DocsReference
#Error taxonomy
Every problem slug the harness can emit, generated by scanning every ProblemDef in the workspace's crates — core's registry and the modules' own — with cargo run -p cratefield-core --example errors-doc, and checked in CI for drift and for slugs defined twice: each slug is defined exactly once, and a module's slugs are emitted only where that module is mounted. Responses are RFC 9457 application/problem+json with instance = the request id, and type = <public_url>/problems/<slug>: the serving venture's own base, from its Venture::public_url (Venture::problem_base overrides it), so every venture names its problems under its own domain. A venture with no public URL — and any problem rendered outside a venture's context — carries the RFC 9457 §4.2.1 default about:blank instead of a URI that would name the wrong venture. The slug is the stable part to match on; a venture may also serve a human-readable page at each <public_url>/problems/<slug>.
| Slug | Status | Title | Crate | Description |
|---|---|---|---|---|
admin-forbidden | 403 | Admin token rejected | cratefield-core | The presented admin token is wrong. |
admin-unauthorized | 401 | Admin access unauthorized | cratefield-core | Admin endpoints are disabled or the request has no bearer token. |
already-exists | 409 | That key is taken | cratefield-tables-api | A row of this table already has that primary key. |
api-key-forbidden | 403 | API key lacks the required scope | cratefield-core | The presented API key is valid but does not carry the scope this route requires. |
api-key-unauthorized | 401 | API key unauthorized | cratefield-core | The request's API key was missing, malformed, unknown, revoked or invalid; one uniform answer for all five. |
auth/client-disabled | 403 | Client is disabled | cratefield-auth-core | A disabled client is refused by every flow |
auth/cross-site-request | 403 | A same-origin request is required | cratefield-auth-core | Fetch metadata or the origin header reports another site; a request that can change state is accepted only from this venture's own origin |
auth/email-token-refused | 400 | That link is no longer valid | cratefield-auth-core | Missing, expired, already used, never issued, or the address is now taken |
auth/import-too-large | 413 | Too many users to import | cratefield-auth-core | An import may carry at most 1000 users in one request; nothing was written. |
auth/last-login-method | 409 | That is the account's only login method | cratefield-auth-passkeys | Add another passkey or link a provider before removing this one |
auth/magic-link-not-ready | 503 | Email sign-in is not available | cratefield-auth-magic-link | The module is missing a port it requires |
auth/magic-link-refused | 400 | That sign-in link is no longer valid | cratefield-auth-magic-link | Missing, expired, already used, or never issued |
auth/meta-callback-refused | 400 | That sign-in link is no longer valid | cratefield-auth-meta | Missing, expired, replayed or mismatched authorization state |
auth/meta-not-configured | 503 | Facebook sign-in is not configured | cratefield-auth-meta | AUTH_META_CLIENT_ID and AUTH_META_CLIENT_SECRET must both be set |
auth/meta-unavailable | 502 | Facebook could not be reached | cratefield-auth-meta | The token exchange or the profile call failed; the detail is in the logs |
auth/oidc-callback-refused | 400 | That sign-in link is no longer valid | cratefield-auth-oidc | Missing, expired, replayed or mismatched authorization state |
auth/oidc-provider-unavailable | 502 | The sign-in provider could not be reached | cratefield-auth-oidc | Discovery, the token exchange or the ID token failed; the detail is in the logs |
auth/oidc-provider-unconfigured | 503 | That sign-in provider is not configured | cratefield-auth-oidc | The provider's AUTH_OIDC_<PROVIDER>_* settings are missing or unusable |
auth/passkey-already-registered | 409 | That authenticator is already registered | cratefield-auth-passkeys | The credential id is already stored for an account |
auth/passkey-ceremony-failed | 401 | The passkey ceremony could not be completed | cratefield-auth-passkeys | Unknown credential, spent or expired challenge, wrong origin, or a signature that does not verify — not distinguished |
auth/passkey-prf-output-rejected | 400 | The passkey presented a PRF result | cratefield-auth-passkeys | clientExtensionResults.prf.results is never accepted; send prf: { enabled } instead |
auth/passkeys-unconfigured | 503 | Passkeys are not configured | cratefield-auth-passkeys | AUTH_PASSKEYS_RP_ID and AUTH_PASSKEYS_ORIGINS must be set |
