Error codes

When the API refuses a request, the response body is an error envelope:

{
  "error": {
    "code": "agent-not-found",
    "message": "…",
    "requestId": "…"
  }
}

Excerpt

code says what went wrong. Match on it: it stays the same, while message is written for people and can change.
details, when present, holds the facts the code needs: a limit, the field at fault, when to retry.
requestId identifies the request in the runtime's logs. Quote it when you report a problem.

The TypeScript and Python clients raise these as typed errors with the same code. The codes below are grouped by their HTTP status.

400 Bad Request

`auth-not-session-token`

Synopsis

400 Bad Request, code auth-not-session-token

POST /v1/auth/refresh or POST /v1/auth/logout was called with a token that isn't a session token (kgi_sk_*). Bearer API tokens are managed through /v1/tokens.

Details

None.

Example

{ "error": { "code": "auth-not-session-token", "message": "…", "requestId": "…" } }

Excerpt

See also

`bad-input`

Synopsis

400 Bad Request, code bad-input

The request is malformed: the body isn't valid JSON or isn't an object, a JSON body nests objects and arrays deeper than the limit, a field has the wrong type or value, a projectId isn't a UUID, or a cursor wasn't issued by this list. Fix the input named in the message.

Details

maxDepth: the most levels a JSON body may nest, when it nests deeper

Example

{ "error": { "code": "bad-input", "message": "…", "details": { "maxDepth": "…" }, "requestId": "…" } }

Excerpt

See also

PATCH /v1/system/tenants/{tenantId}
GET /v1/system/usage
GET /v1/usage
PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint
GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env
PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env
25 more operations name it in their responses

`blob-hash-mismatch`

Synopsis

400 Bad Request, code blob-hash-mismatch

The uploaded bytes don't match the expectedHash you sent. Nothing is stored; recompute the hash or resend the bytes.

Details

expected: the hash you declared
actual: the hash of the bytes received

Example

{ "error": { "code": "blob-hash-mismatch", "message": "…", "details": { "expected": "…", "actual": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/artifacts

`blob-size-mismatch`

Synopsis

400 Bad Request, code blob-size-mismatch

The uploaded bytes aren't the size you declared. Nothing is stored; send the right size or the full body.

Details

declared: the size you declared
actual: the size of the bytes received

Example

{ "error": { "code": "blob-size-mismatch", "message": "…", "details": { "declared": "…", "actual": "…" }, "requestId": "…" } }

Excerpt

See also

Keep files with a run

`cookie-session-not-refreshable`

Synopsis

400 Bad Request, code cookie-session-not-refreshable

POST /v1/auth/refresh was called with a browser (cookie) session. These sessions aren't refreshed; sign in again when the session ends.

Details

None.

Example

{ "error": { "code": "cookie-session-not-refreshable", "message": "…", "requestId": "…" } }

Excerpt

See also

Sessions

`deployment-validation-failed`

Synopsis

400 Bad Request, code deployment-validation-failed

The deployment's manifest has invalid definitions, or a tool names a model provider's key. Each problem is listed in details.issues; fix them and deploy again.

Details

issues: list of problems, each naming the primitive, its index, id, path and message

Example

{ "error": { "code": "deployment-validation-failed", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

`dispatcher-input-invalid`

Synopsis

400 Bad Request, code dispatcher-input-invalid

The eval run's input doesn't fit the suite's kind: neither an agent nor a flow reference was given, or the kind's validation rejected the target or comparison.

Details

None.

Example

{ "error": { "code": "dispatcher-input-invalid", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/eval-runs/{runId}/rescore

`endpoint-url-invalid`

Synopsis

400 Bad Request, code endpoint-url-invalid

The pack service URL the operator set for a deployment isn't https://<host>: it isn't https, or it has user info, a path, a query or a fragment. The message says which. Send the service's origin only. The refusal is recorded as the deployment's endpoint.problem.

Details

None.

Example

{ "error": { "code": "endpoint-url-invalid", "message": "…", "requestId": "…" } }

Excerpt

See also

`env-cross-scope`

Synopsis

400 Bad Request, code env-cross-scope

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "env-cross-scope", "message": "…", "requestId": "…" } }

Excerpt

See also

Set values per environment

`env-name-mismatch`

Synopsis

400 Bad Request, code env-name-mismatch

The envName in the body differs from the envName in the query string. Send one, or make them equal.

Details

None.

Example

{ "error": { "code": "env-name-mismatch", "message": "…", "requestId": "…" } }

Excerpt

See also

`env-name-required`

Synopsis

400 Bad Request, code env-name-required

The envName query parameter is missing, or isn't a valid environment name (lowercase letters, digits and hyphens, starting with a letter, up to 63 characters).

Details

None.

Example

{ "error": { "code": "env-name-required", "message": "…", "requestId": "…" } }

Excerpt

See also

DELETE /v1/env/{name}

`image-unverifiable`

Synopsis

400 Bad Request, code image-unverifiable

The runtime couldn't verify the deployment's image: the registry probe failed, or the registry's digest differs from the digest in the image reference.

Details

imageRef: the image reference that was checked
cause: when a registry read failed, why: image-not-found, image-file-not-found, image-registry-unreachable, image-registry-unauthorized, image-unreadable (a layer that isn't an archive the runtime can read), or image-limit-exceeded (the image is past one of the runtime's bounds on reading an image). Absent when the read succeeded and the check after it failed
limit: with image-limit-exceeded, the bound: manifest, file, layer, read or unpack, the image's own, so the same image is refused again. The tenant's hour of image reads is never this code: reaching it answers rate-limit-exceeded with limit tenant-unpack-hour and Retry-After

Example

{ "error": { "code": "image-unverifiable", "message": "…", "details": { "imageRef": "…", "cause": "…", "limit": "…" }, "requestId": "…" } }

Excerpt

See also

`invalid-agent`

Synopsis

400 Bad Request, code invalid-agent

An agent definition breaks the rules. Defining it in code raises this code before anything is sent; the API answers the same problem as validation-failed, with each issue in details.issues.

Details

issues: each problem: its path and what is wrong

Example

{ "error": { "code": "invalid-agent", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/agents

`invalid-guardrail`

Synopsis

400 Bad Request, code invalid-guardrail

A guardrail definition breaks the rules, or its kind doesn't match the check it names. Defining it in code raises this code; the API answers validation-failed, with each issue in details.issues.

Details

issues: each problem: its path and what is wrong

Example

{ "error": { "code": "invalid-guardrail", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/guardrails

`invalid-mcp-endpoint`

Synopsis

400 Bad Request, code invalid-mcp-endpoint

The body of POST /v1/mcp/endpoints isn't a valid MCP endpoint registration: an unknown field, a missing or empty id or name, an id with a ., an unknown transport, or a config that doesn't match its transport.

Details

reason: short machine-readable reason, such as unknown-field, empty-endpoint-id, dot-in-endpoint-id, unknown-transport, missing-config, config-transport-mismatch or invalid-secret-ref

Example

{ "error": { "code": "invalid-mcp-endpoint", "message": "…", "details": { "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`invalid-provider`

Synopsis

400 Bad Request, code invalid-provider

The provider's metadata is invalid, for example an empty id, an empty region or no models. The message says which.

Details

reason: short code for the problem, such as empty-id or empty-region
providerId: the provider id; present on a registry refusal

Example

{ "error": { "code": "invalid-provider", "message": "…", "details": { "reason": "…", "providerId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/providers

`invalid-provider-config`

Synopsis

400 Bad Request, code invalid-provider-config

The identity provider body is invalid: a field is missing, has the wrong type, isn't a valid URL, is a plaintext secret, or can't be changed. The message names the field.

Details

None.

