Get the audit event catalog (admin)
/v1/admin/audit-catalogReturns every audit event type this server can emit, with its category, default severity, verbosity level, whether configuration can suppress it, its declared metadata keys, and its translation key.
The vocabularies themselves are enumerated in this document, so filter controls and translation coverage can be built statically without calling this endpoint. What it adds is the per-action detail an enum cannot carry, and the set THIS BUILD actually emits — which is what a client should check against when the deployment it is talking to may be older or newer than the contract it was generated from.
The catalog is a compile-time constant of the server, so its CONTENT is
identical for every organization and a client may hold it for the lifetime
of a build. The response itself is no-store and varies on the credential
all the same: what a caller receives here is 200-or-401 depending on the
token presented, so a shared cache that stored the 200 would hand the
catalog to a caller who presented nothing.
- DPoPstring
DPoP proof JWT (RFC 9449 §4). REQUIRED on a request presenting a DPoP-bound access token, and it must be signed by the key named in the token's
cnf.jktand cover this request's method and URI. The proof is read from the request itself rather than from this decoded parameter, so every protected operation is covered whether or not it declares it.
200 OKapplication/jsonThe audit event catalog.
The audit event catalog.
Headers
Cache-Controlno-storeVaryAuthorization
Body
The complete audit event vocabulary this server can emit, plus the closed value sets a client needs to render and filter it.
Show moreShow less
Every vocabulary here is also enumerated in this document, so a client can build its filter controls and its translation coverage statically. What this endpoint adds is the per-action DETAIL a bare enum cannot carry — category, severity, verbosity level, whether configuration can suppress it, its declared metadata keys, and its translation key — and the answer to which values THIS BUILD actually emits, which may be a subset of what the document declares once a deployment is older or newer than its client.
Each array's element type matches the corresponding field on a record, so a value that could be served is a value the document declares. A server that could publish an action it cannot emit would be describing something other than itself.
field_valuescovers the metadata fields whose values are a closed vocabulary rather than data — the refusal cause, what triggered a revocation, a stop or a degraded audit pipeline, a throttle's scope, the step of a logout fanout, of a user_code submission or of a boot that failed, the screen a client name was shown on, a client authentication method, the algorithm a refused client assertion or request object declared, what a consent decision did to the standing agreement, how a UserInfo read resolved its subject, the client metadata field a registration refusal or an unframeable front-channel logout was about, what an RFC 7009 revocation request found, why a logout did not honor its post-logout destination, what a logout's id_token_hint proved, what an accepted authorization request was answered with, what Sec-Fetch-Site said when a cross-site check refused on it, which profiling endpoint was read, which dependency failed, which kind of operation and why, and what the server uses it for, which forwarding headers an untrusted peer sent, and where a request carried a credential over a hop a trusted proxy reported as cleartext, how the server's database role could change or remove audit records, and which writer lane signed a checkpoint of the audit chain and which part of its statement a record holds — so a detection rule can be written against the values the server will actually use rather than the ones someone happened to see.One entry of the server's audit event catalog: everything about an action that does not vary per occurrence.
Show item attributesHide item attributes
The event type — what was attempted. Append-only: an action is never renamed once shipped, because a rename orphans every stored record and every SIEM rule matching on it.
Show moreShow less
The outcome is deliberately NOT part of the name.
auth.sign_in.completedwithoutcome: failureis a failed sign-in; there is noauth.sign_in.failed. Encoding it would double this list, the catalog and every translation file.Translation key: the action verbatim in the
auditEventsnamespace —auditEvents:user.password.changed. Because i18next splits keys on., a locale file nests naturally by segment. The catalog endpoint publishes the same key asi18n_keyso a client need not re-derive it.Compatibility: this is a CLOSED enum, and that has a cost worth stating plainly. A client generated against one version of this document will reject an entire audit page — not merely one record — the first time the server emits an action added after that client was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway because the alternative left every consumer unable to know the translatable vocabulary without calling the catalog endpoint at runtime.
