451 codes

Error codes and messages

Look up an error code (for example api:device_limit, AGW01 or 429) to find the article that explains it.

Filter codes451 codes

API responses89
Console messages258
Android app36
Windows panel13
Database codes14
OpenID Connect13
SAML4
HTTP statuses10
Licence states5
Features (/v1/meta)9

API responses89 codes

Code	Articles
`api:approval_not_pending`	«This request could not be verified.» and other request warnings on the phone
`api:approval_signature_invalid`	«The approval key is no longer valid.» (phone)
`api:attempts_exhausted`	Sign in with a password and a one-time code
`api:attestation_rejected`	Link your phone to your account I cannot link my phone (linking errors)
`api:attestation_status_unavailable`	I cannot link my phone (linking errors)
`api:authorization_rejected`	Create and activate a policy revision Decide approval requests from your organization's systems Approve privileged access requests «The authorization was already used, expired, or was denied by the active policy.» (authorization_rejected)
`api:branding_contrast_insufficient`	Organization branding (colours, logos, texts) White label and your organizations' default branding (every field)
`api:confirmation_mismatch`	Enrol and confirm an Edge appliance Link your phone to your account The Edge appliance has a stale or stuck enrolment I cannot link my phone (linking errors)
`api:conflict`	Groups (teams used in policies) Network zones (company networks in policies) Organization profile (name, identifier and slug) Targets and privileged accounts Create people in the console Create and activate a policy revision Simulate a policy before activating it (candidate and test decision) Register a RADIUS client (VPN, firewall, Wi-Fi) Organization security settings Single sign-on: duration, inactivity and sensitive applications API errors and request limits Create an approval request (intents API) Read a request's decision and cancel it .NET SDK Go SDK Java SDK Python SDK TypeScript / Node.js SDK Issue a customer organization's activation code Create a customer organization (with a licence) Allocate, amend, renew and revoke customer licences «This record already exists.» or «Someone else changed…» (conflict, 409)
`api:continuation_consumed`	Sign in with a password and a one-time code «This sign-in step was already used.» (continuation_consumed)
`api:device_approvals_disabled`	«Phone approvals are turned off for your organization.» (device_approvals_disabled)
`api:device_approvals_suspended`	I got a request I did not make ("It wasn't me") «Phone approvals are paused for this account…» (device_approvals_suspended)
`api:device_approver_unavailable`	«Phone approvals are turned off for your organization.» (device_approvals_disabled)
`api:device_clock_skew`	Clock out of sync (device_clock_skew, one-time codes refused)
`api:device_limit`	Link your phone to your account Replace your phone «This account already has the maximum of three phones.» (device_limit)
`api:device_not_active`	«This account has no phone that can approve.» (no_device)
`api:device_revoked`	«This phone is no longer linked to this account.» (device_revoked)
`api:device_sign_in_disabled`	Sign in with your phone only, without a password «Phone approvals are turned off for your organization.» (device_approvals_disabled)
`api:device_sign_in_pending_limit`	Sign in with your phone only, without a password «There are already requests waiting for this account.» (device_sign_in_pending_limit)
`api:eam_requires_passkey`	Microsoft Entra external authentication method «This application requires a passkey sign-in.» (phone approval not accepted)
`api:edge_audit_discontinuity`	Edge appliance health (heartbeat, clock, certificates) Edge appliance warnings and errors (modules, audit, configuration)
`api:edge_audit_rejected`	Edge appliance warnings and errors (modules, audit, configuration)
`api:edge_disabled`	Edge appliance configuration and modules The Edge appliance has a stale or stuck enrolment
`api:edge_enrolment_malformed`	Edge appliance warnings and errors (modules, audit, configuration)
`api:edge_enrolment_refused`	Enrol and confirm an Edge appliance The Edge appliance has a stale or stuck enrolment
`api:edge_module_refused`	Edge appliance configuration and modules Edge appliance warnings and errors (modules, audit, configuration)
`api:edge_renewal_not_due`	Edge appliance health (heartbeat, clock, certificates) The Edge appliance has a stale or stuck enrolment
`api:edge_request_malformed`	Edge appliance warnings and errors (modules, audit, configuration)
`api:edge_unconfirmed`	Edge appliance health (heartbeat, clock, certificates) The Edge appliance has a stale or stuck enrolment
`api:email_delivery_unavailable`	Organization email: sender and email recovery Per-brand email sender (SES and DKIM) Recover access by email ("I forgot my access details") Invalid email link or an email that never arrives (email_link_invalid)
`api:email_link_invalid`	Recover access by email ("I forgot my access details") Invalid email link or an email that never arrives (email_link_invalid)
`api:endpoint_bundles_unavailable`	Computer policy: offline, break-glass and Safe Mode The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`api:endpoint_clock_skew`	The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`api:endpoint_enrolment_refused`	Install tokens for Windows computers Install the Windows agent silently and through Group Policy (GPO) Deploy the Windows agent with Microsoft Intune The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`api:endpoint_logon_closed`	Sign in to Windows with phone approval Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)
`api:endpoint_logon_limit`	Sign in to Windows with phone approval Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)
`api:endpoint_not_usable`	Approve, disable and retire computers, and see their history The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`api:endpoint_recovery_generation`	Give the Windows recovery response to someone who cannot use their phone
`api:endpoint_secrets_unavailable`	The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`api:endpoint_token_limit`	Install tokens for Windows computers The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`api:endpoints_unavailable`	Windows sign-in with a second factor: overview
`api:enrollment_cancelled`	Link your phone to your account I cannot link my phone (linking errors)
`api:enrolment_cancelled`	Enrol and confirm an Edge appliance The Edge appliance has a stale or stuck enrolment
`api:entitlement_exceeded`	Your organization's custom domains (administrator view) Your organization's licence and end-of-licence warnings Privileged access (PAM): overview and where to start Create people in the console Change a person's role or suspend them Create a customer organization (with a licence) Customer and portal custom domains (DNS proof) Allocate, amend, renew and revoke customer licences Licence pools and seats The distributor's organization quota Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed) SCIM answers 401 or 403 (token expired, revoked or missing a scope)
`api:entitlement_required`	Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed)
`api:forbidden`	Reset a person's authenticators (helpdesk) Roles, delegation and organization hierarchy Organization sessions (view and revoke) API errors and request limits «The operation was not allowed by the active policy or by your permissions.» (forbidden) The console asks you to confirm your identity again (recent confirmation expired)