Example

{ "error": { "code": "invalid-provider-config", "message": "…", "requestId": "…" } }

Excerpt

See also

Set up SSO

`invalid-schema`

Synopsis

400 Bad Request, code invalid-schema

A tool's input or output schema isn't a valid JSON Schema. Defining the tool in code raises this code; the API answers validation-failed, with the issue's path /input or /output.

Details

issues: each problem: its path and what is wrong

Example

{ "error": { "code": "invalid-schema", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/tools

`invalid-tool-definition`

Synopsis

400 Bad Request, code invalid-tool-definition

A tool manifest breaks the rules, for example a missing or inexact version, or both or neither of handler and spec. Defining it in code raises this code; the API answers validation-failed, with each issue in details.issues.

Details

issues: each problem: its path and what is wrong

Example

{ "error": { "code": "invalid-tool-definition", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/tools

`item-not-found`

Synopsis

400 Bad Request, code item-not-found

The pointer in item resolves to nothing in the run's output. Fix the pointer.

Details

None.

Example

{ "error": { "code": "item-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/judgments

`judge-class-not-applicable`

Synopsis

400 Bad Request, code judge-class-not-applicable

The judge class you named doesn't exist, or doesn't apply to this run's project or agent.

Details

None.

Example

{ "error": { "code": "judge-class-not-applicable", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/judgments

`kind-not-applied`

Synopsis

400 Bad Request, code kind-not-applied

You publish a policy of a kind this runtime doesn't enforce, so publishing it would change nothing. Publish one of the kinds listed in details.appliedKinds.

Details

kind: the policy kind you sent
appliedKinds: the policy kinds this runtime applies

Example

{ "error": { "code": "kind-not-applied", "message": "…", "details": { "kind": "…", "appliedKinds": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/policies

`limited-session-not-refreshable`

Synopsis

400 Bad Request, code limited-session-not-refreshable

POST /v1/auth/refresh was called with a session limited to a project or a role. Such a session isn't refreshed, so no copy of it can come back without its limits. Get a new one where you got this one.

Details

None.

Example

{ "error": { "code": "limited-session-not-refreshable", "message": "…", "requestId": "…" } }

Excerpt

See also

`provider-key-refused`

Synopsis

400 Bad Request, code provider-key-refused

The request names a model provider's key as a secret for something that isn't that provider, such as a tool, an MCP endpoint or a webhook endpoint. Store the key under its own name and use that name.

Details

secret: name of the secret that is a model provider's key
providerId: id of the provider that owns that key

Example

{ "error": { "code": "provider-key-refused", "message": "…", "details": { "secret": "…", "providerId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/tools
POST /v1/tools/{toolId}/versions/{version}/reinstate
POST /v1/mcp/endpoints
POST /v1/webhooks
PATCH /v1/webhooks/{triggerId}
POST /v1/webhook-endpoints
1 more operations name it in their responses
Operate a self-hosted runtime

`redirect-uri-mismatch`

Synopsis

400 Bad Request, code redirect-uri-mismatch

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "redirect-uri-mismatch", "message": "…", "requestId": "…" } }

Excerpt

See also

`redirect-uri-not-allowed`

Synopsis

400 Bad Request, code redirect-uri-not-allowed

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "redirect-uri-not-allowed", "message": "…", "requestId": "…" } }

Excerpt

See also

`reference-out-of-scope`

Synopsis

400 Bad Request, code reference-out-of-scope

A request names an item its project can't reach: a tool, agent, flow, guardrail, data block, check or eval suite that isn't registered in the project, its org or the tenant, or a version of an agent, flow or eval suite that the project doesn't run, such as one made in an earlier environment and not yet promoted. Nothing is written. Register the item where the project reaches it, use it from the project that has it, or promote the version first.

Details

issues: list of the references refused, each with the path it was named at, its kind and id, and a message

Example

{ "error": { "code": "reference-out-of-scope", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/runs
POST /v1/agents
POST /v1/agents/{agentId}/versions/{version}/reinstate
POST /v1/agents/{agentId}/promotions
POST /v1/agents/{agentId}/promotions/check
POST /v1/flows
13 more operations name it in their responses
Projects, packs and values
Organize work by org and project
Use an MCP server's tools

`reserved-name-prefix`

Synopsis

400 Bad Request, code reserved-name-prefix

The name starts with the prefix reserved for the runtime's own secrets, so you can't write it.

Details

None.

Example

{ "error": { "code": "reserved-name-prefix", "message": "…", "requestId": "…" } }

Excerpt

See also

`retention-over-limit`

Synopsis

400 Bad Request, code retention-over-limit

The retention policy keeps its domain's records longer than this server's limit for that domain, or holds them (graceSeconds: -1). Publish it with a graceSeconds at or under the limit. A version over the limit stays retired: reinstating it is refused the same way. A * policy isn't refused: in a limited domain, the server keeps records no longer than the limit.

Details

domain: the policy's retention domain
graceSeconds: the policy's grace, in seconds (-1: a hold)
limitSeconds: this server's limit for the domain, in seconds
policyId: the policy id (on a reinstate)
version: the version (on a reinstate)

Example

{ "error": { "code": "retention-over-limit", "message": "…", "details": { "domain": "…", "graceSeconds": "…", "limitSeconds": "…", "policyId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

`schema-validation-failed`

Synopsis

400 Bad Request, code schema-validation-failed

The API doesn't send this code. A flow definition with this problem is answered validation-failed, with the problem in details.issues.

Details

None.

Example

{ "error": { "code": "schema-validation-failed", "message": "…", "requestId": "…" } }

Excerpt

See also

validation-failed
Write a flow

`scope-invalid`

Synopsis

400 Bad Request, code scope-invalid

The scope you sent is malformed or unusable: scopeKind and scopeId don't fit together, inherit isn't true or false, or the org or project doesn't exist for your tenant. Fix the scope fields.

Details

projectId: the project that wasn't found (MCP endpoint register only)
orgId: the org that wasn't found (MCP endpoint register only)

Example

{ "error": { "code": "scope-invalid", "message": "…", "details": { "projectId": "…", "orgId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/blocks

`scope-kind-required`

Synopsis

400 Bad Request, code scope-kind-required

A secrets or env request leaves out the scope: scopeKind is missing from the query, or the body's scope is missing or has a kind other than tenant, org or project.

Details

None.

Example

{ "error": { "code": "scope-kind-required", "message": "…", "requestId": "…" } }

Excerpt

See also

`scope-mismatch`

Synopsis

400 Bad Request, code scope-mismatch

Two scopes in one request disagree: the body scope differs from the query scopeKind/scopeId, or the body scope.tenantId isn't your tenant.

Details

None.

Example

{ "error": { "code": "scope-mismatch", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-name-invalid`

Synopsis

400 Bad Request, code secret-name-invalid

The name isn't one a new secret can have. A new secret's name is 1 to 255 ASCII letters, digits, ., - and _, starting with a letter, digit or _, not ending with . and with no two . in a row, and a secrets store can narrow that. Under kindgi dev, a secret is a key in your env files, so its name is capital letters, digits and underscores, not starting with a digit (ACME_WOO_ORDERS, not acme-woo-orders), and never KINDGI_*, the runtime's own configuration. The message says the rule, and under kindgi dev a name that works.

Details

None.

Example

{ "error": { "code": "secret-name-invalid", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-value-invalid`

Synopsis

400 Bad Request, code secret-value-invalid

The secrets store can't hold this value as given. Under kindgi dev, a secret is a key in your env files, and no env-file quoting holds a value that has a double quote, or a backslash followed by n or r, together with a carriage return or with both a single quote and a backtick. Store the value encoded (base64, say), or without one of those characters. The message says why, and never repeats the value.

Details

None.

Example

{ "error": { "code": "secret-value-invalid", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-value-too-large`

Synopsis

400 Bad Request, code secret-value-too-large

The secret value is larger than the size limit the secrets store accepts.

