid_purpose`

`flow.not_found`

`flow.restart_required`

`flow.session_conflict`

`flow.sso_unavailable`

`flow.unsupported`

`flowdef`

`flowdef.invalid`

`flowdef.missing_id`

`flowdef.missing_project_id`

`flowdef.not_found`

`flowdef.permission_denied`

`flowdef.purpose_mismatch`

`flowdef.revision_conflict`

`flowdef.schema_fetch_failed`

`grant`

`grant.already_exists`

`grant.invalid`

`grant.not_found`

`grant.permission_denied`

`grant.principal_not_found`

`idp`