`api:fresh_passkey_required`	Confirmation of administrative changes (passkey or phone) Reset a person's authenticators (helpdesk) Remove a person's approver phone Give the Windows recovery response to someone who cannot use their phone The console asks you to confirm your identity again (recent confirmation expired)
`api:insufficient_scope`	API authentication (machine clients, SCIM tokens, OIDC clients) Read a request's decision and cancel it
`api:internal_error`	API errors and request limits
`api:invalid_credentials`	Activate your organization with the activation code Activate the distributor account and add operators Sign in with a password and a second factor «Could not verify the identity.» (invalid_credentials)
`api:invalid_cursor`	The AuthGuard API for integrators: overview and conventions Invalid request (validation_error, invalid_request, invalid_cursor)
`api:invalid_idempotency_key`	The AuthGuard API for integrators: overview and conventions Create an approval request (intents API) Invalid request (validation_error, invalid_request, invalid_cursor)
`api:invalid_request`	Invalid request (validation_error, invalid_request, invalid_cursor)
`api:last_active_admin`	Answer GDPR requests (access, rectification, erasure) Change a person's role or suspend them «The organization must keep at least one active administrator.» (last_active_admin)
`api:license_inactive`	Activate your organization with the activation code Your organization's licence and end-of-licence warnings Issue a customer organization's activation code Create a customer organization (with a licence) Allocate, amend, renew and revoke customer licences Licence pools and seats A customer's licence states and what happens at the end Organization read-only or without an active licence (license_read_only, license_inactive)
`api:license_read_only`	Your organization's licence and end-of-licence warnings A customer's licence states and what happens at the end Organization read-only or without an active licence (license_read_only, license_inactive) SCIM answers 401 or 403 (token expired, revoked or missing a scope)
`api:match_failed`	Approve a request on your phone (comparison code) «This request could not be verified.» and other request warnings on the phone
`api:match_mismatch`	Approve a request on your phone (comparison code) «This request could not be verified.» and other request warnings on the phone
`api:no_device`	«This account has no phone that can approve.» (no_device)
`api:not_found`	Organization sessions (view and revoke) API errors and request limits Read a request's decision and cancel it The AuthGuard distributor portal «Not found» (not_found, 404)
`api:pam_policy_denied`	Request privileged access (My access) Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03)
`api:passive_request`	«This application requires a passkey sign-in.» (phone approval not accepted)
`api:passkey_enrolment_required`	Administrator first steps (checklist) «Create the administrator passkey first to continue.» (passkey_enrolment_required)
`api:payload_too_large`	Invalid request (validation_error, invalid_request, invalid_cursor)
`api:phone_authn_context_unsupported`	«This application requires a passkey sign-in.» (phone approval not accepted)
`api:plan_not_allowed`	Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed)
`api:policy_authorization_required`	Create and activate a policy revision «The authorization was already used, expired, or was denied by the active policy.» (authorization_rejected)
`api:presence_reauthentication_required`	Your organization requires phone approval for administrative changes
`api:presence_step_up_required`	Confirmation of administrative changes (passkey or phone) Roles, delegation and organization hierarchy Your organization requires phone approval for administrative changes
`api:proof_rejected`	«The authorization was already used, expired, or was denied by the active policy.» (authorization_rejected)
`api:rate_limited`	The AuthGuard API for integrators: overview and conventions API errors and request limits Create an approval request (intents API) AuthGuard SDKs (TypeScript, Python, Java, .NET, Go) Sign in with your phone only, without a password «Too many attempts.» and error 429 (rate_limited)
`api:realm_activation_pending`	Activate your organization with the activation code Activate the distributor account and add operators «Activation is not finished.» (realm_activation_pending)
`api:realm_pending_deletion`	Suspend, resume, delete and restore customer organizations «This organization is scheduled for deletion.» (realm_pending_deletion)
`api:realm_provisioning`	Activate your organization with the activation code Activate the distributor account and add operators «This organization awaits activation.» (realm_provisioning)
`api:realm_state_conflict`	Suspend, resume, delete and restore customer organizations Transfer an organization between distributors «This organization is scheduled for deletion.» (realm_pending_deletion)
`api:realm_suspended`	A customer's licence states and what happens at the end Suspend, resume, delete and restore customer organizations «This organization is suspended.» (realm_suspended)
`api:recovery_required`	Review and remove passkeys «Confirm the recovery password to remove the last passkey.» (recovery_required)
`api:recovery_session_restricted`	Decide approval requests from your organization's systems Review and remove passkeys Sign in with a recovery code «Complete the recovery: add a passkey…» (recovery_session_restricted)
`api:saml_keys_not_configured`	Register a SAML application SAML application sign-in errors (invalid request, certificate, keys)
`api:second_administrator_required`	Dual approval of authenticator resets Dual control in privileged access «Another administrator must approve this change.» (second_administrator_required)
`api:second_factor_required`	Sign in with a password and a second factor A second factor is asked for after the password (second_factor_required)
`api:secret_already_issued`	OIDC service secrets (issue, rotate and revoke)
`api:service_busy`	API errors and request limits What happens if the service is unavailable? Service unavailable, not responding or slow (503)
`api:service_unavailable`	API errors and request limits AuthGuard SDKs (TypeScript, Python, Java, .NET, Go) What happens if the service is unavailable? Service unavailable, not responding or slow (503)
`api:sso_session_unusable`	Single sign-on: duration, inactivity and sensitive applications Sign in to one of your organization's applications (single sign-on)
`api:step_up_required`	Request privileged access (My access) Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03)
`api:strong_authentication_required`	How the administration console is organized «This operation requires a passkey with local verification.» (strong_authentication_required)
`api:unauthorized`	API authentication (machine clients, SCIM tokens, OIDC clients) API errors and request limits «Your session expired.» or «Your session ended.» (unauthorized)
`api:validation_error`	Create people in the console The AuthGuard API for integrators: overview and conventions API errors and request limits Create an approval request (intents API) Invalid request (validation_error, invalid_request, invalid_cursor)

