Access Manager error list

Auth errors

The following errors can occur when interacting with the Auth APIs endpoints. Error format Auth returns errors in two formats. The format depends on the endpoint. Request an access token, Discover how an email signs in, and Start an SSO login return this format:

{
   "code": "<error_code>",
   "title": "<error_title>",
   "message": "<error_message>"
}

A body validation error can also have a fields object. The other Auth endpoints return errors as RFC 9457 problem details with the application/problem+json media type:

type – https://errors.lerian.studio/v1/ followed by the error code.
title – The HTTP status name. It is not the title in the tables below.
status – The HTTP status code.
detail – The message in the tables below. For 500 and 503 errors, the value is internal error.
instance – The trace ID of the request, when the request has one.
code – The error code in the tables below.
errors – The field validation details, when there are any.

When the request body does not match the endpoint schema, the error has no code and no type. A request that Auth refuses before it reaches the endpoint, such as a rate-limited request, can use a different format.

400

Code	Title	Message
AUT-0001	Missing Fields in Request	Your request is missing one or more required fields. Please refer to the documentation to ensure all necessary fields are included in your request.
AUT-0003	Unexpected Fields in the Request	The request body contains more fields than expected. Please send only the allowed fields as per the documentation. The unexpected fields are listed in the fields object.
AUT-0009	Bad Request	The server could not understand the request due to malformed syntax. Please check the listed fields and try again.
AUT-0013	Invalid Grant Type	The provided ‘grantType’ `[{value}]` is not valid. Accepted grant types are password, client_credentials, refresh_token, or others. Please provide a valid type.
AUT-0014	Grant Type Missing Fields	The provided ‘grant_type’ `[{value}]` is missing required fields. Please refer to the documentation for guidance.
AUT-0022	Missing SSO Parameters	The SSO request is missing the required ‘email’, ‘provider’, or ‘code_challenge’ parameter. Please include all three and try again.
AUT-0027	Invalid SSO Code	The SSO code is invalid, expired, or has already been used. Please restart the SSO login.
AUT-1001	Unsupported Grant Type	The provided ‘grantType’ is not supported by this application. Please refer to the application’s supported grant types.

401

Code	Title	Message
AUT-0006	Token Missing	A valid token must be provided in the request header. Please include a token and try again.
AUT-0007	Invalid Token	The provided token is expired, invalid or malformed. Please provide a valid token and try again.
AUT-0016	Invalid MFA Code	The provided MFA verification code is incorrect. Please check the code and try again.
AUT-0017	MFA Session Expired	The MFA session has expired. Please initiate a new login to receive a fresh MFA challenge.
AUT-0020	Invalid MFA Token	The provided MFA token is invalid, expired or malformed. Please initiate a new login.
AUT-0026	SSO Login Failed	The SSO login could not be completed. Please restart the SSO login and try again.
AUT-0029	Invalid Recovery Code	The provided recovery code is not valid or has already been used. Please try one of your other recovery codes.
AUT-1002	Invalid Username or Password	The provided ‘username’ or ‘password’ is incorrect. Please verify the credentials and try again.
AUT-1003	Invalid Token	The provided token is expired, invalid or malformed. Please provide a valid token and try again.
AUT-1004	Invalid Client	The provided ‘clientId’ or ‘clientSecret’ is incorrect. Please verify the credentials and try again.
AUT-1005	Invalid Refresh Token	The provided ‘refreshToken’ is invalid, expired or revoked. Please verify the token and try again.
AUT-1006	Password Login Unavailable	This account was created through single sign-on and has no password. Please sign in with SSO, or use the ‘forgot password’ flow to set a password and try again.
AUT-1009	Partner Suspended	The partner this credential belongs to is suspended, so no token can be issued for it. The credential itself is unchanged and starts working again if the partner is reactivated.
AUT-1010	Partner Outside Its Validity Window	The partner this credential belongs to is outside its validity window, so no token can be issued for it. Ask the administrator who created it to extend the window.
AUT-1011	Application Not Found	The application this token was issued to no longer exists, so the token can no longer be honoured. Retrying will not help; ask an administrator for a new credential.
AUT-1012	Partner Not Found	The partner this credential belongs to no longer exists, so the credential can no longer be honoured. Retrying will not help; ask an administrator for a new credential.

