# Problem code runbooks

> One runbook per code of an RFC 9457 problem response. A problem's type, https://nauthera.io/problems/<code>, redirects to its page here.

One runbook per `code` of an RFC 9457 problem response. A problem's `type`, `https://nauthera.io/problems/<code>`, redirects to its page here.

| Code | What it means |
|---|---|
| [`invalid_request`](https://www.nauthera.io/docs/v1/runbooks/problems/invalid_request) | A handler refused a request it could read but cannot act on (400). |
| [`invalid_credentials`](https://www.nauthera.io/docs/v1/runbooks/problems/invalid_credentials) | The email address and password, or the passkey, did not verify (401). |
| [`forbidden`](https://www.nauthera.io/docs/v1/runbooks/problems/forbidden) | The caller may not do this, or the request looked cross-site (403). |
| [`unauthorized`](https://www.nauthera.io/docs/v1/runbooks/problems/unauthorized) | The caller is not signed in, or the sign-in or admin token no longer counts (401). |
| [`insufficient_user_authentication`](https://www.nauthera.io/docs/v1/runbooks/problems/insufficient_user_authentication) | The admin operation needs a more recent sign-in, or one with a second factor (401). |
| [`protected_account`](https://www.nauthera.io/docs/v1/runbooks/problems/protected_account) | The admin change targets the caller's own account or a more privileged one (403). |
| [`password_held_by_directory`](https://www.nauthera.io/docs/v1/runbooks/problems/password_held_by_directory) | The user's password lives in their organization's directory, which the server only reads (409). |
| [`last_role_administrator`](https://www.nauthera.io/docs/v1/runbooks/problems/last_role_administrator) | The change would leave the organization with nobody able to grant roles (409). |
| [`invalid_code`](https://www.nauthera.io/docs/v1/runbooks/problems/invalid_code) | The second-factor or recovery code was wrong or already used (401). |
| [`too_many_requests`](https://www.nauthera.io/docs/v1/runbooks/problems/too_many_requests) | A throttle in a handler tripped; slow down and retry later (429). |
| [`too_many_attempts`](https://www.nauthera.io/docs/v1/runbooks/problems/too_many_attempts) | An attempt budget is spent; retrying cannot help, start over (429). |
| [`account_locked`](https://www.nauthera.io/docs/v1/runbooks/problems/account_locked) | The account is temporarily locked after repeated failed sign-ins (429). |
| [`account_unavailable`](https://www.nauthera.io/docs/v1/runbooks/problems/account_unavailable) | The right password for an account an administrator suspended or blocked (403). |
| [`already_enrolled`](https://www.nauthera.io/docs/v1/runbooks/problems/already_enrolled) | The user already has the second factor they are trying to enrol (409). |
| [`registration_disabled`](https://www.nauthera.io/docs/v1/runbooks/problems/registration_disabled) | Self-service registration is turned off on this deployment (403). |
| [`registration_conflict`](https://www.nauthera.io/docs/v1/runbooks/problems/registration_conflict) | The account could not be created with this address (409). |
| [`captcha_failed`](https://www.nauthera.io/docs/v1/runbooks/problems/captcha_failed) | The request carried no captcha solution, or one that is wrong, expired or used (400). |
| [`invalid_reset_link`](https://www.nauthera.io/docs/v1/runbooks/problems/invalid_reset_link) | The password-reset link is unknown, expired, used or another organization's (400). |
| [`password_reused`](https://www.nauthera.io/docs/v1/runbooks/problems/password_reused) | The new password is the same as the one the account must replace (400). |
| [`password_too_short`](https://www.nauthera.io/docs/v1/runbooks/problems/password_too_short) | The new password has fewer characters than the deployment accepts (400). |
| [`password_too_long`](https://www.nauthera.io/docs/v1/runbooks/problems/password_too_long) | The new password has more characters than the deployment accepts (400). |
| [`password_compromised`](https://www.nauthera.io/docs/v1/runbooks/problems/password_compromised) | The new password is a common one or appears in a breach corpus (400). |
| [`invalid_verification_link`](https://www.nauthera.io/docs/v1/runbooks/problems/invalid_verification_link) | The email-verification link is unknown, expired, used or no longer matches (400). |
| [`invalid_invitation_link`](https://www.nauthera.io/docs/v1/runbooks/problems/invalid_invitation_link) | The invitation link was never issued, has expired, was used or no longer applies (400). |
| [`mail_relay_missing`](https://www.nauthera.io/docs/v1/runbooks/problems/mail_relay_missing) | The organization has no email relay, so the message cannot be sent (409 or 503). |
| [`email_unverified`](https://www.nauthera.io/docs/v1/runbooks/problems/email_unverified) | The email second factor cannot be enrolled because the address is not verified (409). |
| [`not_found`](https://www.nauthera.io/docs/v1/runbooks/problems/not_found) | No such resource, or the request names nothing the server serves (404). |
| [`conflict`](https://www.nauthera.io/docs/v1/runbooks/problems/conflict) | The change collides with the current state, a duplicate or a concurrent change (409). |
| [`unavailable`](https://www.nauthera.io/docs/v1/runbooks/problems/unavailable) | The feature is not available here, or something it depends on could not answer (503). |
| [`busy`](https://www.nauthera.io/docs/v1/runbooks/problems/busy) | An aggregate read was turned away; the server is computing as many as it allows (503). |
| [`window_too_large`](https://www.nauthera.io/docs/v1/runbooks/problems/window_too_large) | An audit count or ranking asked for a window longer than its bucket allows (400). |
| [`too_many_series`](https://www.nauthera.io/docs/v1/runbooks/problems/too_many_series) | An audit count would return too many series times buckets (400). |
| [`internal_error`](https://www.nauthera.io/docs/v1/runbooks/problems/internal_error) | The server accepted the operation and could not complete it (500). |
| [`rate_limited`](https://www.nauthera.io/docs/v1/runbooks/problems/rate_limited) | The per-IP request rate limit was exceeded; honour Retry-After (429). |
| [`malformed`](https://www.nauthera.io/docs/v1/runbooks/problems/malformed) | A parameter or body could not be read, or a parameter was repeated (400). |
| [`body_too_large`](https://www.nauthera.io/docs/v1/runbooks/problems/body_too_large) | The request body is larger than the server reads (413). |
| [`required`](https://www.nauthera.io/docs/v1/runbooks/problems/required) | The operation needs a request body and none was sent (400). |
| [`validation_error`](https://www.nauthera.io/docs/v1/runbooks/problems/validation_error) | The request failed the schema; the errors list names each offending field (400). |
| [`unknown_org`](https://www.nauthera.io/docs/v1/runbooks/problems/unknown_org) | The path's /orgs/\{slug\} names no organization served there (404). |
| [`invalid_token`](https://www.nauthera.io/docs/v1/runbooks/problems/invalid_token) | UserInfo refused the access token, which is missing, invalid, expired or misused (401). |
| [`invalid_dpop_proof`](https://www.nauthera.io/docs/v1/runbooks/problems/invalid_dpop_proof) | UserInfo refused the DPoP proof for a bound access token (401). |
| [`use_dpop_nonce`](https://www.nauthera.io/docs/v1/runbooks/problems/use_dpop_nonce) | Retry the UserInfo request with the nonce sent in the DPoP-Nonce header (401). |
| [`server_error`](https://www.nauthera.io/docs/v1/runbooks/problems/server_error) | UserInfo could not check the access token; keep the token and retry (500). |