Console messages258 codes

Code	Articles
`console:activation.code_rejected`	Activate your organization with the activation code Activate the distributor account and add operators
`console:activation.issue_unknown`	Issue a customer organization's activation code
`console:activation.license_inactive`	Activate your organization with the activation code Organization read-only or without an active licence (license_read_only, license_inactive)
`console:admin.lost`	«The operation was not allowed by the active policy or by your permissions.» (forbidden)
`console:admin.required`	How the administration console is organized «The operation was not allowed by the active policy or by your permissions.» (forbidden)
`console:api.session_expired`	«Your session expired.» or «Your session ended.» (unauthorized)
`console:audit.copy_timeout_no_file`	Audit: query events and create a JSON copy
`console:audit.copy_too_large`	Audit: query events and create a JSON copy
`console:audit.invalid_filters`	Audit: query events and create a JSON copy
`console:branding.approver_app_name`	What a distributor's customers see
`console:branding.changed_meanwhile`	How branding inheritance works
`console:branding.contrast_blocked.other`	White label and your organizations' default branding (every field)
`console:branding.contrast_refused`	Organization branding (colours, logos, texts)
`console:branding.image_problem.size`	Organization branding (colours, logos, texts)
`console:branding.names_effective`	What a distributor's customers see
`console:branding.problem.sender_address_invalid`	Per-brand email sender (SES and DKIM)
`console:branding.problem.sender_invalid`	White label and your organizations' default branding (every field)
`console:branding.product_name`	What a distributor's customers see
`console:branding.sender_address`	Per-brand email sender (SES and DKIM)
`console:common.default_deny`	Access policies: how they work
`console:computers.error.conflict`	Approve, disable and retire computers, and see their history
`console:computers.error.endpoint_not_usable`	Approve, disable and retire computers, and see their history The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`console:computers.error.endpoint_token_limit`	Install tokens for Windows computers The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`console:computers.error.endpoints_unavailable`	Windows sign-in with a second factor: overview The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05) Windows: the service on this computer is not responding
`console:computers.logon.reason.cancelled`	Windows: «Sign-in was not approved»
`console:computers.logon.reason.code_failed`	Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)
`console:computers.logon.reason.declined`	Windows: «Sign-in was not approved»
`console:computers.logon.reason.expired`	Windows: «Sign-in was not approved»
`console:computers.logon.reason.match_failed`	Windows: «Sign-in was not approved»
`console:computers.logon.reason.no_factor`	Windows: «Sign-in is not allowed right now. Contact IT support.»
`console:computers.logon.reason.not_me`	Windows: «Sign-in was not approved»
`console:computers.logon.reason.policy_denied`	Windows: «Sign-in is not allowed right now. Contact IT support.»
`console:computers.logon.reason.unmapped`	Windows: «Sign-in is not allowed right now. Contact IT support.»
`console:computers.mapping.email_invalid`	Map Windows accounts to people (SID)
`console:computers.mapping.sid_invalid`	Map Windows accounts to people (SID)
`console:computers.policy.invalid`	Computer policy: offline, break-glass and Safe Mode
`console:computers.posture.invalid`	Device posture (Windows computer compliance)
`console:computers.recovery.challenge_invalid`	Give the Windows recovery response to someone who cannot use their phone
`console:computers.updates.invalid`	Windows agent updates by ring The Windows agent update failed or is paused
`console:computers.updates.no_catalogue`	The Windows agent update failed or is paused
`console:computers.updates.outcome.failed`	The Windows agent update failed or is paused
`console:computers.updates.outcome.rolled_back`	The Windows agent update failed or is paused
`console:computers.updates.paused.admin`	The Windows agent update failed or is paused
`console:computers.updates.paused.failure_reported`	Windows agent updates by ring The Windows agent update failed or is paused
`console:computers.updates.unknown`	The Windows agent update failed or is paused
`console:devices.approve.denied_service`	The rule that allows application sign-ins (federation.authorize) Sign in to one of your organization's applications (single sign-on)
`console:devices.enroll.cancelled`	I cannot link my phone (linking errors)
`console:devices.enroll.expired`	Link your phone to your account
`console:devices.error.approval_not_pending`	«This request could not be verified.» and other request warnings on the phone
`console:devices.error.confirmation_mismatch`	I cannot link my phone (linking errors)
`console:devices.error.device_approvals_disabled`	«Phone approvals are turned off for your organization.» (device_approvals_disabled)
`console:devices.error.device_approvals_suspended`	I got a request I did not make ("It wasn't me") «Phone approvals are paused for this account…» (device_approvals_suspended)
`console:devices.error.device_approver_unavailable`	«Phone approvals are turned off for your organization.» (device_approvals_disabled)
`console:devices.error.device_limit`	«This account already has the maximum of three phones.» (device_limit)
`console:devices.error.eam_requires_passkey`	Microsoft Entra external authentication method «This application requires a passkey sign-in.» (phone approval not accepted)
`console:devices.error.enrollment_cancelled`	I cannot link my phone (linking errors)
`console:devices.error.fresh_passkey_required`	Remove a person's approver phone The console asks you to confirm your identity again (recent confirmation expired)
`console:devices.error.no_device`	I lost my phone or it was stolen «This account has no phone that can approve.» (no_device)
`console:devices.error.phone_authn_context_unsupported`	«This application requires a passkey sign-in.» (phone approval not accepted)
`console:devices.reason.attestation_revoked`	«This phone is no longer linked to this account.» (device_revoked)