403

Code	Title	Message
AUT-0021	IP Not Allowed	Access from your network is not allowed for this workspace. Contact your administrator.
AUT-1008	Sign-In Not Allowed	This account is not allowed to sign in. Please contact your administrator.

404

Code	Title	Message
AUT-0024	SSO Provider Not Found	The requested SSO provider was not found. Please check the provider name and try again.
AUT-1015	Enforcement Sub Not Found	No subject was found for the provided ‘sub’. Please refer to the enforcement documentation for guidance on the correct ‘sub’ value.

429

Code	Title	Message
AUT-0018	Too Many Requests	Too many failed MFA verification attempts. Please wait and try again later.
AUT-0030	Too Many Requests	Too many verification codes have been requested for this session. Please wait and try again later.
AUT-1007	Too Many Requests	Too many failed sign-in attempts. Please wait and try again later.

500

Code	Title	Message
AUT-0005	Internal Server Error	The server encountered an unexpected error. Please try again later or contact support.

503

Code	Title	Message
AUT-0028	MFA Secret Not Set	The MFA secret is not set on this server, so multi-factor authentication is unavailable. Please contact your administrator.
AUT-0031	Verification Temporarily Unavailable	Multi-factor authentication is temporarily unavailable. Please wait a moment and try again.
AUT-0032	Verification Code Not Sent	The verification code could not be sent. Please try again, or choose another verification method.
AUT-0033	Authorization Server Unavailable	The authorization server could not be reached to decide this request. Please wait a moment and try again.

Identity errors

The following errors can occur when interacting with the Identity APIs endpoints.

