Skip to content
Szenera DeveloperDocs
API › Error codes › Error codes: accounts and sessions
Chapters

Error codes: accounts and sessions

The codes of the areas Identity and Sessions: user accounts, keys, invitations, sign-in, second factor, sessions.

12 minute readAPIUpdated: 10/25/2026

On this page

Before you start

For
Anyone who manages accounts or keys through the API or builds a sign-in.
Prerequisite
know the error format — see The error format

The codes of the Identity and Sessions areas: user accounts, operator accounts, API keys, connected applications, SCIM tokens, device accounts, sign-in, second factor, refresh, and impersonation.

How to read the tables

Read the tables like this: Code is the value of the code field in the error body. Your logic switches on it, never on message. Meaning and Typical trigger classify the case. HTTP is the status actually sent. Expected reaction is your client’s response, drawn from a fixed vocabulary that is the same on all seven error-code pages: “check credentials” (401), “check permission or package” (402, 403), “correct the input” (400, 413, 415, 422), “reload, resend” (version conflicts), “do not retry, check the operation” (404, 409, 410, 426), “wait (Retry-After)” (429), and “retry later, report the trace ID if it recurs” (5xx).

The codes

Accounts, keys, devices (Identity)

Accounts, operator accounts, API keys, and devices. For integrations, the key codes are the most important. ApiKey.ScopeEscalationBlocked (403) means the key asks for more than its creator is allowed to do. ApiKey.ScopeNotKeyCapable (422) means a chosen permission is not intended for keys, and asking does not help here, only a different approach. Two more are ApiKey.ExpiresAtInPast (422) and ApiKey.AlreadyRevoked (409), because revocation is final. The OperatorApiKey.* codes concern operator keys (opk_). Then there are the forms of access that are not tied to a person: OAuthClient.* and OAuthAuthorization.* for connected applications. OAuthAuthorization.Expired (410) and OAuthAuthorization.AlreadyDecided (409) are the ones you will see most often, and both mean “restart the consent”. Finally, ScimToken.* covers the access with which a staff directory syncs accounts. Among the Device.* codes, Device.Blocked (409) rejects a blocked device until the operator lifts the block.