`console:distributors.quota_full`	Create a customer organization (with a licence) The distributor's organization quota
`console:distributors.transfer_conflict`	Transfer an organization between distributors
`console:domains.expiry_warning`	The custom domain does not get verified (DNS TXT record)
`console:domains.host_invalid`	Customer and portal custom domains (DNS proof) The custom domain does not get verified (DNS TXT record)
`console:domains.not_found_yet`	Your organization's custom domains (administrator view) Customer and portal custom domains (DNS proof) The custom domain does not get verified (DNS TXT record)
`console:domains.state.failed`	The custom domain does not get verified (DNS TXT record)
`console:domains.state.issuing`	The custom domain does not get verified (DNS TXT record)
`console:domains.state.pending_verification`	The custom domain does not get verified (DNS TXT record)
`console:edge.code.expired`	Enrol and confirm an Edge appliance
`console:edge.config.invalid`	Edge appliance configuration and modules
`console:edge.config.not_approved`	Edge appliance configuration and modules
`console:edge.config.stale`	Edge appliance configuration and modules
`console:edge.confirm.cancelled`	Enrol and confirm an Edge appliance
`console:edge.health.certificate_expiring`	The Edge appliance has a stale or stuck enrolment
`console:edge.health.missing`	Edge appliance warnings and errors (modules, audit, configuration)
`console:edge.health.module_failed`	Edge appliance warnings and errors (modules, audit, configuration)
`console:edge.health.queue_high`	Edge appliance warnings and errors (modules, audit, configuration)
`console:edge.health.revision_behind`	Edge appliance warnings and errors (modules, audit, configuration)
`console:edge.health.suspect`	Edge appliance warnings and errors (modules, audit, configuration)
`console:edge.heartbeat.stale`	Edge appliance health (heartbeat, clock, certificates)
`console:edge.state.awaiting_enrolment`	The Edge appliance has a stale or stuck enrolment
`console:edge.state.disabled`	The Edge appliance has a stale or stuck enrolment
`console:edge.state.pending_confirmation`	The Edge appliance has a stale or stuck enrolment
`console:edge.state.retired`	The Edge appliance has a stale or stuck enrolment
`console:email.conflict`	Organization email: sender and email recovery «This record already exists.» or «Someone else changed…» (conflict, 409)
`console:email.sender_domain`	Organization email: sender and email recovery Per-brand email sender (SES and DKIM)
`console:email.sender_name`	Organization email: sender and email recovery
`console:email_link.confirmed`	Confirm your email address
`console:email_link.invalid_or_used`	Recover access by email ("I forgot my access details") Confirm your email address Invalid email link or an email that never arrives (email_link_invalid)
`console:email_link.not_valid`	Invalid email link or an email that never arrives (email_link_invalid)
`console:email_link.recovery_unavailable`	Recover access by email ("I forgot my access details") Invalid email link or an email that never arrives (email_link_invalid)
`console:enrol.creation_canceled`	Create a passkey
`console:enrol.recovery_done`	Sign in with a recovery code
`console:enrol.unsupported`	Create a passkey
`console:error.authorization_rejected`	«The authorization was already used, expired, or was denied by the active policy.» (authorization_rejected)
`console:error.clock_skew`	Clock out of sync (device_clock_skew, one-time codes refused)
`console:error.conflict`	«This record already exists.» or «Someone else changed…» (conflict, 409)
`console:error.continuation_consumed`	«This sign-in step was already used.» (continuation_consumed)
`console:error.forbidden`	«The operation was not allowed by the active policy or by your permissions.» (forbidden)
`console:error.fresh_passkey_required`	Create a passkey The console asks you to confirm your identity again (recent confirmation expired)
`console:error.invalid_credentials`	«Could not verify the identity.» (invalid_credentials)
`console:error.invalid_cursor`	Invalid request (validation_error, invalid_request, invalid_cursor)
`console:error.last_active_admin`	Change a person's role or suspend them «The organization must keep at least one active administrator.» (last_active_admin)
`console:error.network`	Service unavailable, not responding or slow (503)
`console:error.not_allowed`	Sign in with a passkey My passkey does not appear or does not work
`console:error.not_ready`	Service unavailable, not responding or slow (503)
`console:error.offline`	Service unavailable, not responding or slow (503)
`console:error.passkey_enrolment_required`	Administrator first steps (checklist) «Create the administrator passkey first to continue.» (passkey_enrolment_required)
`console:error.password_length`	Change your password
`console:error.password_same`	Change your password
`console:error.password_weak`	Create people in the console Change your password
`console:error.presence_step_up_cancelled`	Your organization requires phone approval for administrative changes
`console:error.presence_step_up_denied`	Your organization requires phone approval for administrative changes
`console:error.presence_step_up_expired`	Your organization requires phone approval for administrative changes
`console:error.presence_step_up_required`	Confirmation of administrative changes (passkey or phone) Your organization requires phone approval for administrative changes
`console:error.receipt_mismatch`	Signed receipts and stored evidence Verify a decision's signed receipt
`console:error.recovery_required`	Review and remove passkeys «Confirm the recovery password to remove the last passkey.» (recovery_required)
`console:error.recovery_session_restricted`	«Complete the recovery: add a passkey…» (recovery_session_restricted)
`console:error.saml_keys_not_configured`	Register a SAML application
`console:error.second_administrator_required`	Dual approval of authenticator resets «Another administrator must approve this change.» (second_administrator_required)
`console:error.session_expired`	«Your session expired.» or «Your session ended.» (unauthorized)