Details

None.

Example

{ "error": { "code": "secret-value-too-large", "message": "…", "requestId": "…" } }

Excerpt

See also

`signature-invalid`

Synopsis

400 Bad Request, code signature-invalid

The deployment's signature isn't valid: it isn't base64, can't be verified, or doesn't match the signed envelope of image digest, version, index hash, tenant and publish time. A promotion checks the signature again, over the fields the deployment keeps, and is refused the same way.

Details

None.

Example

{ "error": { "code": "signature-invalid", "message": "…", "requestId": "…" } }

Excerpt

See also

`signing-key-algorithm-unsupported`

Synopsis

400 Bad Request, code signing-key-algorithm-unsupported

The signing key uses an algorithm other than ed25519: a trust request names another algorithm, or a stored key can't be used to verify.

Details

algorithm: the unsupported algorithm; present only when a stored key fails verification

Example

{ "error": { "code": "signing-key-algorithm-unsupported", "message": "…", "details": { "algorithm": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/signing-keys/{keyId}/revoke

`site-invalid`

Synopsis

400 Bad Request, code site-invalid

A site's settings were refused. Registering one needs a displayName, an origin and an approvalsUrl, and a setting the API doesn't know is refused. An origin is https:// with no path, query, fragment or credentials (http:// only on a loopback host); an approvalsUrl is on that origin, with {approvalId} in it; allowedRoles holds 1 to 20 role names of up to 64 characters (a-z, 0-9, _ and -); a roleMap names only roles in allowedRoles, and its reviewer roles are standard or senior, never above reviewerCeiling; a displayName is 1 to 100 characters, with no control, format or invisible characters; peopleCap is a whole number from 1 to 10,000, and newPeoplePerDay from 1 to 1,000. The message says the rule that was broken.

Details

field: the setting that was refused

Example

{ "error": { "code": "site-invalid", "message": "…", "details": { "field": "…" }, "requestId": "…" } }

Excerpt

See also

`site-key-invalid`

Synopsis

400 Bad Request, code site-key-invalid

The key a site posts to POST /v1/auth/sites/enroll isn't an Ed25519 public JWK: kty OKP, crv Ed25519, x the 32-byte public key in base64url, and a kid of 1 to 64 letters, digits, ., _ and -. A JWK with a private part (d) is refused too: post the public half only. The message says which part is wrong.

Details

None.

Example

{ "error": { "code": "site-key-invalid", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/auth/sites/enroll

`supervisor-header-missing`

Synopsis

400 Bad Request, code supervisor-header-missing

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "supervisor-header-missing", "message": "…", "requestId": "…" } }

Excerpt

See also

How Kindgi fits your app

`tenant-slug-mismatch`

Synopsis

400 Bad Request, code tenant-slug-mismatch

A purge's confirm isn't the tenant's slug, the second check on its id. Nothing was changed: send its slug, as GET /v1/system/tenants/{tenantId} gives it.

Details

tenantId: the tenant

Example

{ "error": { "code": "tenant-slug-mismatch", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/system/tenants/{tenantId}/purge

`token-sign-in-needs-an-api-token`

Synopsis

400 Bad Request, code token-sign-in-needs-an-api-token

POST /v1/auth/token-sign-in was called while signed in by a session. It takes an API token in the Authorization header, so there's nothing to exchange.

Details

None.

Example

{ "error": { "code": "token-sign-in-needs-an-api-token", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/auth/token-sign-in

`trigger-invalid-config`

Synopsis

400 Bad Request, code trigger-invalid-config

The trigger's schedule settings are invalid, for example a cron expression that doesn't parse or fires more often than the minimum interval.

Details

triggerId: the trigger being updated (updates only)

Example

{ "error": { "code": "trigger-invalid-config", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }

Excerpt

See also

`unknown-effect`

Synopsis

400 Bad Request, code unknown-effect

A tool declares an effect kind that isn't supported. Defining the tool in code raises this code; the API answers validation-failed, with the issue in details.issues.

Details

None.

Example

{ "error": { "code": "unknown-effect", "message": "…", "requestId": "…" } }

Excerpt

See also

validation-failed
Write a tool

`unknown-field`

Synopsis

400 Bad Request, code unknown-field

The request body has a field the endpoint doesn't accept. The message names the field; remove it and resend.

Details

None.

Example

{ "error": { "code": "unknown-field", "message": "…", "requestId": "…" } }

Excerpt

See also

`unresolved-guardrail`

Synopsis

400 Bad Request, code unresolved-guardrail

An agent names a guardrail that isn't registered, so its turn can't start. Register the missing guardrails or remove them from the agent.

Details

guardrailIds: the guardrail ids that aren't registered
runId: the run the turn belongs to, when it has one

Example

{ "error": { "code": "unresolved-guardrail", "message": "…", "details": { "guardrailIds": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

Configure a guardrail

`unresolved-tool`

Synopsis

400 Bad Request, code unresolved-tool

An agent's turn needs a tool that isn't registered: the agent declares a tool the project doesn't have, or the model asks for a tool the agent doesn't declare. Register the tool or fix the agent definition.

Details

toolId: the tool that couldn't be resolved
runId: the run the turn belongs to, when it has one

Example

{ "error": { "code": "unresolved-tool", "message": "…", "details": { "toolId": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

Operate a self-hosted runtime

`validation-failed`

Synopsis

400 Bad Request, code validation-failed

The request body is well-formed JSON but fails validation, for example an agent, flow, tool, policy or eval suite definition that breaks the rules, or a version pin that can't be resolved. Fix the entries in details.issues and resend.

Details

issues: list of problems, each with a path to the offending field and a message

Example

{ "error": { "code": "validation-failed", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

`webhook-body-not-json`

Synopsis

400 Bad Request, code webhook-body-not-json

The request says its content type is JSON, but the body doesn't parse as JSON.

Details

None.

Example

{ "error": { "code": "webhook-body-not-json", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/hooks/{tenantId}/{webhookId}

`webhook-secret-not-found`

Synopsis

400 Bad Request, code webhook-secret-not-found

The secret the endpoint references doesn't exist. Store the secret first, then register the endpoint.

Details

secretRef: the secret reference that was not found (name and environment)

Example

{ "error": { "code": "webhook-secret-not-found", "message": "…", "details": { "secretRef": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/webhook-endpoints

`webhook-secret-too-weak`

Synopsis

400 Bad Request, code webhook-secret-too-weak

The signing secret is too weak: it must be whsec_ followed by base64 of at least 24 random bytes. POST /v1/webhook-endpoints/generate-secret makes a valid one.

Details

secretRef: the secret reference that was too weak (name and environment)

Example

{ "error": { "code": "webhook-secret-too-weak", "message": "…", "details": { "secretRef": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/webhook-endpoints

`webhook-url-refused`

Synopsis

400 Bad Request, code webhook-url-refused

The deployment refuses the endpoint URL, for example because of where it points. The message says why.

Details

reason: why the URL was refused

Example

{ "error": { "code": "webhook-url-refused", "message": "…", "details": { "reason": "…" }, "requestId": "…" } }

Excerpt

See also

401 Unauthorized

`auth-expired`

Synopsis

401 Unauthorized, code auth-expired

Your API key or public run token has expired. Use a new one; an expired console session answers session-expired instead.

Details

None.

Example

{ "error": { "code": "auth-expired", "message": "…", "requestId": "…" } }

Excerpt

See also

`auth-missing`

Synopsis

401 Unauthorized, code auth-missing

The request has no usable credentials: the Authorization header is absent or not Bearer <token>, or the token isn't recognised. Send a valid API key or session token.

Details

None.