auth/password-login-refused | 401 | That email address and password do not match | cratefield-auth-password | Wrong password, unknown address, or the account cannot sign in this way |
auth/password-not-ready | 503 | Password sign-in is not available | cratefield-auth-password | The module is missing a port it requires |
auth/password-token-refused | 400 | That link is no longer valid | cratefield-auth-password | Missing, expired, already used, or never issued |
auth/password-unsuitable | 400 | That password cannot be used | cratefield-auth-password | Too short, too long, or found in a public breach corpus |
auth/reauthentication-required | 403 | Sign in again to change this | cratefield-auth-core | The session is too old and the password does not match, not distinguished |
auth/session-invalid | 401 | A valid session is required | cratefield-auth-core | Missing, unknown, revoked or expired session — not distinguished |
auth/sso-domain-claimed | 409 | That email domain is already in use | cratefield-auth-core | An email domain routes to at most one active SSO connection per client |
auth/sso-unauthorized | 401 | That SSO request is not authorized | cratefield-auth-core | The admin API takes HTTP Basic with a confidential client's id and secret |
auth/sso-unconfigured | 503 | SSO connections are not configured on this deployment | cratefield-auth-core | AUTH_CORE_SSO_TOKEN_KEY is missing or unusable |
auth/token-request-refused | 400 | Token request refused | cratefield-auth-core | Unknown client, wrong secret, or an invalid grant — deliberately not distinguished |
auth/tokens-unconfigured | 503 | Token issuing is not configured | cratefield-auth-core | Signing keys are absent; no token can be minted or published |
bad-cursor | 400 | Not a cursor for this table | cratefield-tables-api | The after parameter is not the next value from a previous page of this table. |
bad-filter | 400 | Not a filter for this table | cratefield-tables-api | A query parameter names a column the table does not declare, or a value that is not that column's kind. |
bad-key | 400 | Not a key for this table | cratefield-tables-api | The path segment is not a value of the table's primary-key column. |
bad-sort | 400 | Not a sort for this table | cratefield-tables-api | The sort parameter names a column the table does not declare, or one whose nulls the engines order differently. |
captcha-failed | 400 | Captcha verification failed | cratefield-core | The captcha token was missing or rejected; retry the challenge. |
changelog-source-not-found | 404 | No such source | cratefield-module-changelog | The configured repository has no releases, or does not exist. Check CHANGELOG_REPO. |
changelog-upstream | 502 | The source could not be fetched | cratefield-module-changelog | The upstream source failed; nothing stored was changed. The detail carries what upstream answered. |
composite-key | 400 | A composite key does not fit in one path segment | cratefield-tables-api | The table's primary key is more than one column, so /{table}/{key} cannot name a row; name the key in the query at /{table}/__by?<column>=<value> instead. |
connections-bad-state | 400 | That connection link is no longer valid | cratefield-module-connections | The connect state was never issued, has already been used, or has expired. Start the connection again. |
connections-not-found | 404 | No such connection | cratefield-module-connections | No connection the venture holds has that id. |
connections-oauth-denied | 400 | The provider did not grant access | cratefield-module-connections | The provider sent the browser back with an error instead of a code, so no connection was stored. |
connections-reconnect-required | 409 | This connection needs to be reconnected | cratefield-module-connections | The provider rejected the stored refresh token, so the person must authorize the connection again before an access token can be issued. |
connections-revoked | 409 | This connection was revoked | cratefield-module-connections | The connection was revoked and its tokens were cleared, so there is nothing left to use or refresh. |
connections-unknown-provider | 404 | Unknown provider | cratefield-module-connections | The callback names a provider key the venture has not configured, so there is no client to exchange the code with. |
connections-upstream | 502 | The provider could not complete the connection | cratefield-module-connections | Talking to the provider's token endpoint failed, or it answered with a body that is not a token response. |
