# invalid_target

The resource indicator is malformed or was not part of the grant (RFC 8707 §2).

## Meaning

Sent when `resource` is not an absolute URI without a fragment, at `/authorize`
(redirected to the client), `/par`, `/device_authorization` and `/token`; and at
`/token` when a refresh or code redemption names a resource the original authorization
did not cover.

## Impact

The client gets no token for that resource. A client bug or a change in the resource
the application asks for between authorization and token request.

## Diagnosis

The audit record has reason `invalid_target` and cause `resource_malformed` or
`resource_not_granted`, and records the resource requested. Compare it with the
`resource` sent at `/authorize`.

## Mitigation

- As a client developer: send an absolute URI without a fragment, and at `/token` only a
  resource included in the authorization request; to reach another resource, authorize
  again.
- As an operator: nothing to change on the server.
- As a user: tell the application's owner.

## Escalation

If a resource that was authorized is refused at `/token`, open an issue with the request
id, the server version and both resource values.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.