Example

{ "error": { "code": "auth-missing", "message": "…", "requestId": "…" } }

Excerpt

See also

People, API keys and service accounts

`auth-revoked`

Synopsis

401 Unauthorized, code auth-revoked

The API key you used has been revoked. Use another key. Also sent when a console session was opened with a key that has since been revoked: sign in again.

Details

None.

Example

{ "error": { "code": "auth-revoked", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/tokens/{tokenId}/revoke

`refresh-token-invalid`

Synopsis

401 Unauthorized, code refresh-token-invalid

The session token was rotated by a refresh and is no longer valid. Retry with the fresh token from the last refresh.

Details

None.

Example

{ "error": { "code": "refresh-token-invalid", "message": "…", "requestId": "…" } }

Excerpt

See also

Sessions

`session-expired`

Synopsis

401 Unauthorized, code session-expired

A session token's absolute lifetime has ended. Sign in again to get a new session.

Details

None.

Example

{ "error": { "code": "session-expired", "message": "…", "requestId": "…" } }

Excerpt

See also

Sessions

`session-inactive`

Synopsis

401 Unauthorized, code session-inactive

A session token has been idle longer than the deployment's inactivity timeout, so it's refused. Sign in again.

Details

None.

Example

{ "error": { "code": "session-inactive", "message": "…", "requestId": "…" } }

Excerpt

See also

Sessions

`site-enrollment-refused`

Synopsis

401 Unauthorized, code site-enrollment-refused

POST /v1/auth/sites/enroll was refused: the enrollment code is wrong, used or expired, or its site is paused or unregistered. Each of these gets the same answer. Ask a tenant admin for a new enrollment code.

Details

None.

Example

{ "error": { "code": "site-enrollment-refused", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/auth/sites/enroll

`site-sign-in-refused`

Synopsis

401 Unauthorized, code site-sign-in-refused

POST /v1/auth/site-sign-in refused the site's statement about a person. Until the statement's signature checks out, every refusal has the reason not-verified, so a caller learns nothing about the site. After it, the reason is the check that refused it: site-paused, site-not-vouching, wrong-audience, expired, issued-in-the-future, too-long-lived, replayed, role-not-allowed, person-removed or people-cap.

Details

reason: why: not-verified until the statement's signature checks out, then the check that refused it

Example

{ "error": { "code": "site-sign-in-refused", "message": "…", "details": { "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`webhook-refused`

Synopsis

401 Unauthorized, code webhook-refused

The inbound webhook request doesn't prove who sent it: an unknown address, a missing, wrong or too old signature, or a secret that can't be read. The answer is the same for every reason; the reason is in the trigger's fires and the access audit.

Details

None.

Example

{ "error": { "code": "webhook-refused", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/hooks/{tenantId}/{webhookId}

403 Forbidden

`authz-denied`

Synopsis

403 Forbidden, code authz-denied

The API doesn't send this code. A refused action is answered permission-denied.

Details

None.

Example

{ "error": { "code": "authz-denied", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/mcp/endpoints

`capability-not-mintable`

Synopsis

403 Forbidden, code capability-not-mintable

A tenant's key can't carry a system capability (system:*, or kindgi:system on a runtime serving many tenants): those are system keys' alone. Mint the key without them, or mint a system key with POST /v1/system/keys.

Details

capabilities: the capabilities asked for that a tenant's key can't carry
action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "capability-not-mintable", "message": "…", "details": { "capabilities": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`csrf-origin-mismatch`

Synopsis

403 Forbidden, code csrf-origin-mismatch

A request authenticated by the console session cookie came from an origin the deployment doesn't allow, or carried no Origin header. Use the console at its own address, or an API key.

Details

None.

Example

{ "error": { "code": "csrf-origin-mismatch", "message": "…", "requestId": "…" } }

Excerpt

See also

Run with authorization

`host-access-denied`

Synopsis

403 Forbidden, code host-access-denied

The deployment doesn't let tenant configuration reach its host, so a stdio MCP endpoint (a command on the host) is refused. Use an HTTP endpoint instead, or ask whoever runs the deployment.

Details

action: the action that was refused
resource: the resource it was refused on, as type:id
reason: why the check refused it

Example

{ "error": { "code": "host-access-denied", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`identity-providers-operator-managed`

Synopsis

403 Forbidden, code identity-providers-operator-managed

The deployment's operator manages sign-in, so changing identity providers needs the deployment's own token; a tenant admin's key is refused.

Details

None.

Example

{ "error": { "code": "identity-providers-operator-managed", "message": "…", "requestId": "…" } }

Excerpt

See also

`insufficient-role`

Synopsis

403 Forbidden, code insufficient-role

The reviewer's role ranks below the tier the approval requires, so it can't decide it. Ask a reviewer of a higher role, or escalate.

Details

reviewerId: the reviewer
reviewerRole: the reviewer's role
requiredRole: the role the approval needs

Example

{ "error": { "code": "insufficient-role", "message": "…", "details": { "reviewerId": "…", "reviewerRole": "…", "requiredRole": "…" }, "requestId": "…" } }

Excerpt

See also

Decide an approval

`judge-class-not-allowed`

Synopsis

403 Forbidden, code judge-class-not-allowed

The judge class limits who may assert it, and your key or role isn't one of them, so you can't record a judgment as that class.

Details

action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "judge-class-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`key-project-mismatch`

Synopsis

403 Forbidden, code key-project-mismatch

Your key is limited to one project, and the request names another project, or asks to mint a key not limited to your project. Use the project the key is limited to. A promotion reads one project and writes another, so a key or session limited to a project can't promote, or check a promotion.

Details

keyProjectId: the project your key is limited to
projectId: the project the request names
action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "key-project-mismatch", "message": "…", "details": { "keyProjectId": "…", "projectId": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`license-operator-only`

Synopsis

403 Forbidden, code license-operator-only

GET /v1/license and GET /v1/license/usage are for the deployment's own token, or a system key holding system:license. Where the deployment is set up to serve one tenant (without KINDGI_TENANCY=multi) and its database holds only that one, that tenant's admins also read the license's countdown, never its use. Other callers are refused, and the refusal recorded.

Details

None.

Example

{ "error": { "code": "license-operator-only", "message": "…", "requestId": "…" } }

Excerpt

See also

`limited-session-cannot-mint`

Synopsis

403 Forbidden, code limited-session-cannot-mint

POST /v1/tokens was called by a session limited to a project or a role. A limited session mints no keys: a key would outlive whatever ends the session. Mint the key with an API key, or with a session that isn't limited.

Details

action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "limited-session-cannot-mint", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`participant-not-allowed`

Synopsis

403 Forbidden, code participant-not-allowed

A turn would run as a participant, and you may not read that participant's memory. A turn reads and keeps its participant's memory, so running as one takes what the memory API takes: you're the participant yourself (that user, with their session or their own API key, never a service account's key), or you hold write on the turn's project. When the turn's project isn't known, only the participant may. It's checked wherever a turn gets a participant: input.participantId on POST /v1/runs, participantId on POST /v1/conversations, and a conversation's own participant when you post a turn into it, whatever the body names. Nothing was started or opened. Use a key or role with write on the turn's project, or have the participant run it.

Details

action: the action that was refused: write
resource: what it was refused on, as type:id: conversation:<id> when you posted into a conversation (never its participant or project), else project:<id>, the turn's project, or tenant:<id> when that isn't known
reason: why it was refused; when you posted into a conversation, it names neither the conversation's participant nor its project

Example

{ "error": { "code": "participant-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`permission-denied`

Synopsis

403 Forbidden, code permission-denied

Your key or session isn't allowed to do this on this resource, or lacks a capability the route needs, which the message names. For a permission, ask an admin for it. A key carries only the capabilities it was made with, and only ones the person who made it holds: use a key made with that capability.