Possible values"admin.access.denied""audit.counts.read""audit.log.read""audit.ranking.read""auth.account.locked""auth.email_verification.completed""auth.email_verification.requested""auth.invitation.accepted""auth.password_reset.completed""auth.password_reset.requested""auth.rate_limit.triggered""auth.registration.completed""auth.sign_in.alerted""auth.sign_in.completed""auth.sign_out.completed""branding.applied""branding.deleted""client.adopted""client.applied""client.configuration.read""client.configured""client.deleted""client.deregistered""client.listed""client.name.suspicious""client.provisioned""client.read""client.registered""client.registration.attempted""client.secret.issued""client.usage.read""http.cleartext_credential.received""http.forwarding.ignored""http.header.repeated""http.request.screened""http.request.served""identity_provider.applied""identity_provider.deleted""identity_provider.listed""mfa.factor.locked""mfa.recovery_code.consumed""mfa.recovery_codes.acknowledged""mfa.recovery_codes.regenerated""mfa.request.authenticated""mfa.status.read""mfa.totp.activated""mfa.totp.disabled""mfa.totp.enrollment_started""mfa.totp.verified""oauth.authorization.requested""oauth.client_authentication.attempted""oauth.consent.decided""oauth.consent.revoked""oauth.device.decided""oauth.device.redeemed""oauth.device.requested""oauth.device.user_code.attempted""oauth.token.introspected""oauth.token.issued""oauth.token.presented""oauth.token.refreshed""oauth.token.revoked""oidc.logout.frontchannel.rendered""oidc.logout.initiated""oidc.logout.participant.added""oidc.logout.participant.skipped""oidc.logout.token.delivered""oidc.userinfo.read""organization.created""organization.deleted""organization.listed""organization.mail.tested""organization.read""organization.route.attempted""organization.snapshot.read""organization.updated""role.granted""role.revoked""session.created""session.history.listed""session.listed""session.presented""session.revoked""system.admin.bootstrapped""system.audit.checkpoint""system.audit.configured""system.audit.degraded""system.audit.overflow""system.audit.partition_created""system.audit.partition_dropped""system.audit.recovered""system.audit.write_delayed""system.audit.write_failed""system.debug.accessed""system.dependency.degraded""system.dependency.recovered""system.keys.loaded""system.migration.applied""system.session.reaped""system.signing_key.created""system.signing_key.dropped""system.started""system.stopped""system.transport.configured""threats.overview.read""user.created""user.deleted""user.devices.listed""user.identities.listed""user.invitation.sent""user.listed""user.password.changed""user.read""user.updated"The group an action belongs to, for faceting. Declared per action rather than derived from the action's first segment, because the two do not always agree:
oauth.*andoidc.*events are both "token" work to an operator, and the grouping a UI offers should follow what an operator is looking for rather than how the constant is spelled.Possible values"authentication""session""mfa""token""user""organization""client""role""admin""audit""system"How much an event matters, lowest first. Assigned per action, and an occurrence may raise it but never lower it. A refusal or a server fault is raised to at least
warningwhatever its action's default, soseverity >= warningselects everything that did not go as asked; a protocol step that only looks like a failure (authorization_pending,use_dpop_nonce,mfa_required,login_required,interaction_required,consent_required,account_selection_required) keeps its action's default.Possible values"info""notice""warning""critical"The configured verbosity tier at which an action is recorded, least verbose first. Independent of severity: token refresh is low severity but the highest-volume event an identity provider produces, so it sits at the most verbose tier. It is the level of an action's successes: a refusal or a server fault is recorded at
securitywhatever its action declares, so the default configuration keeps every refused token request and no issued one. The configuration also acceptsoff, which is not listed here because no catalog entry can declare it — an action recorded only when mandatory is a mandatory flag written confusingly.Possible values"security""write""read""trace"Whether configuration is unable to suppress this action. The non-suppressible set is small and deliberate: an operator who could switch off logging of destructive administrative actions would have a privilege-escalation path rather than a feature.
Whether the action is platform-scoped (never owned by a tenant), such as process startup or audit retention.
The metadata keys an occurrence of this action may carry. It is a closed allowlist enforced at write time, which is what makes it impossible for a credential to reach the payload.
The translation key for this action — the action verbatim in the
auditEventsnamespace. Published here so a client never re-implements the derivation rule.A short English description. It is documentation and a last-resort fallback for a client with no translation yet — never the stored record.
