Problem code runbooks

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

One runbook per code of an RFC 9457 problem response. A problem's type, https://nauthera.io/problems/<code>, redirects to its page here.

Code	What it means
`invalid_request`	A handler refused a request it could read but cannot act on (400).
`invalid_credentials`	The email address and password, or the passkey, did not verify (401).
`forbidden`	The caller may not do this, or the request looked cross-site (403).
`unauthorized`	The caller is not signed in, or the sign-in or admin token no longer counts (401).
`insufficient_user_authentication`	The admin operation needs a more recent sign-in, or one with a second factor (401).
`protected_account`	The admin change targets the caller's own account or a more privileged one (403).
`password_held_by_directory`	The user's password lives in their organization's directory, which the server only reads (409).
`last_role_administrator`	The change would leave the organization with nobody able to grant roles (409).
`invalid_code`	The second-factor or recovery code was wrong or already used (401).
`too_many_requests`	A throttle in a handler tripped; slow down and retry later (429).
`too_many_attempts`	An attempt budget is spent; retrying cannot help, start over (429).
`account_locked`	The account is temporarily locked after repeated failed sign-ins (429).
`account_unavailable`	The right password for an account an administrator suspended or blocked (403).
`already_enrolled`	The user already has the second factor they are trying to enrol (409).
`registration_disabled`	Self-service registration is turned off on this deployment (403).
`registration_conflict`	The account could not be created with this address (409).
`captcha_failed`	The request carried no captcha solution, or one that is wrong, expired or used (400).
`invalid_reset_link`	The password-reset link is unknown, expired, used or another organization's (400).
`password_reused`	The new password is the same as the one the account must replace (400).
`password_too_short`	The new password has fewer characters than the deployment accepts (400).
`password_too_long`	The new password has more characters than the deployment accepts (400).
`password_compromised`	The new password is a common one or appears in a breach corpus (400).
`invalid_verification_link`	The email-verification link is unknown, expired, used or no longer matches (400).
`invalid_invitation_link`	The invitation link was never issued, has expired, was used or no longer applies (400).
`mail_relay_missing`	The organization has no email relay, so the message cannot be sent (409 or 503).
`email_unverified`	The email second factor cannot be enrolled because the address is not verified (409).
`not_found`	No such resource, or the request names nothing the server serves (404).
`conflict`	The change collides with the current state, a duplicate or a concurrent change (409).
`unavailable`	The feature is not available here, or something it depends on could not answer (503).
`busy`	An aggregate read was turned away; the server is computing as many as it allows (503).
`window_too_large`	An audit count or ranking asked for a window longer than its bucket allows (400).
`too_many_series`	An audit count would return too many series times buckets (400).
`internal_error`	The server accepted the operation and could not complete it (500).
`rate_limited`	The per-IP request rate limit was exceeded; honour Retry-After (429).
`malformed`	A parameter or body could not be read, or a parameter was repeated (400).
`body_too_large`	The request body is larger than the server reads (413).
`required`	The operation needs a request body and none was sent (400).
`validation_error`	The request failed the schema; the errors list names each offending field (400).
`unknown_org`	The path's /orgs/{slug} names no organization served there (404).
`invalid_token`	UserInfo refused the access token, which is missing, invalid, expired or misused (401).
`invalid_dpop_proof`	UserInfo refused the DPoP proof for a bound access token (401).
`use_dpop_nonce`	Retry the UserInfo request with the nonce sent in the DPoP-Nonce header (401).
`server_error`	UserInfo could not check the access token; keep the token and retry (500).