Details

action: the action that was refused
resource: the resource it was refused on, as type:id
reason: why the check refused it

Example

{ "error": { "code": "permission-denied", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/runs
POST /v1/tokens
GET /v1/usage
POST /v1/tokens/public
POST /v1/memory/facts
DELETE /v1/memory/facts/{factId}
20 more operations name it in their responses
Run with authorization
Memory reference
Approvals reference

`production-limit-reached`

Synopsis

403 Forbidden, code production-limit-reached

You put a project in production while the tenant already had as many projects in production as its limit allows, or more (projectsInProduction, set by whoever runs the server). Nothing changed. A project already in production isn't counted again, and taking one out is never refused. Take a project out of production, or go where details.next says when the server names a place, or ask whoever runs it to raise the limit; then put the project in production again.

Details

projectId: the project that wasn't put in production
limit: which limit: projects-in-production
projectsInProduction: the tenant's limit on projects in production
inProduction: how many of the tenant's projects are in production; over the limit when the limit was lowered below it
next: where to go for a higher limit, for example a billing page (KINDGI_PRODUCTION_NEXT_URL); absent when the server names none

Example

{ "error": { "code": "production-limit-reached", "message": "…", "details": { "projectId": "…", "limit": "…", "projectsInProduction": "…", "inProduction": "…", "next": "…" }, "requestId": "…" } }

Excerpt

See also

PUT /v1/projects/{projectId}/production

`production-not-allowed`

Synopsis

403 Forbidden, code production-not-allowed

You put a project in production while the tenant isn't allowed to: the server gates production (KINDGI_PRODUCTION_GATE=on), and the tenant's productionAllowed is false. Projects already in production stay so, and staging keeps working. Go where details.next says, when the server names a place, or ask whoever runs it; then put the project in production again.

Details

projectId: the project that wasn't put in production
next: where to go to be allowed, for example a billing page (KINDGI_PRODUCTION_NEXT_URL); absent when the server names none

Example

{ "error": { "code": "production-not-allowed", "message": "…", "details": { "projectId": "…", "next": "…" }, "requestId": "…" } }

Excerpt

See also

PUT /v1/projects/{projectId}/production

`role-exceeds-principal`

Synopsis

403 Forbidden, code role-exceeds-principal

An admin key was requested for a principal that isn't a tenant admin. Mint a member key instead.

Details

None.

Example

{ "error": { "code": "role-exceeds-principal", "message": "…", "requestId": "…" } }

Excerpt

See also

`second-factor-invalid`

Synopsis

403 Forbidden, code second-factor-invalid

The code from the authenticator app, or the recovery code, isn't right: try the code the app shows now. Replacing a second factor that's set up takes a code from it. Too many wrong codes lock it for a while (second-factor-locked).

Details

None.

Example

{ "error": { "code": "second-factor-invalid", "message": "…", "requestId": "…" } }

Excerpt

See also

`second-factor-required`

Synopsis

403 Forbidden, code second-factor-required

The workspace requires a second factor at sign-in. Signing in to the console with an API token is refused, since a token can't give one: sign in another way, with your second factor. Taking your own second factor off is refused too: replace it (POST /v1/identity/me/second-factor with a code), or ask a tenant admin to remove it.

Details

action: the action that was refused (token sign-in only)
resource: the resource it was refused on, as type:id (token sign-in only)
reason: why the check refused it (token sign-in only)

Example

{ "error": { "code": "second-factor-required", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`second-factor-unusable`

Synopsis

403 Forbidden, code second-factor-unusable

The person's authenticator key can't be opened any more: the deployment's sign-in secret changed, and the previous one isn't configured. A recovery code still works, and so does setting the second factor up again with one; otherwise a tenant admin removes it.

Details

None.

Example

{ "error": { "code": "second-factor-unusable", "message": "…", "requestId": "…" } }

Excerpt

See also

`separate-approver-required`

Synopsis

403 Forbidden, code separate-approver-required

The approval requires a different person from the one who requested it, and you asked for it. Ask another reviewer to approve.

Details

approvalId: the approval that needs another approver

Example

{ "error": { "code": "separate-approver-required", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } }

Excerpt

See also

Decide an approval

`signer-not-trusted`

Synopsis

403 Forbidden, code signer-not-trusted

The key that signed the deployment isn't on the tenant's trust list. Trust the key, then deploy again. A promotion is refused the same way when the key that signed the build is no longer trusted: the build isn't promoted.

Details

signerKeyId: id of the signing key that isn't trusted

Example

{ "error": { "code": "signer-not-trusted", "message": "…", "details": { "signerKeyId": "…" }, "requestId": "…" } }

Excerpt

See also

`site-person-grants-managed`

Synopsis

403 Forbidden, code site-person-grants-managed

The request would change what a person a site signs in may do: give them or take away a grant, a tenant role, a project or team membership or its role, or a reviewer role, or mint them a key. Such a person holds only what their site's sign-in writes: their next sign-in would undo a change, and a key would outlive a paused or unregistered site. Change their role on the site, remove the person, or pause the site instead.

Details

None.

Example

{ "error": { "code": "site-person-grants-managed", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/tokens
POST /v1/approvals/reviewers
POST /v1/approvals/reviewers/{reviewerId}/unregister
POST /v1/identity/users/{userId}/grant
POST /v1/teams/{teamId}/memberships
DELETE /v1/teams/{teamId}/memberships/{userId}
4 more operations name it in their responses
Let a store's staff ask and approve in WordPress

`system-key-expiry-required`

Synopsis

403 Forbidden, code system-key-expiry-required

A full system key minted by another system key must expire: set expiresAt. Only the deployment's own token mints one that never expires.

Details

None.

Example

{ "error": { "code": "system-key-expiry-required", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/system/keys

`system-key-on-tenant-route`

Synopsis

403 Forbidden, code system-key-on-tenant-route

A system key was sent to a route it can't use. A system key acts in no tenant, so it reaches /v1/system/*, GET /v1/license and GET /v1/license/usage only: use one of the tenant's keys.

Details

action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "system-key-on-tenant-route", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`system-key-scope-not-served`

Synopsis

403 Forbidden, code system-key-scope-not-served

The runtime serves one tenant, where a system key holds system:license alone, and this key holds anything else, which scopes names: it was minted while the runtime served many tenants, say. It's refused on every route. Mint one holding system:license with the deployment's own token, and revoke this one.

Details

scopes: the scopes the key holds
served: the scopes a system key may hold on this runtime
action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "system-key-scope-not-served", "message": "…", "details": { "scopes": "…", "served": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`system-principal-required`

Synopsis

403 Forbidden, code system-principal-required

The route is a system route (/v1/system/*), and it was called with a tenant's key or a session. Call it with a system key (kgi_sy_…).

Details

action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "system-principal-required", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/system/keys
GET /v1/system/keys
POST /v1/system/keys/{keyId}/revoke
POST /v1/system/tenants
GET /v1/system/tenants
GET /v1/system/tenants/{tenantId}
20 more operations name it in their responses

`system-scope-missing`

Synopsis

403 Forbidden, code system-scope-missing

The system key doesn't hold the scope this request takes, which scope names: the route's own, or more for what the request asks (creating a tenant without firstAdmin, for one). Every /v1/system/keys route takes the full system capability, which a scoped key doesn't hold. A deployment's secret values (secrets=values on its pack env) take a key holding system:pack-env itself: kindgi:system doesn't stand in for it. On a runtime serving one tenant, a system key reaches no /v1/system/* route, and scope is kindgi:system: the system keys take the deployment's own token there.

Details

scope: the scope the request takes
action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "system-scope-missing", "message": "…", "details": { "scope": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/system/keys
GET /v1/system/keys
POST /v1/system/keys/{keyId}/revoke
POST /v1/system/tenants
GET /v1/system/tenants
GET /v1/system/tenants/{tenantId}
20 more operations name it in their responses

`token-expiry-exceeds-minter`

Synopsis

403 Forbidden, code token-expiry-exceeds-minter

The new key would outlive the key minting it. Give it an expiresAt no later than the minting key's expiry.