The group an action belongs to, for faceting. Declared per action rather than derived from the action's first segment, because the two do not always agree:
oauth.*andoidc.*events are both "token" work to an operator, and the grouping a UI offers should follow what an operator is looking for rather than how the constant is spelled.Possible values"authentication""session""mfa""token""user""organization""client""role""admin""audit""system"no duplicates
How an attempt ended.
deniedis separated fromfailurebecause "you were not allowed" and "you got it wrong" are different security signals — a cluster of the former is what a SIEM alerts on.errormarks a failure attributable to the server, so an operator can tell "users are getting it wrong" from "we are broken". The server enforces the pairing:erroralways carries the reasoninternal_errororunavailable, and those two reasons never appear under any other outcome.Possible values"success""failure""denied""error"no duplicates
How much an event matters, lowest first. Assigned per action, and an occurrence may raise it but never lower it. A refusal or a server fault is raised to at least
warningwhatever its action's default, soseverity >= warningselects everything that did not go as asked; a protocol step that only looks like a failure (authorization_pending,use_dpop_nonce,mfa_required,login_required,interaction_required,consent_required,account_selection_required) keeps its action's default.Possible values"info""notice""warning""critical"no duplicates
The failure vocabulary this build can emit. A client translates a record's
reasonrather than displaying it, so it needs the full set to know which keys to provide.Each item:A stable machine token explaining a non-success outcome. Absent on success.
Show moreShow less
Translate it rather than displaying it: the key is the token verbatim in the
auditReasonsnamespace —auditReasons:invalid_credentials. A separate namespace from actions, because these are flat tokens rather than dotted paths and would otherwise nest unpredictably.The OAuth-related values are spelled exactly as the corresponding RFC 6749 §5.2 / OIDC Core §3.1.2.6 wire error, so the audit record and the error the client actually received are the same string.
Compatibility: closed, with the same cost described on
AuditAction— this vocabulary grows as the server implements more specifications (invalid_targetarrived with RFC 8707,invalid_dpop_proofwith RFC 9449).Possible values"invalid_credentials""account_locked""rate_limited""mfa_required""email_verification_required""invalid_code""factor_locked""missing_role""missing_scope""cross_org_denied""not_found""conflict""invalid_request""invalid_client""invalid_grant""invalid_redirect_uri""unauthenticated""registration_closed""invalid_target""invalid_dpop_proof""repeated_header""token_expired""missing_expiry""audience_mismatch""unsupported_critical""unregistered_client""redirect_uri_required""pushed_request_required""invalid_request_uri""request_uri_client_mismatch""invalid_request_object""unavailable""internal_error""access_denied""login_required""consent_required""interaction_required""unsupported_grant_type""invalid_scope""unauthorized_client""unsupported_response_type""account_selection_required""invalid_authorization_details""expired_token""request_not_supported""request_uri_not_supported""unsupported_token_type""invalid_token""use_dpop_nonce""authorization_pending""slow_down""invalid_client_metadata""invalid_software_statement""unapproved_software_statement""account_unavailable""insufficient_user_authentication""protected_account"no duplicates
The refusal causes this build can record in
metadata.cause.Each item:The RULE that produced a refusal, carried in a record's
metadata.cause.Show moreShow less
A reason is the error the client received, and one error covers many rules on purpose:
invalid_grantanswers an unknown code, a PKCE mismatch and a refresh token presented by the wrong client alike, because telling the caller which one fired would tell them whether the credential they hold is genuine. The cause is the operator's half of that distinction. Each token names one rule and means the same thing at every endpoint that applies it; the action,grant_type,methodandmetadata_fieldsay where.The second factor uses it the same way: one 401 answers a wrong code, a replayed one, a malformed one and a genuine one from a device whose clock is off, and refuses a missing, unknown, expired or foreign pending sign-in or session alike. The cause is where they differ.