crm-already-exists | 409 | That value is already taken | cratefield-module-crm | A contact's normalized email address and an organisation's domain are each unique. Another row already holds the value you tried to set, so nothing was changed: use a different value, or merge the two records. |
crm-stale-generation | 409 | The record has changed since you read it | cratefield-module-crm | The generation in the body is not the one the row holds now, so somebody else wrote to it in between. Nothing was changed: read the record again, reapply your edit to the current values and retry with the new generation. |
device-auth/approver-required | 401 | Sign in to approve a device | cratefield-module-device-auth | The device page is served only to a signed-in person; no subject was identified. |
device-auth/cross-site-request | 403 | A same-origin request is required | cratefield-module-device-auth | The approval form accepts only a request a browser reports as coming from this venture's own origin. |
device-auth/too-many-attempts | 429 | Too many attempts | cratefield-module-device-auth | One approver has entered wrong user codes more often than the configured allowance. |
device-auth/unknown-user-code | 404 | Unknown or expired code | cratefield-module-device-auth | No pending, unexpired device request carries that user code. |
device-rehome-limit | 429 | Too many devices taken over | cratefield-module-notifications | This account has claimed too many devices that belonged to other accounts. |
internal | 500 | Internal error | cratefield-core | Unhandled error; no internals are exposed in the body. |
invalid-token | 400 | Invalid or expired token | cratefield-core | A signed link or token is malformed, tampered with, or expired. |
linkedin-fact-check-failed | 422 | The commentary does not keep the facts of its source | fz-module-linkedin | A protected span of the source (name, number, quote, code, link, hashtag or mention) is missing or altered in the commentary, or the commentary introduced a number. missing and introduced list each one. |
linkedin-not-connected | 409 | No LinkedIn account connected | fz-module-linkedin | Connect a page first: POST /v1/linkedin/admin/connect. |
linkedin-page-role-missing | 403 | The connected account cannot post to this page | fz-module-linkedin | The page is unknown, revoked, or held with a role that cannot publish organic posts. |
linkedin-reconnect-required | 409 | LinkedIn connection needs renewing | fz-module-linkedin | LinkedIn rejected the stored credentials. A page administrator must connect again. |
linkedin-upstream | 502 | LinkedIn rejected the request | fz-module-linkedin | LinkedIn answered with an error. The detail carries its code. |
mail-not-configured | 503 | Mail is not configured | cratefield-core | No sending domain is verified; use the direct address shown by the form. |
no-membership-fact | 500 | Tenant membership cannot be checked | cratefield-tables-api | This table admits members of the tenant, and on a deployment that resolves tenants from a registry there is no membership fact to check. |
no-reads | 400 | A batch with no reads | cratefield-tables-api | A batch names at least one read; an empty one is a request with no question. |
no-such-row | 404 | No such row | cratefield-tables-api | No row of this table has that key. |
no-such-table | 404 | No such table | cratefield-tables-api | This venture declares no table by that name. |
no-verifier | 500 | Cannot identify the caller | cratefield-tables-api | This table is not public and the deployment wired no way to verify a caller. |
not-a-key-column | 400 | Not a key column for this table | cratefield-tables-api | A __by query names primary-key columns only. To narrow by any other column, read the page and filter it. |
not-a-row | 422 | Not a row of this table | cratefield-tables-api | The body does not match the table's declared columns. |
not-found | 404 | Not found | cratefield-core | No route matched the request. |
not-production-ready | 503 | Not ready for production traffic | cratefield-core | This deployment declares production but cannot satisfy the abuse controls its routes declare. |
not-ready | 503 | Service not ready | cratefield-core | Readiness probe failed: the database is missing, erroring or too slow. |
not-yours-to-give | 403 | That row would not be yours | cratefield-tables-api | The subject column names a different caller; a row written here is your own. |
orgs-already-member | 409 | Already a member | cratefield-module-orgs | That account already belongs to this organization. |
