# temporarily_unavailable

The server could not establish what it needed to answer, and the request may succeed if retried (RFC 6749 §4.1.2.1).

## Meaning

The server's own failure, never a verdict on the request. Sent with `503` when the client
registry cannot be read while authenticating a client (`/token`, `/introspect`,
`/revoke`, `/par`, `/device_authorization`), when introspection or revocation cannot
reach the token store, when `/register` cannot read the registry or is not enabled, and
when `/end_session` cannot read the session. `/token` also answers it for the token
exchange and JWT bearer grants, which are declared but not implemented yet.

## Impact

While a dependency is failing, sign-ins and token requests fail for every client of the
organization, and users see the application's error. For the two unimplemented grants it
is permanent until they are built, and no retry helps.

## Diagnosis

1. The audit record has outcome `errored` and reason `unavailable`; for a client
   authentication the cause is `client_lookup_failed`. Find it by `X-Request-ID`.
2. Check the database and Redis, the server's readiness and its error log around the
   same time; the request id joins the log lines.
3. If the description says the grant "is not yet available", it is one of the
   unimplemented grants, not an outage.

## Mitigation

- As a client developer: retry with backoff; do not treat it as a refusal of the
  credential. Do not use token exchange or JWT bearer grants against this server.
- As an operator: restore the failing dependency; the condition clears once it answers.
- As a user: try again in a moment.

## Escalation

If it persists while the database and Redis are healthy, open an issue with the request
id, the server version and the matching server log lines. Never attach tokens or secrets.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.