A cause names a rule, never a value: no code, verifier, redirect URI or error description ever appears here. A value outside this vocabulary is never stored — the server drops it and lists
causeunder_dropped.Compatibility: closed and append-only, with the cost described on
AuditAction.Possible values"parameter_missing""grant_not_allowed""confidential_client_required""scope_not_registered""scope_exceeds_grant""resource_malformed""resource_not_granted""grant_client_mismatch""dpop_binding_mismatch""code_unknown""code_reused""redirect_uri_mismatch""pkce_verifier_missing""pkce_mismatch""pkce_required""pkce_verifier_unexpected""refresh_unknown""refresh_reused""session_ended""subject_revoked""grant_revoked""device_code_unknown""device_code_expired""authorization_denied""polling_too_fast""token_invalid""token_expired""missing_expiry""org_claim_mismatch""basic_header_malformed""multiple_auth_methods""client_id_mismatch""assertion_type_unsupported""client_unknown""client_lookup_failed""auth_method_mismatch""auth_method_unsupported""secret_missing""secret_not_registered""secret_mismatch""assertion_too_large""assertion_malformed""jwks_uri_missing""registered_alg_not_allowed""assertion_alg_not_allowed""assertion_typ_rejected""critical_header_unsupported""jwks_uri_invalid""jwks_fetch_failed""jwks_malformed""jwks_private_key_published""jwks_no_usable_key""assertion_kid_unknown""assertion_signature_invalid""assertion_sub_missing""assertion_sub_mismatch""assertion_iss_missing""assertion_iss_mismatch""assertion_aud_mismatch""assertion_exp_missing""assertion_expired""assertion_lifetime_too_long""assertion_not_yet_valid""assertion_iat_in_future""assertion_jti_missing""assertion_jti_too_large""assertion_is_request_object""assertion_replayed""replay_store_unavailable""request_canceled""panic_recovered""unknown_identifier""reset_link_unknown""verification_link_unknown""already_verified""invitation_link_unknown""password_mismatch""password_hash_malformed""password_not_set""account_locked""identifier_locked""address_throttled""identifier_throttled""verify_capacity""request_abandoned""account_unavailable""cross_site_request""identifier_taken""reserved_identifier""password_already_set""mail_relay_missing""captcha_missing""captcha_invalid""captcha_expired""captcha_replayed""captcha_unverifiable""code_mismatch""code_replayed""code_malformed""code_other_method""clock_skew""no_codes_left""lock_standing""no_factor""already_enrolled""enrollment_not_activated""verifier_saturated""seed_key_unknown""seed_integrity_failed""pending_absent""pending_unknown""pending_foreign_org""pending_expired""pending_not_enrollment""session_absent""session_unknown""session_foreign_org""session_expired""session_account_deleted""session_account_unavailable""issuer_unresolved""client_not_admin""org_claim_missing""grant_family_missing""software_statement_unsupported""blank_entry""value_unsupported""value_not_permitted""scope_reserved""refresh_without_issuing_grant""grant_response_mismatch""signing_alg_method_mismatch""too_many_values""uri_invalid""host_not_global""native_redirect_not_loopback""credential_missing""registration_token_invalid""operator_managed_client""client_secret_mismatch""concurrent_update""insufficient_scope""organization_missing""identity_not_allowed""operation_not_granted""organization_not_granted""namespace_not_granted""reserved_manager""admin_roles_label""invalid_field""immutable_field""main_organization""fips_unavailable""reserved_client_held""rp_timeout""rp_unreachable""rp_tls_failed""rp_transport_failed""rp_rejected""rp_misconfigured""rp_unavailable""logout_uri_invalid""no_delivery_slot""fanout_deadline""notifier_saturated""notifier_closed""egress_proxy_failed""aborted_at_shutdown""backchannel_not_registered""hint_absent""hint_malformed""hint_type_rejected""hint_key_unknown""hint_signature_invalid""hint_issuer_mismatch""hint_expired""hint_not_yet_valid""hint_claims_missing""hint_unverifiable""hint_subject_mismatch""logout_request_unknown""sid_missing""signing_key_unknown""signing_key_integrity_failed""token_malformed""token_typ_rejected""token_kid_unknown""token_alg_mismatch""token_signature_invalid""token_issuer_mismatch""token_issuer_unknown""token_not_yet_valid""dpop_proof_missing""dpop_proof_repeated""dpop_scheme_required""dpop_proof_too_large""dpop_malformed""dpop_typ_rejected""dpop_alg_not_allowed""dpop_jwk_missing""dpop_jwk_private""dpop_jwk_invalid""dpop_key_unsupported""dpop_signature_invalid""dpop_claim_missing""dpop_jti_too_large""dpop_htm_mismatch""dpop_htu_invalid""dpop_htu_mismatch""dpop_iat_too_old""dpop_iat_in_future""dpop_nonce_missing""dpop_nonce_stale""dpop_ath_missing""dpop_ath_mismatch""dpop_proof_replayed""signed_request_required""response_type_unsupported""response_mode_unsupported""pkce_method_unsupported""account_selection_unsupported""authorization_details_malformed""authorization_details_type_not_registered""request_object_malformed""request_object_alg_not_allowed""request_object_kid_unknown""request_object_signature_invalid""request_object_aud_mismatch""request_object_iss_mismatch""request_object_expired""request_object_not_yet_valid""request_uri_in_push""request_uri_not_pushed""request_uri_consumed""max_age_exceeded""consent_not_enabled""consent_not_granted""body_too_large""body_malformed""parameter_repeated""schema_invalid""cors_origin_denied""throttle_failed_open""throttle_failed_closed""cursor_tampered""cursor_scope_mismatch""cursor_sort_mismatch""unknown_organization""main_organization_prefixed""organization_lookup_failed""organization_build_failed""issuer_location_mismatch""sign_in_unknown""sign_in_too_old""second_factor_required""own_account""target_outranks_caller""owner_tier_required""platform_role_outside_main""role_outranks_caller""last_role_administrator""federation_state_invalid""upstream_denied""upstream_unavailable""upstream_token_invalid""upstream_email_missing""identity_provider_unknown""identity_provider_not_allowed""account_not_linked""email_domain_not_allowed"no duplicates
The kind of principal that caused an event.