400

`code`	`title`	`message`
IDE-0001	Missing Fields in Request	Your request is missing one or more required fields. Please refer to the documentation to ensure all necessary fields are included in your request.
IDE-0002	Invalid Field Type	One or more fields in the request body have an invalid type. Verify the field types against the API documentation and try again.
IDE-0003	Invalid Path Parameter	One or more path parameters are in an incorrect format. Please check the following parameters `[{value}]` and ensure they meet the required format before trying again.
IDE-0004	Unexpected Fields in the Request	The request body contains more fields than expected. Please send only the allowed fields as per the documentation. The unexpected fields are listed in the fields object.
IDE-0005	Invalid Query Parameter	One or more query parameters are in an incorrect format. Please check the following parameters `'[{value}]'` and ensure they meet the required format before trying again.
IDE-0007	Bad Request	The server could not understand the request due to malformed JSON syntax.
IDE-0012	Invalid Application Name	The application name provided is not part of the managed applications allowlist, so it cannot be created or deleted. Supported values: `{value}`.
IDE-0018	Pagination Limit Exceeded	The pagination limit exceeds the maximum allowed of `{value}` items per page. Please verify the limit and try again.
IDE-0019	Invalid Page	Query parameter page is invalid. The page must be greater than 0.
IDE-0020	Password Too Short	The password must be at least 12 characters long.
IDE-0021	Password No Uppercase	The password must contain at least one uppercase letter.
IDE-0022	Password No Lowercase	The password must contain at least one lowercase letter.
IDE-0023	Password No Digit	The password must contain at least one digit.
IDE-0024	Password No Special Char	The password must contain at least one special character.
IDE-0025	Password Consecutive Repeated	The password must not contain consecutive repeated characters.
IDE-0027	Old Password Invalid	The old password provided is invalid.
IDE-0028	Password Same As Old	The new password must be different from the current password.
IDE-0030	Username Empty	The username cannot be empty.
IDE-0031	Username Too Short	The username must be at least 2 characters long.
IDE-0032	Username Too Long	The username must not exceed 255 characters.
IDE-0033	Username Invalid Character	The username can only contain letters, numbers, hyphens, and underscores.
IDE-0034	Email Domain Mismatch	The user’s email domain does not match the tenant’s domain. Please use an email address within the tenant’s domain and try again.
IDE-0035	IP Allowlist Too Large	The IP allowlist is too large: the combined, comma-separated entries must not exceed `{value}` characters. Please remove some entries and try again.
IDE-0036	Invalid IP Allowlist Entry	The IP allowlist entry `{value}` is not a valid IP address or CIDR block. Please correct it and try again.
IDE-0037	Invalid IP Allowlist Scope	The IP allowlist enforcement scope `{value}` is not supported. Please use console, api, or both, and try again.
IDE-0038	IP Allowlist Entry Too Broad	The IP allowlist entry `{value}` covers too wide a range to restrict access. Please use a prefix of at least `/{value}` and try again.
IDE-0041	MFA Not Enabled	Multi-factor authentication is not enabled for this account.
IDE-0042	Invalid MFA Passcode	The code entered is incorrect. Please try again.
IDE-0043	MFA Setup Not Initiated	MFA setup has not been initiated. Please start the setup process first.
IDE-0044	Invalid MFA Type	The provided MFA type is invalid. Allowed types are: `{value}`.
IDE-0045	MFA Operation Failed	The MFA operation could not be completed. Please try again.
IDE-0046	MFA Verification Failed	MFA verification failed. Please check the passcode and try again.
IDE-0047	MFA Secret Required	The secret field is required for TOTP (app) MFA type. Please provide the secret returned from the setup step.
IDE-0048	MFA Destination Not Configured	There is no `{value}` on file for this account. Add one to the profile first.
IDE-0049	MFA Method Not Enabled	The `{value}` verification method is not enabled for this account.
IDE-0051	MFA Setup Not Verified	MFA setup has been initiated but not yet verified. Please complete the verify step before enabling.
IDE-0052	MFA Secret Mismatch	The provided MFA secret does not match the secret issued during setup. Restart the setup flow and use the latest secret.
IDE-0053	MFA Recovery Code Mismatch	The provided recovery code does not belong to this MFA setup. Use one of the recovery codes returned by the setup step.
IDE-0054	MFA Recovery Codes Replace Uncertain	The recovery-code regeneration could not be confirmed, and your previous recovery codes may already have been invalidated. Retry the regeneration: it is safe to repeat and will issue a new set of codes.