orgs-email-unverified | 403 | Your email address is not verified | cratefield-module-orgs | Accepting an invitation matches the caller's verified address against the one invited, and the credential this request carried proved none. |
orgs-forbidden | 403 | Your role does not allow this | cratefield-module-orgs | The caller's role in this organization does not permit the change they asked for — only owners, and the manager roles the venture named, may manage members and invitations, and only an owner may grant or change the owner role. |
orgs-invalid-email | 422 | That is not an email address | cratefield-module-orgs | The address to invite could not be normalized and validated as one. |
orgs-invalid-name | 422 | An organization needs a name | cratefield-module-orgs | The name was empty or whitespace only. |
orgs-invitation-for-someone-else | 403 | That invitation is for another address | cratefield-module-orgs | The signed-in account's verified address is not the one the invitation was sent to. The invitation has not been spent. |
orgs-invitation-gone | 410 | That invitation is no longer valid | cratefield-module-orgs | The invitation token is unknown, has lapsed, or has already been accepted. An invitation is single-use, so a second acceptance is refused. |
orgs-last-owner | 409 | An organization keeps an owner | cratefield-module-orgs | This is the organization's only owner, so it cannot be removed or demoted. Grant the owner role to somebody else first. |
orgs-mail-failed | 502 | The invitation could not be sent | cratefield-module-orgs | The mailing provider refused the invitation message, so no invitation was created. Nothing is left behind to accept; try again. |
orgs-not-found | 404 | No such organization | cratefield-module-orgs | No organization the caller is a member of carries that id. An organization the caller is not in answers the same way, so its existence is not disclosed. |
orgs-unknown-role | 422 | Unknown role | cratefield-module-orgs | The role is not one of the roles this venture configured for its organizations. The configured set is fixed at build. |
owlpost-unverified | 401 | Unverified delivery | cratefield-module-owlpost | The request carried no signature this deployment could verify, or one that did not hold. |
partial-key | 400 | The key is not complete | cratefield-tables-api | Name every primary-key column of the table once: a row is addressed by its whole key. after and sort are the page's parameters on this route and cannot name a key column, so a table whose key uses one of those names has no address here. |
privacy-provider-unverified | 401 | Unverified provider call | cratefield-module-privacy | The request carried no signature this deployment could verify, or one that did not hold. |
rate-limited | 429 | Rate limit exceeded | cratefield-core | Too many requests from this IP or address; retry after the pause. |
request-too-large | 413 | Request body too large | cratefield-core | The request body exceeded the 64 KiB limit for /v1 endpoints. |
sealed-already-exists | 409 | That blob id is already stored | cratefield-module-sealed | The client generated this blob id, and a record under it already exists for this subject. Nothing was changed. |
sealed-not-found | 404 | No such blob | cratefield-module-sealed | No blob the caller holds carries that id. A blob held by someone else answers the same way, so its existence is not disclosed. |
sealed-precondition-failed | 412 | The record has changed since you read it | cratefield-module-sealed | The If-Match revision is not the one the row holds now, so somebody else wrote to it in between. Read the record again, reapply your edit and retry with the fresh ETag. |
sealed-precondition-required | 428 | An If-Match header is required | cratefield-module-sealed | Read the record first and send its ETag back as If-Match; a write without one is refused rather than applied blind. |
sidecar-contract-mismatch | 503 | Sidecar contract mismatch | cratefield-core | A sidecar answers a different HARNESS_API than this harness speaks. |
sidecar-unauthorized | 401 | Unauthorized sidecar caller | cratefield-core | A request to a sidecar-guarded route could not be established as coming from the trusted gateway. |
sidecar-unavailable | 503 | Sidecar module unavailable | cratefield-core | A sidecar-mounted module could not be reached; other modules are unaffected. |
table-forbidden | 403 | Not yours to reach | cratefield-tables-api | The table's declared access level does not admit this caller. |
table-misdeclared | 500 | Table declaration cannot be enforced | cratefield-tables-api | The table declares owner access without a subject column to match a caller against. |