anonymousis the correct value for every pre-authentication event: a failed sign-in has no principal yet, and the address that was typed is in the event metadata instead — putting it in the actor id would mint a phantom identifier that joins against nothing.Possible values"user""admin""client""system""anonymous"no duplicates
The kind of object an event acted upon.
audit_logis the log itself, for the events that record reading or exporting it.consentis one user's standing agreement with one client for one resource, named by the agreement's id, so every decision about it shares one target.Possible values"user""organization""client""session""token""factor""role""system""audit_log""consent"no duplicates
The closed value set of every metadata field that has one, in the server's field order.
Each item:The closed set of values one metadata field may carry. A value outside it is never stored: the server drops it and lists the key under
_dropped, exactly as it does an undeclared key. A field that holds a list (fails_closed,fails_open,carried_in,headers,audit_rewrite_routes) holds only values from the set, and is dropped whole if one is not.
401 Unauthorizedapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
Cache-Controlno-storeWWW-AuthenticatestringDPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json).
codeis a stable machine-readable slug for the problem kind (it mirrors the suffix oftype), so consumers can branch on it without parsing prose.errorsis present on validation failures and lists every offending field.- Example
"Request validation failed" - Example
400 - typestring · uriExample
"urn:problem-type:validation_error" - detailstringExample
"One or more fields did not satisfy the API schema." - codeenum
The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing
titleordetail, which are English prose for logs. A problem whose status says everything the server knows carries nocode.Show moreShow less
validation_erroris the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are theerrorslist — one entry per offending field — which a form renders on those fields.requiredandmalformedare spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.Compatibility: this is a CLOSED enum, with the same cost as
AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error" - instancestringExample
"/introspect" - request_idstringExample
"8d94ed49-1caf-4ab3-9594-557142f2d023" - trace_idstring
Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
Example"4bf92f3577b34da6a3ce929d0e0e4736" - errorsarray of objects
Field-level violations (present for validation errors).
Each item:A single field-level validation violation.
Show item attributesHide item attributes
Offending field, dotted for nested bodies (e.g. child.id).
Example"token_type_hint"Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
Example"not_allowed"- Example
"field token_type_hint must be one of [access_token, refresh_token]"
403 Forbiddenapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
Cache-Controlno-storeWWW-AuthenticatestringDPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json).
codeis a stable machine-readable slug for the problem kind (it mirrors the suffix oftype), so consumers can branch on it without parsing prose.errorsis present on validation failures and lists every offending field.- Example
"Request validation failed" - Example
400 - typestring · uriExample
"urn:problem-type:validation_error" - detailstringExample
"One or more fields did not satisfy the API schema." - codeenum
The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing
titleordetail, which are English prose for logs. A problem whose status says everything the server knows carries nocode.Show moreShow less
validation_erroris the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are theerrorslist — one entry per offending field — which a form renders on those fields.requiredandmalformedare spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.Compatibility: this is a CLOSED enum, with the same cost as
AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error" - instancestringExample
"/introspect" - request_idstringExample
"8d94ed49-1caf-4ab3-9594-557142f2d023" - trace_idstring
Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
Example"4bf92f3577b34da6a3ce929d0e0e4736" - errorsarray of objects
Field-level violations (present for validation errors).
Each item:A single field-level validation violation.