IDE-0055	MFA App Enrollment Forbidden	MFA app enrollment cannot be enabled by an administrator on behalf of another user
IDE-0058	Password Reset Rejected	The password reset could not be completed. Request a new code and try again.
IDE-0059	Pagination Page Exceeded	The requested page exceeds the maximum allowed of `{value}`. Please verify the page and try again.
IDE-0060	MFA Disable Confirmation Required	There is no active confirmation code: it has expired, has already been used, or was never sent. Request a new code and enter it before it expires.
IDE-0061	MFA Disable Confirmation Attempts Exceeded	The confirmation code was entered incorrectly too many times and can no longer be used. Request a new code to continue.
IDE-0062	MFA Disable Confirmation Resend Limit Reached	Too many confirmation codes have been requested. Wait a while before requesting another one.
IDE-0063	MFA Verification Temporarily Locked	Too many incorrect codes have been entered, so verification is temporarily blocked. Close this and come back later.
IDE-1009	Invalid Provider Type	The provider type is not valid for the specified category. Please check the supported types and try again.
IDE-1010	Invalid Provider Category	Only Email, SMS and OAuth provider categories are supported. Please specify a valid category.
IDE-1014	Missing Issuer URL	A Custom OAuth provider requires issuerUrl for OIDC discovery, or all of customAuthUrl, customTokenUrl and customUserInfoUrl explicitly. Please provide the issuer URL and try again.
IDE-1015	OIDC Discovery Failed	OIDC discovery from the issuer URL failed: the issuer must be a reachable http(s) endpoint that serves a .well-known/openid-configuration document exposing the authorization, token and userinfo endpoints. Please verify the issuer URL and try again.
IDE-1017	Test Message Not Delivered	The test message was not delivered to the destination, and the provider did NOT report a credential failure — the configuration may well be correct. Trial accounts are the common cause: Twilio trial accounts refuse delivery to recipients that have not been verified in the Twilio console, whatever the credentials. Verify the destination, or use one already verified with the provider, and test again. This outcome is also returned when the provider’s response is inconclusive, so that a working provider is never reported as having bad credentials. Provider reported: `{value}`
IDE-1032	Invalid Provider Endpoint URL	issuerUrl, customAuthUrl, customTokenUrl and customUserInfoUrl must each be an absolute http(s) URL.
IDE-1041	Unknown Product	The product `{value}` is not a supported product. Please use one of: `{value}`.
IDE-1042	Unknown Scope Field	The scope is not accepted by the product: `{value}`. Please scope only the dimensions the product publishes (`GET /v1/scope-catalog/{product}`).
IDE-1043	Permission Above Product Ceiling	The permission is above what your organization holds in the product: `{value}`. A partner cannot be delegated more than your organization’s editor role holds; please remove it and try again.
IDE-1044	Scope Without Permissions	The product `{value}` has a scope entry but no permissions entry, which would authorize nothing. Please add the permissions for this product or remove its scope.
IDE-1045	Invalid Validity Window	The field validUntil must be later than validFrom. Please correct the validity window and try again.
IDE-1047	Wildcard Not Allowed	The field `{value}` must not contain the wildcard `*`, which would grant everything the product offers. Please list the values explicitly and try again.
IDE-1048	Empty IP Allowlist	The field ipAllowlist must not be an empty array. Send null to inherit the organization’s list, or suspend the partner to block it entirely.
IDE-1050	Duplicate IP Allowlist Entry	The IP allowlist entry `{value}` appears more than once. Please keep a single entry per CIDR and try again.
IDE-1052	Partner Rejected	The partner could not be stored because the identity provider refused the request: `{value}`. Please correct the request and try again.
IDE-1054	Product Not Ready For Partners	The product is not ready for partners yet: it has not published a scope catalog: `{value}`. Please remove its permissions entry and try again.
IDE-1055	Product Not Opted In To Partners	The product has not opted in to partners, so it cannot be granted to one: `{value}`. Please remove its permissions entry and try again.
IDE-1056	Partner Write Exceeds Its Scope	A write in the permissions acts at a level wider than the partner’s scope: `{value}`. Please remove that action, or widen the partner’s scope, and try again.
IDE-1057	Partner Read Rejected	The identity provider refused the request: `{value}`. Please correct the request and try again.