table-read-only | 403 | Not writable | cratefield-tables-api | This table's declared access is public-read: it is served, never written. |
telegram/action-not-confirmable | 409 | Action cannot be confirmed | cratefield-module-telegram | The action is not awaiting passkey confirmation, or it has expired, or it was already confirmed. |
telegram/action-not-yours | 403 | Not your action | cratefield-module-telegram | Actions are confirmed by the account they were requested for. |
telegram/no-such-action | 404 | No such action | cratefield-module-telegram | No action with that id exists. |
telegram/passkey-required | 403 | Passkey confirmation required | cratefield-module-telegram | Approving a value-moving action needs a fresh passkey ceremony, and this request did not carry one this deployment could verify. |
telegram/unauthenticated | 401 | Sign in first | cratefield-module-telegram | This route is available only to a signed-in user. |
telegram/unverified | 401 | Unverified delivery | cratefield-module-telegram | The delivery carried no secret token this deployment could verify, or one that did not hold. |
telemetry-payload-rejected | 400 | Telemetry payload rejected | cratefield-module-telemetry | The batch carries a value outside the closed grammar the notice route publishes. |
telemetry-schema-unsupported | 400 | Telemetry schema not supported | cratefield-module-telemetry | The batch names a payload schema version this collector does not parse. |
tenant-degraded | 503 | Tenant is degraded | cratefield-core | The tenant's schema is behind or its database is unreachable; its neighbours are unaffected. |
too-many-reads | 400 | Too many reads in one batch | cratefield-tables-api | A batch carries at most 20 reads; send the rest as another batch. |
unauthenticated | 401 | Not authenticated | cratefield-core | A credential was presented and did not verify, or none was presented where one is required. |
unknown-category | 400 | Unknown notification category | cratefield-module-notifications | The named category is not declared by this venture. |
unknown-product | 400 | Unknown product | cratefield-core | The named product is not on this waitlist. |
unknown-tenant | 404 | Unknown tenant | cratefield-core | The request's host resolves to no tenant in the registry. |
usage/allowance-exhausted | 429 | Usage allowance exhausted | cratefield-core | The subject's metered allowance is spent for the current period; retry after the period resets. |
validation-failed | 400 | Request validation failed | cratefield-core | The request body or query did not deserialize into a valid request. |
verifier-unavailable | 503 | Cannot check the credential | cratefield-tables-api | The service that verifies credentials could not answer. Try again shortly. |
wallets/address-already-linked | 409 | Wallet already linked | cratefield-module-wallets | This wallet is already linked to a different account. |
wallets/chain-mismatch | 400 | Chain mismatch | cratefield-module-wallets | The chain in the message is not the chain this request, and this service, are for. |
wallets/domain-mismatch | 400 | Domain mismatch | cratefield-module-wallets | The domain in the sign-in message does not match this service's domain. |
wallets/invalid-message | 400 | Invalid sign-in message | cratefield-module-wallets | The message could not be parsed as a SIWE or SIWS sign-in message. |
wallets/message-expired | 400 | Message expired or not yet valid | cratefield-module-wallets | The message's expiration time has passed or its not-before time is in the future. |
wallets/nonce-invalid | 400 | Invalid or expired nonce | cratefield-module-wallets | The nonce is unknown, already used, issued to another account, or expired. |
wallets/not-found | 404 | No such wallet link | cratefield-module-wallets | No wallet link with that id belongs to your account. |
wallets/signature-invalid | 400 | Signature verification failed | cratefield-module-wallets | The signature does not prove ownership of the address in the message. |
wallets/unauthenticated | 401 | Sign in to manage wallets | cratefield-module-wallets | These routes are available only to a signed-in user. |
webhook-unverified | 401 | Unverified webhook delivery | cratefield-module-notifications | The delivery did not carry a signature this deployment could verify. |
webpush-not-configured | 404 | Browser push is not configured | cratefield-module-notifications | This venture serves no Web Push application server key. |
Mirrored from docs/ERRORS.md at b6f50cd. The harness is the source of truth: a correction goes there first.