`console:error.sso_session_unusable`	Sign in to one of your organization's applications (single sign-on)
`console:error.strong_authentication_required`	«This operation requires a passkey with local verification.» (strong_authentication_required)
`console:error.timeout`	Service unavailable, not responding or slow (503)
`console:error.unauthorized`	«Your session expired.» or «Your session ended.» (unauthorized)
`console:error.wsfed_keys_not_configured`	Federate a Microsoft 365 domain (WS-Federation)
`console:factor_reset.already_executed`	Reset a person's authenticators (helpdesk)
`console:factor_reset.conflict`	Dual approval of authenticator resets
`console:factor_reset.executed`	Reset a person's authenticators (helpdesk)
`console:group.ack_required`	Groups (teams used in policies)
`console:groups.conflict`	Groups (teams used in policies)
`console:helpdesk.conflict`	Dual approval of authenticator resets
`console:intents.client.invalid_types`	Third-party requests: operation types and machine clients
`console:intents.recovery_restricted`	«Complete the recovery: add a passkey…» (recovery_session_restricted)
`console:intents.type.invalid_key`	Third-party requests: operation types and machine clients
`console:intents.webhooks_unavailable`	Third-party requests: operation types and machine clients Decision webhooks (Standard Webhooks)
`console:licenses.create.exceeded`	Create a customer organization (with a licence)
`console:licenses.create.no_pool`	Create a customer organization (with a licence)
`console:licenses.no_pools`	Licence pools and seats
`console:licenses.problem.not_found`	«Not found» (not_found, 404)
`console:licenses.problem.pool_exceeded`	Allocate, amend, renew and revoke customer licences
`console:licenses.problem.seats_below_use`	Allocate, amend, renew and revoke customer licences
`console:m365.access_denied`	Federate a Microsoft 365 domain (WS-Federation) Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.csv_invalid`	Microsoft 365 anchors (ImmutableID and UPN)
`console:m365.invalid`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.not_enabled`	Microsoft 365 anchors (ImmutableID and UPN) Federate a Microsoft 365 domain (WS-Federation) Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.nothing_written`	Microsoft 365 anchors (ImmutableID and UPN)
`console:m365.refusal_anchored`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.refusal_duplicate`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.refusal_invalid_immutable_id`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.refusal_invalid_upn`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.refusal_malformed`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.refusal_taken`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.refusal_unknown_user`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:m365.refusal_upn_outside_domain`	Microsoft 365 sign-in errors (anchor, policy, import)
`console:network.cidr_limit`	Network zones (company networks in policies)
`console:network.list_required`	Network zones (company networks in policies)
`console:network.unknown_zone`	Network zones (company networks in policies)
`console:oath.expired_message`	Set up an authenticator app (TOTP)
`console:offline_codes.none`	Sign in to Windows offline (offline codes)
`console:oidc.conflict`	Register an OpenID Connect (OIDC) service
`console:oidc.credential_id_required`	OIDC service secrets (issue, rotate and revoke)
`console:oidc.destination_mismatch`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`console:oidc.expired`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`console:oidc.mismatch`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`console:oidc.passkey_required`	«This operation requires a passkey with local verification.» (strong_authentication_required)
`console:pam.error.authorization_rejected`	Approve privileged access requests «The authorization was already used, expired, or was denied by the active policy.» (authorization_rejected)
`console:pam.error.dual_control_pending`	Dual control in privileged access PAM settings (retention and per-connection approval) «Another administrator must approve this change.» (second_administrator_required)
`console:pam.error.not_found`	«Not found» (not_found, 404)
`console:pam.error.pam_policy_denied`	Request privileged access (My access) Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03)
`console:pam.error.passkey_unsupported`	Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03) My passkey does not appear or does not work
`console:pam.error.service_unavailable`	Privileged access (PAM): overview and where to start The vault and privileged account credentials
`console:pam.error.step_up_required`	Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03)
`console:pam.field.approver_groups`	Privileged access profiles (approvals, duration and permissions)
`console:pam.field.breakglass_justification`	Request break-glass (emergency) access
`console:pam.field.connector`	Targets and privileged accounts
`console:pam.field.escrow_fingerprint`	Vault key escrow (a key kept offline)
`console:pam.field.escrow_key`	Vault key escrow (a key kept offline)
`console:pam.field.incident`	Request break-glass (emergency) access
`console:pam.field.interval`	Privileged credential rotation
`console:pam.field.key_label`	My SSH keys for privileged access
`console:pam.field.lease_bounds`	Privileged access profiles (approvals, duration and permissions)
`console:pam.field.mode`	Targets and privileged accounts
`console:pam.field.password_length`	Privileged credential rotation
`console:pam.field.quorum`	Privileged access profiles (approvals, duration and permissions)
`console:pam.field.retention`	PAM settings (retention and per-connection approval)
`console:pam.field.secret`	The vault and privileged account credentials
`console:pam.field.ssh_key`	My SSH keys for privileged access
`console:pam.hold.erased`	Recording retention and legal hold
`console:pam.integrity.failed`	Privileged sessions and recordings (watch, terminate, replay)
`console:pam.player.text_only`	Privileged sessions and recordings (watch, terminate, replay)
`console:pam.session.no_gateway`	Use the web terminal and SSH command of a privileged access
`console:phone_login.error.disabled`	«Phone approvals are turned off for your organization.» (device_approvals_disabled)