Details

latestExpiresAt: the latest expiry the new key may have
action: the action that was refused
resource: the resource it was refused on
reason: why the caller was refused

Example

{ "error": { "code": "token-expiry-exceeds-minter", "message": "…", "details": { "latestExpiresAt": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`token-sign-in-not-allowed`

Synopsis

403 Forbidden, code token-sign-in-not-allowed

The key can't open a console session: it belongs to a service account, or it is narrowed to a member role or one project. Use a full key of a person, or the identity provider.

Details

action: the action that was refused
resource: the resource it was refused on, as type:id
reason: why the check refused it

Example

{ "error": { "code": "token-sign-in-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

`token-sign-in-off`

Synopsis

403 Forbidden, code token-sign-in-off

This deployment doesn't allow signing in to the console with an API token. Sign in with the organization's identity provider, or ask whoever runs the deployment to allow it.

Details

action: the action that was refused
resource: the resource it was refused on, as type:id
reason: why the check refused it

Example

{ "error": { "code": "token-sign-in-off", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }

Excerpt

See also

404 Not Found

`adapter-not-found`

Synopsis

404 Not Found, code adapter-not-found

No adapter is registered with that id in the tenant.

Details

adapterId: the adapter id that was looked up

Example

{ "error": { "code": "adapter-not-found", "message": "…", "details": { "adapterId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/adapters/{adapterId}

`agent-not-found`

Synopsis

404 Not Found, code agent-not-found

The agent, or the agent version, doesn't exist in the project, or your key can't see it. Check the id and version; for a run, the agent version the run started with may have been removed.

Details

agentId: the agent id
version: the version asked for, when one was named

Example

{ "error": { "code": "agent-not-found", "message": "…", "details": { "agentId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/agents/{agentId}/versions

`agent-version-not-found`

Synopsis

404 Not Found, code agent-version-not-found

The agent has no active version with that number: it was never registered or has since been unregistered. Pick a version from the agent's version list.

Details

None.

Example

{ "error": { "code": "agent-version-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

`approval-not-found`

Synopsis

404 Not Found, code approval-not-found

No approval with this id exists, or your role can't see it.

Details

approvalId: the approval id

Example

{ "error": { "code": "approval-not-found", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } }

Excerpt

See also

`audit-bundle-not-found`

Synopsis

404 Not Found, code audit-bundle-not-found

The API doesn't send this code. The audit bundle of an approval that doesn't exist is answered approval-not-found.

Details

None.

Example

{ "error": { "code": "audit-bundle-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

`blob-not-found`

Synopsis

404 Not Found, code blob-not-found

No artifact with that id exists in the tenant, or it's in a project your key can't read.

Details

blobId: the artifact id that was looked up

Example

{ "error": { "code": "blob-not-found", "message": "…", "details": { "blobId": "…" }, "requestId": "…" } }

Excerpt

See also

DELETE /v1/artifacts/{blobId}

`block-not-found`

Synopsis

404 Not Found, code block-not-found

No block exists with that id (or that version), or it's in a project your key can't read.

Details

blockId: the block id
version: the version looked up; present only when a version was requested

Example

{ "error": { "code": "block-not-found", "message": "…", "details": { "blockId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

`capability-not-found`

Synopsis

404 Not Found, code capability-not-found

No capability is registered with that id in the tenant.

Details

capabilityId: the capability id that was looked up

Example

{ "error": { "code": "capability-not-found", "message": "…", "details": { "capabilityId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/capabilities/{capabilityId}

`compliance-evidence-not-found`

Synopsis

404 Not Found, code compliance-evidence-not-found

No exportable compliance evidence record with that id exists under the tenant.

Details

evidenceId: the evidence id that wasn't found

Example

{ "error": { "code": "compliance-evidence-not-found", "message": "…", "details": { "evidenceId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/compliance/evidence/{evidenceId}

`conversation-not-found`

Synopsis

404 Not Found, code conversation-not-found

The conversation doesn't exist in your tenant, or a turn names one in a project your key can't read. Check the conversation id.

Details

conversationId: the conversation id that wasn't found

Example

{ "error": { "code": "conversation-not-found", "message": "…", "details": { "conversationId": "…" }, "requestId": "…" } }

Excerpt

See also

`cost-record-not-found`

Synopsis

404 Not Found, code cost-record-not-found

No cost record exists with that id in the tenant.

Details

recordId: the cost record id that was looked up

Example

{ "error": { "code": "cost-record-not-found", "message": "…", "details": { "recordId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/cost/records/{recordId}

`deployment-not-found`

Synopsis

404 Not Found, code deployment-not-found

No deployment with that id exists under the tenant. A promotion of a deployment in a project you can't read is answered the same way.

Details

deploymentId: the deployment id that wasn't found

Example

{ "error": { "code": "deployment-not-found", "message": "…", "details": { "deploymentId": "…" }, "requestId": "…" } }

Excerpt

See also

`env-not-found`

Synopsis

404 Not Found, code env-not-found

The env entry named in the path doesn't exist in the scope and environment you asked for.

Details

name: the env entry name that was not found

Example

{ "error": { "code": "env-not-found", "message": "…", "details": { "name": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/env/{name}

`eval-run-not-found`

Synopsis

404 Not Found, code eval-run-not-found

No eval run exists with that id in the tenant.

Details

runId: the run id that was looked up

Example

{ "error": { "code": "eval-run-not-found", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }

Excerpt

See also

Compare a version on a test set

`eval-suite-not-found`

Synopsis

404 Not Found, code eval-suite-not-found

No eval suite is registered with that id.

Details

suiteId: the suite id that was looked up

Example

{ "error": { "code": "eval-suite-not-found", "message": "…", "details": { "suiteId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/eval-suites/{suiteId}

`fact-not-found`

Synopsis

404 Not Found, code fact-not-found

The memory fact doesn't exist in your tenant. Check the fact id.

Details

factId: the fact id

Example

{ "error": { "code": "fact-not-found", "message": "…", "details": { "factId": "…" }, "requestId": "…" } }

Excerpt

See also

Memory reference

`flow-not-found`

Synopsis

404 Not Found, code flow-not-found

The flow, or the flow version, isn't registered. Check the id and version; a run can't start on an unregistered flow version.

Details

flowId: the flow id
version: the version asked for, when one was named

Example

{ "error": { "code": "flow-not-found", "message": "…", "details": { "flowId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

`gate-policy-not-found`

Synopsis

404 Not Found, code gate-policy-not-found

No gate policy with that id exists, or it has no version with that number.

Details

policyId: the policy id that was looked up

Example

{ "error": { "code": "gate-policy-not-found", "message": "…", "details": { "policyId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/gate-policies

`guardrail-not-found`

Synopsis

404 Not Found, code guardrail-not-found

No guardrail with this id is registered. Check the id.

Details

guardrailId: the guardrail id

Example

{ "error": { "code": "guardrail-not-found", "message": "…", "details": { "guardrailId": "…" }, "requestId": "…" } }

Excerpt

See also

`identity-provider-not-found`

Synopsis

404 Not Found, code identity-provider-not-found

No identity provider with that id is registered for the tenant.

Details

providerId: the provider id that wasn't found

Example

{ "error": { "code": "identity-provider-not-found", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }

Excerpt

See also

Set up SSO

`identity-user-not-found`

Synopsis

404 Not Found, code identity-user-not-found

No user with that id exists under this tenant (or the person named isn't a member of it).