Code Meaning Typical trigger HTTP Expected reaction
User.NotFound Account not found Access to an unknown account ID 404 do not retry, check the operation
User.EmailAlreadyExists Email already taken Creation with an address that is already in use 409 do not retry, check the operation
User.PlanSeatQuotaExceeded Seat limit reached Account over the seat limit of the package 422 correct the input
User.MissingCredential Sign-in credentials missing Account with neither a password nor a company sign-in 422 correct the input
User.SsoInconsistent Company sign-in state inconsistent Contradictory link to the company sign-in 422 correct the input
User.SsoUnlinkRequiresPassword Unlinking the sign-in requires a password Unlinking without a password set 422 correct the input
User.CurrentPasswordMismatch Current password incorrect Password change with the wrong current password 400 correct the input
User.PasswordAlreadySet Password already set First password for an account that already has one 409 do not retry, check the operation
User.RoleEscalationBlocked Permission escalation blocked Assigning higher permissions than your own 403 check permission or package
User.LastRoleRemovalBlocked Last role cannot be removed Demoting the last Owner 409 do not retry, check the operation
User.RoleRequired Role is required Assignment without a role — an account has exactly one 422 correct the input
User.MultipleRolesNotAllowed More than one role Assignment with several roles 422 correct the input
User.LastOwnerSuspensionBlocked Last Owner cannot be suspended Suspending the only active Owner 409 do not retry, check the operation
User.CannotSuspendSelf Self-suspension blocked Suspending your own account 403 check permission or package
User.CannotModifySelf Own role cannot be changed Role change on your own account 403 check permission or package
User.AlreadySuspended Already suspended Duplicate suspension 409 do not retry, check the operation
User.NotSuspended Not suspended Unsuspending an active account 409 do not retry, check the operation
User.AlreadyDeleted Already deleted Duplicate deletion 409 do not retry, check the operation
User.NotDeleted Account is not deleted Second stage of deletion (pseudonymization) on a live account — it removes the address and access of the account and must never run while the deletion is not final 409 do not retry, check the operation
User.NotPending Not in the pending state Action requires the pending state 409 do not retry, check the operation
User.MfaAlreadyEnabled Second factor already active Duplicate activation of the second factor 409 do not retry, check the operation
User.MfaSetupNotStarted Second-factor setup not started Confirmation without a started setup 409 do not retry, check the operation
User.MfaNotEnabled Second factor not active Action on the second factor although it is not active 409 do not retry, check the operation
User.InvalidMfaCode Second-factor code invalid Wrong code for an action on the account 401 check credentials
OperatorUser.NotFound Operator account not found Unknown ID of the operator account 404 do not retry, check the operation
OperatorUser.EmailAlreadyExists Address of the operator account taken Creation with an address that is already in use 409 do not retry, check the operation
OperatorUser.CannotSuspendSelf Self-suspension not permitted Operator account suspends itself 403 check permission or package
OperatorUser.CannotModifySelf Own role cannot be changed Operator account changes its own role 403 check permission or package
OperatorUser.CannotSuspendOwner Owner cannot be suspended Suspending the owner, transfer the owner role first 409 do not retry, check the operation
OperatorUser.OwnerRoleImmutable Owner role cannot be changed Role change on the owner, only the transfer replaces the owner 409 do not retry, check the operation
OperatorUser.OwnerRequired Only the owner may do this Roles, transfer, or creation by an account that is not the owner 403 check permission or package
OperatorUser.OwnerTransferTargetInvalid Transfer target not possible Own account, a suspended account, or the owner itself as the target 422 correct the input
OperatorUser.OwnerTransferNotFound No transfer offer Acceptance without an open offer to this account 404 do not retry, check the operation
OperatorUser.OwnerTransferExpired Transfer offer expired Acceptance after the seven days have passed 409 do not retry, check the operation
OperatorUser.RecoveryCodeConsumed Recovery code used up Reused code 409 do not retry, check the operation
OperatorUser.AlreadySuspended Operator account already suspended Duplicate suspension 409 do not retry, check the operation
OperatorUser.NotSuspended Operator account not suspended Unsuspending an active operator account 409 do not retry, check the operation
ApiKey.NotFound API key not found Unknown key ID 404 do not retry, check the operation
ApiKey.ScopeEscalationBlocked Permission escalation blocked Key with more permissions than its issuer 403 check permission or package
ApiKey.ScopeNotKeyCapable Permission not intended for keys A permission scope that includes a permission the catalog never assigns to keys. Separate from the escalation block: if you have too few permissions of your own, asking for more helps. If keys can never carry the permission, only a different approach helps 422 correct the input
ApiKey.AlreadyRevoked API key already revoked Duplicate revocation 409 do not retry, check the operation
ApiKey.ExpiresAtInPast Expiry in the past Issuing with an expiry in the past 422 correct the input
OAuthClient.NotFound Connected application not found A client ID for which no registration exists 404 do not retry, check the operation
OAuthClient.AlreadyBlocked Application is already blocked A second block on the same client. It would change nothing and only overwrite the first reason 409 do not retry, check the operation
OAuthClient.NotBlocked Application is not blocked Unblocking a client that is not blocked — usually the wrong ID 409 do not retry, check the operation
OAuthAuthorization.NotFound Consent request not found Opening or deciding with an unknown request ID 404 do not retry, check the operation
OAuthAuthorization.AlreadyDecided Request already decided A second allow or deny of the same request. Without this guard, a single approval would produce a second code 409 do not retry, check the operation
OAuthAuthorization.Expired Consent request expired The time limit has passed. Deliberately 410 and not 404: the request did exist, and the flow starts over from your application 410 do not retry, check the operation
OAuthAuthorization.ScopeNotDelegatable Permission cannot be delegated to applications The request names a permission key that the catalog never assigns to machines. Unlike having too few permissions of your own, asking does not help here, only a different approach 422 correct the input
OAuthAuthorization.ScopeEscalationBlocked Permission escalation blocked The consent asks for more than the consenting person holds 422 correct the input
OAuthAuthorization.DelegationDisabled Delegated access switched off This organization does not have the capability for delegated access. The request is stopped where the person decides, not only at the exchange 403 check permission or package
OperatorApiKey.NotFound Operator key not found Unknown key ID when rotating or revoking 404 do not retry, check the operation
OperatorApiKey.PermissionEscalationBlocked Permission escalation blocked Key with more permissions than its issuer holds 403 check permission or package
OperatorApiKey.PermissionNotKeyCapable Permission not intended for keys The requested permission is not on the allowlist for machine access 422 correct the input
OperatorApiKey.AlreadyRevoked Operator key already revoked Duplicate revocation — revocation is final (forensics) 409 do not retry, check the operation
ScimToken.SsoProviderRequired No active company sign-in method Issuing a SCIM token before the organization has an active sign-in method. The accounts created this way would otherwise have no sign-in procedure 409 do not retry, check the operation
ScimToken.NotFound No SCIM token exists Rotating or revoking although none has been issued 404 do not retry, check the operation
ScimToken.AlreadyExists SCIM token already exists A second issuance alongside a valid token. Switching goes through rotation and has a route of its own 409 do not retry, check the operation
ScimToken.AlreadyRevoked SCIM token already revoked Duplicate revocation — it is final 409 do not retry, check the operation
Device.NotFound Device not found Unknown device ID 404 do not retry, check the operation
Device.DuplicateHardwareSerial Serial number duplicated Reconnecting a web display under a known serial number with a different secret 409 do not retry, check the operation
Device.ReregistrationPending Re-registration awaits confirmation Registration of a paired device with a new key, for example after reflashing. The organization decides in the device record, and the rejection carries the device name in details.deviceName. For 24 hours after Accept, keep displays, the same key is issued a certificate 409 do not retry, check the operation
Device.ReregistrationNotPending No re-registration open Decision about a device that has not reported with a new key 409 do not retry, check the operation
Device.CertFingerprintConflict Certificate fingerprint duplicated Fingerprint already assigned 409 do not retry, check the operation
Device.InvalidCsr Certificate request invalid Malformed certificate request 400 correct the input
Device.CertNotEligibleForRotation Rotation not permitted Certificate cannot be rotated yet 409 do not retry, check the operation
Device.AlreadyClaimed Device already claimed Duplicate pairing, or a browser signs in under the ID of a paired web display. Its way back is Create a new address 409 do not retry, check the operation
Device.NotActive Device not active Action on an inactive device 409 do not retry, check the operation
Device.Decommissioned Device decommissioned (legacy) No longer issued. The device agent still reads the code as an order to restore factory settings 409 do not retry, check the operation
Device.Blocked Device blocked Re-registration, release, or a repeated block of a blocked device 409 do not retry, check the operation
Device.NotBlocked Device not blocked Unblocking a device that is not blocked 409 do not retry, check the operation
Device.DisplaySecretInvalid Device secret unknown Call from a web display with a wrong or missing secret 401 check credentials
Device.ConnectLinkInvalid Connect link invalid Link used up, expired, or display already taken over 410 do not retry, check the operation