`console:phone_login.error.invalid`	«There are already requests waiting for this account.» (device_sign_in_pending_limit)
`console:phone_login.error.pending_limit`	Sign in with your phone only, without a password «There are already requests waiting for this account.» (device_sign_in_pending_limit)
`console:phone_login.error.rate_limited`	«There are already requests waiting for this account.» (device_sign_in_pending_limit) «Too many attempts.» and error 429 (rate_limited)
`console:phone_login.expired`	Sign in with your phone only, without a password
`console:presence.clock_skew`	Clock out of sync (device_clock_skew, one-time codes refused)
`console:privacy.email.request_conflict`	Answer GDPR requests (access, rectification, erasure)
`console:privacy.erase.conflict`	Answer GDPR requests (access, rectification, erasure)
`console:privacy.erase.last_admin`	Answer GDPR requests (access, rectification, erasure) «The organization must keep at least one active administrator.» (last_active_admin)
`console:privacy.export_partial`	Answer GDPR requests (access, rectification, erasure)
`console:privacy.self.changed`	My data: download it and confirm an email change
`console:privacy.self.mismatch`	My data: download it and confirm an email change
`console:privacy.settings.conflict`	Retention of suspended accounts (automatic deletion)
`console:privacy.settings.invalid_days`	Retention of suspended accounts (automatic deletion)
`console:radius.field.certificate_sha256`	RadSec certificate problems (TLS)
`console:radius.invalid_form`	Register a RADIUS client (VPN, firewall, Wi-Fi)
`console:radius.mode.push`	The VPN or Wi-Fi refuses sign-in (RADIUS Access-Reject or no answer)
`console:radius.mode.totp`	The VPN or Wi-Fi refuses sign-in (RADIUS Access-Reject or no answer)
`console:radius.mode.totp_or_push`	The VPN or Wi-Fi refuses sign-in (RADIUS Access-Reject or no answer)
`console:radius.transport.radsec`	RadSec certificate problems (TLS)
`console:realms.confirm.mismatch`	Suspend, resume, delete and restore customer organizations
`console:realms.error.entitlement_exceeded`	Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed)
`console:realms.error.license_inactive`	Organization read-only or without an active licence (license_read_only, license_inactive)
`console:realms.error.license_read_only`	Organization read-only or without an active licence (license_read_only, license_inactive)
`console:realms.error.not_found`	The AuthGuard distributor portal «Not found» (not_found, 404)
`console:realms.error.realm_activation_pending`	«Activation is not finished.» (realm_activation_pending)
`console:realms.error.realm_pending_deletion`	«This organization is scheduled for deletion.» (realm_pending_deletion)
`console:realms.error.realm_provisioning`	«This organization awaits activation.» (realm_provisioning)
`console:realms.error.realm_state_conflict`	«This organization is scheduled for deletion.» (realm_pending_deletion)
`console:realms.error.realm_suspended`	«This organization is suspended.» (realm_suspended)
`console:recovery.activation_expired`	Generate and store recovery codes
`console:recovery.presence_required`	Generate and store recovery codes
`console:recovery.resume_expired`	Sign in with a recovery code
`console:review.no_passkeys`	My passkey does not appear or does not work
`console:saml.certificate_expiring`	Renew the SAML signing certificate SAML application sign-in errors (invalid request, certificate, keys)
`console:saml.expired`	SAML application sign-in errors (invalid request, certificate, keys)
`console:saml.mismatch`	SAML application sign-in errors (invalid request, certificate, keys)
`console:schedule.days_required`	Access schedules in policies (UTC)
`console:schedule.same_bounds`	Access schedules in policies (UTC)
`console:schedule.time_format`	Access schedules in policies (UTC)
`console:scim.invalid_scopes`	SCIM tokens (create, rotate and revoke)
`console:scim.limit`	SCIM tokens (create, rotate and revoke) SCIM answers 401 or 403 (token expired, revoked or missing a scope)
`console:scim.state.expired`	SCIM answers 401 or 403 (token expired, revoked or missing a scope)
`console:scim.state.expiring`	SCIM answers 401 or 403 (token expired, revoked or missing a scope)
`console:scim.state.revoked`	SCIM answers 401 or 403 (token expired, revoked or missing a scope)
`console:second_factor.none`	Sign in with a password and a second factor I lost my phone or it was stolen A second factor is asked for after the password (second_factor_required)
`console:second_factor.passkey_failed`	Sign in with a password and a second factor
`console:second_factor.returned`	A second factor is asked for after the password (second_factor_required)
`console:security.conflict`	Organization security settings
`console:security.presence_device_required`	Confirmation of administrative changes (passkey or phone)
`console:security.presence_unavailable`	Organization security settings
`console:setup.created`	Self-hosted installation: create the first organization with the bootstrap token
`console:setup.retryable`	Self-hosted installation: create the first organization with the bootstrap token
`console:signin.passkeys_unsupported`	Sign in with a passkey My passkey does not appear or does not work
`console:simulation.advisory_only`	Simulate a policy before activating it (candidate and test decision)
`console:sso.signed_out`	Signed-in browsers and signing out
`console:stepup.confirm`	The console asks you to confirm your identity again (recent confirmation expired)
`console:stepup.needed`	The console asks you to confirm your identity again (recent confirmation expired)
`console:tenant.invalid_profile`	Organization profile (name, identifier and slug)
`console:totp.hotp_rejected`	HOTP and OCRA tokens (counter and challenge)
`console:totp.ocra_rejected`	HOTP and OCRA tokens (counter and challenge)
`console:totp.resync_unconfirmed`	HOTP and OCRA tokens (counter and challenge)
`console:totp.totp_rejected`	Set up an authenticator app (TOTP)
`console:totp_login.ambiguous`	Sign in with a password and a one-time code
`console:totp_login.expired`	Sign in with a password and a one-time code
`console:totp_login.unavailable`	«This sign-in step was already used.» (continuation_consumed)