401

`code`	`title`	`message`
IDE-0008	Token Missing	A valid token must be provided in the request header. Please include a token and try again.
IDE-0009	Invalid Token	The provided token is expired, invalid or malformed. Please provide a valid token and try again.

403

`code`	`title`	`message`
IDE-0057	Not Your Profile	This operation may only be performed on your own account. The requested user ID does not match the authenticated user.
IDE-1023	System Role Immutable	System roles cannot be modified or deleted. Only custom roles can be changed.

404

`code`	`title`	`message`
IDE-0013	User ID Not Match	The provided ID does not match the token owner. Users are only allowed to update their own password. Please ensure you are using the correct ID and try again.
IDE-1001	Application ID Not Found	The provided application ID does not exist in our records. Please verify the application ID and try again.
IDE-1002	No Applications Found	No applications were found in the search. Please review the search criteria and try again.
IDE-1003	User ID Not Found	The provided user ID does not exist in our records. Please verify the user ID and try again.
IDE-1004	No Users Found	No users were found in the search. Please review the search criteria and try again.
IDE-1006	Group ID Not Found	The provided group ID does not exist in our records. Please verify the group ID and try again.
IDE-1007	Provider Not Found	The provided provider ID does not exist in our records. Please verify the provider ID and try again.
IDE-1012	Provider Not Linked	The specified provider is not linked to this application. Please verify the provider ID and try again.
IDE-1020	Role Not Found	The provided role ID does not exist in our records. Please verify the role ID and try again.
IDE-1024	Permission Not Found	The provided permission ID does not exist in our records. Please verify the permission ID and try again.
IDE-1031	Organization Not Found	The organization resolved from the access token does not exist. Please verify the token and try again.
IDE-1046	Partner Not Found	The provided partner ID does not exist in this organization. Please verify the ID and try again.
IDE-1053	Scope Catalog Not Found	The product `{value}` has not published a scope catalog, so none of its partners can be scoped. Check the product slug, or deploy a version of the product that declares its scope.

409

`code`	`title`	`message`
IDE-0017	User Already Exists	A user with this username or email already exists. Please use a different username or email and try again.
IDE-0040	MFA Already Enabled	Multi-factor authentication is already enabled for this user.
IDE-0056	Phone Number In Use By SMS MFA	The phone number cannot be removed while a legacy SMS multi-factor enrollment is still recorded for this user, because SMS codes were delivered to it. Clear the enrollment first: an administrator calls DELETE `/v1/users/{id}/mfa/admin/sms`, or the member calls DELETE `/v1/users/{id}/mfa/sms` with their own token. The phone number can be removed afterwards, and the member can enroll app or email.
IDE-1008	Provider Already Exists	A provider with this name already exists. Please use a different name and try again.
IDE-1011	Provider Already Linked	This provider is already linked to the application. Use PATCH to update the link configuration.
IDE-1022	Role Already Exists	A role with this name already exists. Please use a different name and try again.
IDE-1030	Group Already Exists	A group with this name already exists. Please use a different name and try again.
IDE-1040	Partner Display Name Already Exists	A partner named `{value}` already exists in this organization. Please choose a different displayName and try again.
IDE-1049	Partner Has Applications	This partner still has `{value}` application(s) attached and cannot be deleted. Please delete the applications listed in the errors field and try again.
IDE-1058	Group Has Members	This group still has members, so it cannot be deleted. Remove the group’s members before deleting it.
IDE-1059	Group Has Subgroups	Other groups are nested under this group, so it cannot be deleted. Delete or move the group’s subgroups before deleting it.

422

`code`	`title`	`message`
IDE-1016	Provider Credentials Rejected	The provider rejected the configured credentials, so it cannot send messages. This is a credential failure, not a delivery failure: correct the provider’s credentials (clientId / clientSecret, or the SMTP login) and test again. Provider reported: `{value}`
IDE-1018	Test Send Not Supported	Only Email and SMS providers can be test-sent. An OAuth provider has no message to send; its configuration is exercised by an actual sign-in.

500

`code`	`title`	`message`
IDE-0006	Internal Server Error	The server encountered an unexpected error. Please try again later or contact support.

503

`code`	`title`	`message`
IDE-0064	Application Creation Busy	Another application for this product is being created in your organization right now. Retry the request.
IDE-0065	Lock Store Unavailable	The service that coordinates concurrent changes is temporarily unavailable. Nothing was changed. Retry the request.
IDE-0066	Identity Provider Unavailable	The identity provider is temporarily unavailable. Retry the request.

Overview

Authentication

Single sign-on

Authorization

User information

Login MFA

Identity overview

Groups

Applications

Partners

Users

Account MFA

Identity providers

Application providers

Permissions

Roles

Security policies

Plugin declarations

Error handling

Access Manager error list

Auth errors

400

401

403

404

429

500

503

Identity errors

400

401

403

404

409

422

500

503

​Auth errors

​400

​401

​403

​404

​429

​500

​503

​Identity errors

​400

​401

​403

​404

​409

​422

​500

​503

Auth errors

400

401

403

404

429

500

503

Identity errors

400

401

403

404

409

422

500

503