Show item attributesHide item attributes
Offending field, dotted for nested bodies (e.g. child.id).
Example"token_type_hint"Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
Example"not_allowed"- Example
"field token_type_hint must be one of [access_token, refresh_token]"
429 Too Many Requestsapplication/problem+jsonToo many requests.
Too many requests.
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json).
codeis a stable machine-readable slug for the problem kind (it mirrors the suffix oftype), so consumers can branch on it without parsing prose.errorsis present on validation failures and lists every offending field.- Example
"Request validation failed" - Example
400 - typestring · uriExample
"urn:problem-type:validation_error" - detailstringExample
"One or more fields did not satisfy the API schema." - codeenum
The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing
titleordetail, which are English prose for logs. A problem whose status says everything the server knows carries nocode.Show moreShow less
validation_erroris the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are theerrorslist — one entry per offending field — which a form renders on those fields.requiredandmalformedare spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.Compatibility: this is a CLOSED enum, with the same cost as
AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error" - instancestringExample
"/introspect" - request_idstringExample
"8d94ed49-1caf-4ab3-9594-557142f2d023" - trace_idstring
Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
Example"4bf92f3577b34da6a3ce929d0e0e4736" - errorsarray of objects
Field-level violations (present for validation errors).
Each item:A single field-level validation violation.
Show item attributesHide item attributes
Offending field, dotted for nested bodies (e.g. child.id).
Example"token_type_hint"Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
Example"not_allowed"- Example
"field token_type_hint must be one of [access_token, refresh_token]"
Errorapplication/problem+jsonProblem details (RFC 9457) with an RFC 6750 / RFC 9449 challenge.
Headers
Cache-Controlno-storeWWW-AuthenticatestringDPoP-Noncestring
Body
RFC 9457 (formerly RFC 7807) problem details (application/problem+json).
codeis a stable machine-readable slug for the problem kind (it mirrors the suffix oftype), so consumers can branch on it without parsing prose.errorsis present on validation failures and lists every offending field.- Example
"Request validation failed" - Example
400 - typestring · uriExample
"urn:problem-type:validation_error" - detailstringExample
"One or more fields did not satisfy the API schema." - codeenum
The kind of problem, as a stable machine-readable slug a client branches on and translates rather than parsing
titleordetail, which are English prose for logs. A problem whose status says everything the server knows carries nocode.Show moreShow less
validation_erroris the one code whose message is not a sentence about the code itself: the request failed the schema, and the specifics are theerrorslist — one entry per offending field — which a form renders on those fields.requiredandmalformedare spelled like two of the per-field violation codes (FieldError.code) but mean something else; the two vocabularies are told apart by position, never by spelling.Compatibility: this is a CLOSED enum, with the same cost as
AuditAction: a client generated against an older version of this document rejects a problem carrying a code added after it was built. Regenerate on upgrade, or decode the field as a plain string. It is enumerated anyway so that what a client must translate is knowable from the contract alone.Possible values"invalid_request""invalid_credentials""forbidden""unauthorized""insufficient_user_authentication""protected_account""last_role_administrator""invalid_code""too_many_requests""too_many_attempts""account_locked""account_unavailable""already_enrolled""registration_disabled""registration_conflict""captcha_failed""invalid_reset_link""invalid_verification_link""invalid_invitation_link""mail_relay_missing""not_found""conflict""unavailable""busy""window_too_large""too_many_series""internal_error""rate_limited""malformed""body_too_large""required""validation_error""unknown_org""invalid_token""invalid_dpop_proof""use_dpop_nonce""server_error" - instancestringExample
"/introspect" - request_idstringExample
"8d94ed49-1caf-4ab3-9594-557142f2d023" - trace_idstring
Distributed-trace id (hex) for correlating this response with traces and logs. Present only when tracing is enabled and the request was recorded. Opaque and safe to log/share.
Example"4bf92f3577b34da6a3ce929d0e0e4736" - errorsarray of objects
Field-level violations (present for validation errors).
Each item:A single field-level validation violation.
Show item attributesHide item attributes
Offending field, dotted for nested bodies (e.g. child.id).
Example"token_type_hint"Machine-readable violation code: required, too_short, too_long, pattern, invalid_format, not_allowed, minimum, maximum, multiple_of, too_few, too_many, not_unique, malformed.
Example"not_allowed"- Example
"field token_type_hint must be one of [access_token, refresh_token]"