Details

userId: the user id that wasn't found

Example

{ "error": { "code": "identity-user-not-found", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/identity/users/{userId}/unregister
POST /v1/identity/users/{userId}/invite
GET /v1/identity/users/{userId}/second-factor
POST /v1/identity/users/{userId}/second-factor/remove
GET /v1/identity/users/{userId}/grants
POST /v1/identity/users/{userId}/grant
3 more operations name it in their responses

`improvement-pass-not-found`

Synopsis

404 Not Found, code improvement-pass-not-found

The improvement pass doesn't exist, or your key can't read its agent.

Details

passId: the pass id that was looked up

Example

{ "error": { "code": "improvement-pass-not-found", "message": "…", "details": { "passId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/improvement-passes/{passId}/cancel

`judge-class-not-found`

Synopsis

404 Not Found, code judge-class-not-found

No live judge class exists with that id.

Details

None.

Example

{ "error": { "code": "judge-class-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

`judging-item-not-found`

Synopsis

404 Not Found, code judging-item-not-found

The run isn't in the project's judging queue.

Details

None.

Example

{ "error": { "code": "judging-item-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

`judging-rule-not-found`

Synopsis

404 Not Found, code judging-rule-not-found

The project has no judging rule with that id.

Details

None.

Example

{ "error": { "code": "judging-rule-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

`judgment-not-found`

Synopsis

404 Not Found, code judgment-not-found

No judgment exists with that id, or it's in a project your key can't read. Unregistering also needs it to be live.

Details

None.

Example

{ "error": { "code": "judgment-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

Judge a run's output

`mcp-endpoint-not-found`

Synopsis

404 Not Found, code mcp-endpoint-not-found

No MCP endpoint is registered with that id.

Details

endpointId: the endpoint id that was looked up

Example

{ "error": { "code": "mcp-endpoint-not-found", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } }

Excerpt

See also

`mcp-prompt-not-found`

Synopsis

404 Not Found, code mcp-prompt-not-found

The MCP endpoint is registered, but it has no prompt with the name you asked for.

Details

endpointId: id of the MCP endpoint
promptName: the prompt name that wasn't found

Example

{ "error": { "code": "mcp-prompt-not-found", "message": "…", "details": { "endpointId": "…", "promptName": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/mcp/endpoints/{endpointId}/prompts/{name}

`mcp-resource-not-found`

Synopsis

404 Not Found, code mcp-resource-not-found

The MCP endpoint is registered, but it has no resource at the URI you asked for.

Details

endpointId: id of the MCP endpoint
uri: the resource URI that wasn't found

Example

{ "error": { "code": "mcp-resource-not-found", "message": "…", "details": { "endpointId": "…", "uri": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/mcp/endpoints/{endpointId}/resources/{uri}

`not-found`

Synopsis

404 Not Found, code not-found

The token, secret rotation or memory erasure you named doesn't exist for your tenant, or its id isn't valid. Check the id.

Details

None.

Example

{ "error": { "code": "not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

`observation-not-found`

Synopsis

404 Not Found, code observation-not-found

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "observation-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

Let a pass look for something better

`org-not-found`

Synopsis

404 Not Found, code org-not-found

The org doesn't exist in the tenant: it never existed or was deleted. Also returned when creating or changing a project or team with an unknown orgId.

Details

orgId: the org id that wasn't found

Example

{ "error": { "code": "org-not-found", "message": "…", "details": { "orgId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/orgs/{orgId}

`policy-not-found`

Synopsis

404 Not Found, code policy-not-found

No policy exists with that id (or that version) in the tenant.

Details

policyId: the policy id

Example

{ "error": { "code": "policy-not-found", "message": "…", "details": { "policyId": "…" }, "requestId": "…" } }

Excerpt

See also

`principal-not-found`

Synopsis

404 Not Found, code principal-not-found

The person or service account the key is for doesn't exist in this tenant or has been unregistered, or the request names none. Name an existing one with for.

Details

None.

Example

{ "error": { "code": "principal-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/tokens

`project-membership-not-found`

Synopsis

404 Not Found, code project-membership-not-found

The user isn't a member of the project.

Details

projectId: the project
userId: the user who isn't a member

Example

{ "error": { "code": "project-membership-not-found", "message": "…", "details": { "projectId": "…", "userId": "…" }, "requestId": "…" } }

Excerpt

See also

PATCH /v1/projects/{projectId}/memberships/{userId}

`project-not-found`

Synopsis

404 Not Found, code project-not-found

The project doesn't exist in the tenant, or your key can't see it. For GET /v1/projects/default, the tenant has no Default project.

Details

projectId: the project id that wasn't found; absent for the missing Default project

Example

{ "error": { "code": "project-not-found", "message": "…", "details": { "projectId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/runs
POST /v1/tokens
PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended
POST /v1/service-accounts
POST /v1/service-accounts/{serviceAccountId}/grant
POST /v1/agents
20 more operations name it in their responses
Start a run

`promotion-not-found`

Synopsis

404 Not Found, code promotion-not-found

No promotion with that id exists for this agent.

Details

None.

Example

{ "error": { "code": "promotion-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

Release an agent version

`proposal-not-found`

Synopsis

404 Not Found, code proposal-not-found

The improvement proposal doesn't exist in the tenant, or your key can't see its agent.

Details

proposalId: the proposal id that was looked up

Example

{ "error": { "code": "proposal-not-found", "message": "…", "details": { "proposalId": "…" }, "requestId": "…" } }

Excerpt

See also

Propose a change, and test it

`provenance-not-found`

Synopsis

404 Not Found, code provenance-not-found

No provenance record exists for the run id in the path, or the id isn't a valid run id.

Details

runId: the run id that was looked up

Example

{ "error": { "code": "provenance-not-found", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/provenance/{runId}

`provider-not-found`

Synopsis

404 Not Found, code provider-not-found

No model provider is registered with that id in the tenant.

Details

providerId: the provider id that was looked up

Example

{ "error": { "code": "provider-not-found", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }

Excerpt

See also

`reviewer-not-found`

Synopsis

404 Not Found, code reviewer-not-found

No reviewer is registered with this id.

Details

reviewerId: the reviewer id

Example

{ "error": { "code": "reviewer-not-found", "message": "…", "details": { "reviewerId": "…" }, "requestId": "…" } }

Excerpt

See also

`run-not-found`

Synopsis

404 Not Found, code run-not-found

The run doesn't exist in your tenant. Check the run id.

Details

runId: the run id that wasn't found (only some routes)

Example

{ "error": { "code": "run-not-found", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`secret-not-found`

Synopsis

404 Not Found, code secret-not-found

The secret doesn't exist in the scope and environment you named, or it was revoked. A deployment that references a missing secret gets the same answer.

Details

name: the secret name that was not found

Example

{ "error": { "code": "secret-not-found", "message": "…", "details": { "name": "…" }, "requestId": "…" } }

Excerpt

See also

Keep secrets in your own secret manager

`secret-revoked`

Synopsis

404 Not Found, code secret-revoked

The secret was revoked, so its value can't be read or rotated.

Details

name: the revoked secret name (in binding results)

Example

{ "error": { "code": "secret-revoked", "message": "…", "details": { "name": "…" }, "requestId": "…" } }

Excerpt

See also

`secret-version-not-found`

Synopsis

404 Not Found, code secret-version-not-found

The secret exists but has no version with the number you asked for.

Details

name: the secret name
versionId: the version number that was not found

Example

{ "error": { "code": "secret-version-not-found", "message": "…", "details": { "name": "…", "versionId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/secrets/{name}/versions/{versionId}

`service-account-not-found`

Synopsis

404 Not Found, code service-account-not-found

No service account with that id exists in this tenant.

Details

None.

Example

{ "error": { "code": "service-account-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

`session-not-found`

Synopsis

404 Not Found, code session-not-found

POST /v1/auth/refresh was called with a session that has been revoked or no longer exists. Sign in again to get a new session.