Android app36 codes

Code	Articles
`android:standard_approval_disabled`	«Phone approvals are turned off for your organization.» (device_approvals_disabled)
`android:standard_approval_expired`	Approve a request on your phone (comparison code) «This request could not be verified.» and other request warnings on the phone
`android:standard_approval_failed`	«This request could not be verified.» and other request warnings on the phone
`android:standard_approval_invalid`	«This request could not be verified.» and other request warnings on the phone
`android:standard_approval_key_invalidated`	Remove an account from the approver app «The approval key is no longer valid.» (phone)
`android:standard_approval_match_failed`	Approve a request on your phone (comparison code) «This request could not be verified.» and other request warnings on the phone
`android:standard_approval_policy_denied`	Approve a request on your phone (comparison code) «This application requires a passkey sign-in.» (phone approval not accepted)
`android:standard_approval_reported`	I got a request I did not make ("It wasn't me")
`android:standard_approval_revoked`	Remove an account from the approver app «This phone is no longer linked to this account.» (device_revoked)
`android:standard_approval_service_policy_denied`	The rule that allows application sign-ins (federation.authorize) «This application requires a passkey sign-in.» (phone approval not accepted)
`android:standard_approval_unverified`	«This request could not be verified.» and other request warnings on the phone
`android:standard_delivery_background_restricted`	Get requests on your phone (notifications) Requests do not reach my phone (notifications)
`android:standard_delivery_channel_quiet`	Get requests on your phone (notifications) Requests do not reach my phone (notifications)
`android:standard_details_notifications_blocked`	Requests do not reach my phone (notifications)
`android:standard_details_push_not_registered`	Requests do not reach my phone (notifications)
`android:standard_details_push_unavailable`	Requests do not reach my phone (notifications)
`android:standard_enroll_expired`	Link your phone to your account I cannot link my phone (linking errors)
`android:standard_enroll_failed`	I cannot link my phone (linking errors)
`android:standard_enroll_mismatch`	Link your phone to your account I cannot link my phone (linking errors)
`android:standard_enroll_reason_attestation`	I cannot link my phone (linking errors)
`android:standard_enroll_reason_camera`	I cannot link my phone (linking errors)
`android:standard_enroll_reason_cancelled`	I cannot link my phone (linking errors)
`android:standard_enroll_reason_device_limit`	«This account already has the maximum of three phones.» (device_limit)
`android:standard_enroll_reason_invalid_qr`	I cannot link my phone (linking errors)
`android:standard_enroll_reason_network`	I cannot link my phone (linking errors)
`android:standard_enroll_reason_other`	I cannot link my phone (linking errors)
`android:standard_enroll_reason_unavailable`	I cannot link my phone (linking errors)
`android:standard_network_access`	RADIUS second-factor modes (code, phone or both) Connect to your organization's VPN or Wi-Fi
`android:standard_notifications_explain`	Requests do not reach my phone (notifications)
`android:standard_pam_action`	Approve privileged access requests
`android:standard_pending_unavailable`	Get requests on your phone (notifications) «This request could not be verified.» and other request warnings on the phone
`android:standard_policy_activates_now`	Create and activate a policy revision
`android:standard_remove_done_phone_only`	Replace your phone
`android:standard_remove_with_local_failure`	Remove an account from the approver app
`android:standard_signin_reported`	I got a request I did not make ("It wasn't me")
`android:standard_unsupported`	Install the approver app on your phone «This phone is not supported.» (Android 14 and hardware keys)

Windows panel13 codes

Code	Articles
`windows:break_glass_title`	The Windows break-glass account and what to do when nobody can sign in
`windows:denied_body`	Windows: «Sign-in was not approved»
`windows:denied_title`	Sign in to Windows with phone approval Windows: «Sign-in was not approved»
`windows:offline_chip`	Sign in to Windows offline (offline codes) Windows: the service on this computer is not responding
`windows:offline_title`	Sign in to Windows offline (offline codes)
`windows:recovery_title`	I cannot use my phone on Windows (recovery with support)
`windows:refused`	Windows: «Sign-in is not allowed right now. Contact IT support.»
`windows:remote_offline`	Unlock Windows, remote desktop and administrator prompts Windows: the service on this computer is not responding
`windows:service_unavailable`	The Windows break-glass account and what to do when nobody can sign in Windows: the service on this computer is not responding
`windows:totp_title`	Use your authenticator-app code on Windows
`windows:unlock_header`	Unlock Windows, remote desktop and administrator prompts
`windows:wrong_code`	Use your authenticator-app code on Windows I cannot use my phone on Windows (recovery with support) Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)
`windows:wrong_password`	Sign in to Windows with phone approval Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)

Database codes14 codes

Code	Articles
`sqlstate:AG409`	Privileged credential rotation «This record already exists.» or «Someone else changed…» (conflict, 409)
`sqlstate:AG420`	Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed)
`sqlstate:AG422`	Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed)
`sqlstate:AG424`	Organization read-only or without an active licence (license_read_only, license_inactive)
`sqlstate:AGM01`	Vault key escrow (a key kept offline) Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03)
`sqlstate:AGM02`	PAM break-glass: group, alerts and review Privileged credential rotation Request break-glass (emergency) access Request privileged access (My access) Use the web terminal and SSH command of a privileged access Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03)
`sqlstate:AGM03`	PAM break-glass: group, alerts and review Dual control in privileged access Vault key escrow (a key kept offline) Privileged access profiles (approvals, duration and permissions) Recording retention and legal hold PAM settings (retention and per-connection approval) Targets and privileged accounts Privileged access errors (pam_policy_denied, step_up_required, AGM01–AGM03) «Another administrator must approve this change.» (second_administrator_required)
`sqlstate:AGW01`	Install tokens for Windows computers The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`sqlstate:AGW02`	Approve, disable and retire computers, and see their history The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`sqlstate:AGW04`	The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`sqlstate:AGW05`	The Windows computer does not enrol (AGW01, AGW02, AGW04, AGW05)
`sqlstate:AGW06`	Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)
`sqlstate:AGW07`	Give the Windows recovery response to someone who cannot use their phone
`sqlstate:AGW08`	Windows: «The code is not correct. Try again.» and pending requests (AGW06, AGW08)