Sign-in and sessions (Sessions)

Sign-in with a password, magic link, company sign-in, and platform-wide providers, second factor, refresh, password reset, and impersonation by the operator. The codes with 410 mark links that are used up or expired. A new link is the only way.

Code Meaning Typical trigger HTTP Expected reaction
Login.InvalidCredentials Sign-in credentials incorrect Wrong password or wrong email address 401 check credentials
Login.AccountSuspended Account suspended Sign-in of a suspended account 403 check permission or package
Login.TenantSuspended Organization suspended Sign-in to a suspended organization 403 check permission or package
Login.ChoiceTicketInvalid Choice ticket invalid Organization choice with an unknown, expired, or already redeemed ticket (also: another device) 401 check credentials
Login.OrganizationNotEligible Organization not selectable The chosen organization is not in the ticket’s set 403 check permission or package
Login.SsoRequired Company sign-in enforced Password, magic link, or reset for an address in a verified domain of the company sign-in 403 check permission or package
Login.HandoffTicketInvalid Handoff ticket invalid Ticket unknown, expired (3 min), or already redeemed 401 check credentials
Mfa.InvalidCode Second-factor code invalid Wrong code at sign-in 401 check credentials
Mfa.TooManyAttempts Too many second-factor attempts Failed-attempt limit exceeded 429 wait (Retry-After)
Mfa.NotEnabled Second factor not active Sign-in with a second factor although none is active 409 do not retry, check the operation
Session.NotFound Session not found Unknown session ID 404 do not retry, check the operation
Session.Revoked Session revoked Use of a revoked session 401 check credentials
Session.Expired Session expired Expired session 401 check credentials
RefreshToken.Invalid Refresh token invalid Malformed or unknown token, or a token of the wrong session type on the route (organization ↔ operator account) 401 check credentials
RefreshToken.TheftDetected Token theft detected Reused refresh token 401 check credentials
PasswordReset.TokenInvalid Reset token invalid Malformed token 400 correct the input
PasswordReset.TokenExpired Reset token expired Expired token 410 do not retry, check the operation
PasswordReset.TokenUsed Reset token already used Already redeemed 410 do not retry, check the operation
MagicLink.TokenInvalid Magic link invalid Malformed token 400 correct the input
MagicLink.TokenExpired Magic link expired Expired token 410 do not retry, check the operation
MagicLink.TokenUsed Magic link already used Already redeemed 410 do not retry, check the operation
Sso.StateInvalid Callback state invalid Tampered or expired callback state 401 check credentials
Sso.ProviderUnavailable Sign-in method unavailable Starting sign-in with an unknown, inactive, or unreachable provider 404 do not retry, check the operation
Sso.CallbackFailed Callback failed The provider reports an error, or the token exchange or the check of the ID token fails 401 check credentials
Social.ProviderUnavailable Provider not set up Starting sign-in with Google, Microsoft, or Apple although the platform has not configured the provider 503 retry later, report the trace ID if it recurs
Social.EmailUnverified Address not verified The provider returns no verified address — without it, no first link is created 403 check permission or package
Social.LinkConflict ID already taken The same provider ID is already attached to another account 409 do not retry, check the operation
Social.NoAccount No account for the address The verified address belongs to no account — the path ends in sign-up 404 do not retry, check the operation
Impersonation.ReasonRequired Reason required Impersonation without a reason 422 correct the input
Impersonation.LifetimeExceeded Impersonation expired Upper limit of 4 hours exceeded 401 check credentials

Count

This page lists 103 codes. Together with the other six error-code pages this gives 493 domain codes (4xx) and 119 server errors (5xx), 612 codes in all — the complete catalog of the platform.