OpenID Connect13 codes

Code	Articles
`oidc:access_denied`	Microsoft Entra external authentication method Register an OpenID Connect (OIDC) service The rule that allows application sign-ins (federation.authorize) Access policies: how they work Integrate an application with OpenID Connect OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:interaction_required`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:invalid_client`	OIDC service secrets (issue, rotate and revoke) Register an OpenID Connect (OIDC) service API authentication (machine clients, SCIM tokens, OIDC clients) Integrate an application with OpenID Connect OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:invalid_dpop_proof`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:invalid_grant`	Register an OpenID Connect (OIDC) service Integrate an application with OpenID Connect OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:invalid_request`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:invalid_scope`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:login_required`	Microsoft Entra external authentication method Integrate an application with OpenID Connect OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:temporarily_unavailable`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:unauthorized_client`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:unsupported_grant_type`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:unsupported_response_type`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)
`oidc:use_dpop_nonce`	OIDC application sign-in errors (invalid_client, invalid_grant, redirect_uri)

SAML4 codes

Code	Articles
`saml:NoAuthnContext`	Integrate a SAML 2.0 service provider
`saml:NoPassive`	Register a SAML application Integrate a SAML 2.0 service provider
`saml:RequestDenied`	The rule that allows application sign-ins (federation.authorize) Access policies: how they work Register a SAML application Integrate a SAML 2.0 service provider
`saml:UnknownPrincipal`	Integrate a SAML 2.0 service provider

HTTP statuses10 codes

Code	Articles
`http:400`	What SCIM does to accounts and groups Edge appliance warnings and errors (modules, audit, configuration) Error code index
`http:401`	SCIM provisioning with Microsoft Entra ID, step by step SCIM provisioning with Okta, step by step SCIM tokens (create, rotate and revoke) API authentication (machine clients, SCIM tokens, OIDC clients) Clock out of sync (device_clock_skew, one-time codes refused) Error code index «Could not verify the identity.» (invalid_credentials) SCIM answers 401 or 403 (token expired, revoked or missing a scope) «Your session expired.» or «Your session ended.» (unauthorized)
`http:403`	SCIM provisioning with Microsoft Entra ID, step by step SCIM provisioning with Okta, step by step SCIM tokens (create, rotate and revoke) API authentication (machine clients, SCIM tokens, OIDC clients) «Phone approvals are turned off for your organization.» (device_approvals_disabled) «This phone is no longer linked to this account.» (device_revoked) The Edge appliance has a stale or stuck enrolment Limit reached (entitlement_exceeded, entitlement_required, plan_not_allowed) Error code index «The operation was not allowed by the active policy or by your permissions.» (forbidden) «This account has no phone that can approve.» (no_device) «Activation is not finished.» (realm_activation_pending) «This organization is scheduled for deletion.» (realm_pending_deletion) «This organization awaits activation.» (realm_provisioning) «This organization is suspended.» (realm_suspended) SCIM answers 401 or 403 (token expired, revoked or missing a scope)
`http:404`	Read a request's decision and cancel it Error code index «Not found» (not_found, 404)
`http:409`	Configure the RADIUS device (ports, timeouts and accounting) What SCIM does to accounts and groups Create an approval request (intents API) Read a request's decision and cancel it «This request could not be verified.» and other request warnings on the phone «This record already exists.» or «Someone else changed…» (conflict, 409) «This sign-in step was already used.» (continuation_consumed) «This account already has the maximum of three phones.» (device_limit) Edge appliance warnings and errors (modules, audit, configuration) Error code index «The organization must keep at least one active administrator.» (last_active_admin) «This account has no phone that can approve.» (no_device) «This application requires a passkey sign-in.» (phone approval not accepted) «This organization is scheduled for deletion.» (realm_pending_deletion) «Confirm the recovery password to remove the last passkey.» (recovery_required) SAML application sign-in errors (invalid request, certificate, keys)
`http:412`	What SCIM does to accounts and groups
`http:421`	Customer and portal custom domains (DNS proof)
`http:422`	«The approval key is no longer valid.» (phone) «This request could not be verified.» and other request warnings on the phone Error code index Invalid request (validation_error, invalid_request, invalid_cursor)
`http:429`	The AuthGuard API for integrators: overview and conventions «Phone approvals are paused for this account…» (device_approvals_suspended) «There are already requests waiting for this account.» (device_sign_in_pending_limit) Error code index «Too many attempts.» and error 429 (rate_limited)
`http:503`	The vault and privileged account credentials What happens if the service is unavailable? «Phone approvals are turned off for your organization.» (device_approvals_disabled) The custom domain does not get verified (DNS TXT record) Error code index Service unavailable, not responding or slow (503)

Licence states5 codes

Code	Articles
`license:active`	A customer's licence states and what happens at the end
`license:expired`	Your organization's licence and end-of-licence warnings A customer's licence states and what happens at the end
`license:grace`	Your organization's licence and end-of-licence warnings A customer's licence states and what happens at the end
`license:none`	Your organization's licence and end-of-licence warnings A customer's licence states and what happens at the end
`license:warning`	Your organization's licence and end-of-licence warnings A customer's licence states and what happens at the end

Features (/v1/meta)9 codes

Code	Articles
`meta:edge`	Install the Edge appliance (Docker or systemd) /v1/meta: features served and organization state
`meta:email`	/v1/meta: features served and organization state
`meta:endpoints`	Windows sign-in with a second factor: overview /v1/meta: features served and organization state
`meta:helpdesk`	/v1/meta: features served and organization state
`meta:intents`	Third-party requests: operation types and machine clients /v1/meta: features served and organization state
`meta:oidc`	/v1/meta: features served and organization state
`meta:privacy`	/v1/meta: features served and organization state
`meta:radius`	Register a RADIUS client (VPN, firewall, Wi-Fi) /v1/meta: features served and organization state
`meta:sso`	/v1/meta: features served and organization state