Details

sessionId: id of the session that no longer exists

Example

{ "error": { "code": "session-not-found", "message": "…", "details": { "sessionId": "…" }, "requestId": "…" } }

Excerpt

See also

Sessions

`signing-key-not-found`

Synopsis

404 Not Found, code signing-key-not-found

The signing key id doesn't exist among the tenant's trusted keys, or a signed export asked for a signing key the runtime doesn't sign with. Omit the key id to use the active key.

Details

signingKeyId: the key id requested for signing; present only on export signing

Example

{ "error": { "code": "signing-key-not-found", "message": "…", "details": { "signingKeyId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/signing-keys/{keyId}

`signing-not-configured`

Synopsis

404 Not Found, code signing-not-configured

The runtime has no export signing key, so signed exports and the features that depend on them are unavailable.

Details

None.

Example

{ "error": { "code": "signing-not-configured", "message": "…", "requestId": "…" } }

Excerpt

See also

Export signed evidence

`site-not-found`

Synopsis

404 Not Found, code site-not-found

No site with that id in the project the path names, or, revoking a key, no key with that id on the site. GET /v1/projects/{projectId}/sites lists the project's sites.

Details

None.

Example

{ "error": { "code": "site-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

GET /v1/projects/{projectId}/sites/{siteId}
PATCH /v1/projects/{projectId}/sites/{siteId}
POST /v1/projects/{projectId}/sites/{siteId}/pause
POST /v1/projects/{projectId}/sites/{siteId}/resume
POST /v1/projects/{projectId}/sites/{siteId}/unregister
POST /v1/projects/{projectId}/sites/{siteId}/enrollment-codes
2 more operations name it in their responses

`site-person-not-found`

Synopsis

404 Not Found, code site-person-not-found

The site has no link to that person: they never signed in through it. Only the people a site signs in are let back in through it. Find their id with kindgi people list --include-removed.

Details

userId: the person who was to be let back in

Example

{ "error": { "code": "site-person-not-found", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/projects/{projectId}/sites/{siteId}/people/{userId}/restore

`system-key-not-found`

Synopsis

404 Not Found, code system-key-not-found

No system key has that id.

Details

None.

Example

{ "error": { "code": "system-key-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/system/keys/{keyId}/revoke

`team-grant-not-found`

Synopsis

404 Not Found, code team-grant-not-found

The team has no role on that project.

Details

None.

Example

{ "error": { "code": "team-grant-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

PATCH /v1/projects/{projectId}/team-grants/{teamId}

`team-membership-not-found`

Synopsis

404 Not Found, code team-membership-not-found

The user isn't a member of the team.

Details

teamId: the team
userId: the user who isn't a member

Example

{ "error": { "code": "team-membership-not-found", "message": "…", "details": { "teamId": "…", "userId": "…" }, "requestId": "…" } }

Excerpt

See also

PATCH /v1/teams/{teamId}/memberships/{userId}

`team-not-found`

Synopsis

404 Not Found, code team-not-found

No team with that id exists under the tenant.

Details

teamId: the team id that wasn't found

Example

{ "error": { "code": "team-not-found", "message": "…", "details": { "teamId": "…" }, "requestId": "…" } }

Excerpt

See also

`tenant-config-not-found`

Synopsis

404 Not Found, code tenant-config-not-found

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "tenant-config-not-found", "message": "…", "requestId": "…" } }

Excerpt

See also

Operate a self-hosted runtime

`tenant-not-found`

Synopsis

404 Not Found, code tenant-not-found

The tenant your key belongs to doesn't exist.

Details

tenantId: the tenant id that wasn't found

Example

{ "error": { "code": "tenant-not-found", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/system/tenants/{tenantId}
PATCH /v1/system/tenants/{tenantId}
POST /v1/system/tenants/{tenantId}/close
PUT /v1/system/tenants/{tenantId}/suspended
PUT /v1/system/tenants/{tenantId}/image-prefix
PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended
11 more operations name it in their responses
GET /v1/tenant

`tool-not-found`

Synopsis

404 Not Found, code tool-not-found

The tool, or the tool version, isn't registered in the project. Check the id and version.

Details

toolId: the tool id
version: the version asked for, when one was named

Example

{ "error": { "code": "tool-not-found", "message": "…", "details": { "toolId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

`trigger-not-found`

Synopsis

404 Not Found, code trigger-not-found

No trigger (schedule, webhook trigger or event trigger) with that id exists for your tenant, or the id belongs to a trigger of another kind.

Details

triggerId: the trigger id that was not found

Example

{ "error": { "code": "trigger-not-found", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/schedules/{triggerId}/owner

`webhook-delivery-not-found`

Synopsis

404 Not Found, code webhook-delivery-not-found

The endpoint has no delivery with that id.

Details

deliveryId: the delivery id that was not found

Example

{ "error": { "code": "webhook-delivery-not-found", "message": "…", "details": { "deliveryId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/webhook-endpoints/{endpointId}/test

`webhook-endpoint-not-found`

Synopsis

404 Not Found, code webhook-endpoint-not-found

No outbound webhook endpoint with that id exists in your tenant.

Details

endpointId: the endpoint id that was not found

Example

{ "error": { "code": "webhook-endpoint-not-found", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/webhook-endpoints/{endpointId}/test

409 Conflict

`agent-already-registered`

Synopsis

409 Conflict, code agent-already-registered

That agent id and version is already published, and versions never change. Publish under a new version; details.nextFreeVersion suggests the next free one.

Details

agentId: the agent id
version: the version already taken
nextFreeVersion: the next unused version, when one can be worked out

Example

{ "error": { "code": "agent-already-registered", "message": "…", "details": { "agentId": "…", "version": "…", "nextFreeVersion": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/agents

`agent-project-mismatch`

Synopsis

409 Conflict, code agent-project-mismatch

The agent belongs to a different project than the one you named; an agent stays in the project its first version went to. Publish its versions there. The answer doesn't name that project.

Details

agentId: the agent id (publish, derive)
primitive: the kind of item (deployment only)
id: the item's id and version (deployment only)

Example

{ "error": { "code": "agent-project-mismatch", "message": "…", "details": { "agentId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }

Excerpt

See also

`agent-version-live`

Synopsis

409 Conflict, code agent-version-live

The version is live in one or more scopes, so it can't be unregistered. Roll back, unpin or promote another version there first.

Details

agentId: the agent
version: the version
scopes: the scopes where it is live

Example

{ "error": { "code": "agent-version-live", "message": "…", "details": { "agentId": "…", "version": "…", "scopes": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/agents/{agentId}/versions/{version}/unregister

`agent-version-mismatch`

Synopsis

409 Conflict, code agent-version-mismatch

The conversation was opened with one agent version, but the turn or resume names another. Use the version the conversation started with.

Details

conversationId: the conversation (new turn only)
expectedVersion: the version the conversation or run is bound to
actualVersion: the version the call used

Example

{ "error": { "code": "agent-version-mismatch", "message": "…", "details": { "conversationId": "…", "expectedVersion": "…", "actualVersion": "…" }, "requestId": "…" } }

Excerpt

See also

Operate a self-hosted runtime

`already-terminal`

Synopsis

409 Conflict, code already-terminal

The API doesn't send this code. Cancelling an eval run that has finished is answered eval-run-already-terminal.

Details

None.

Example

{ "error": { "code": "already-terminal", "message": "…", "requestId": "…" } }

Excerpt

See also

eval-run-already-terminal

`approval-already-decided`

Synopsis

409 Conflict, code approval-already-decided

The approval already has a decision recorded; a second decision is refused.

Details

approvalId: the approval

Example

{ "error": { "code": "approval-already-decided", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } }

Excerpt

See also

Decide an approval

`approval-not-decided`

Synopsis

409 Conflict, code approval-not-decided

The approval is still pending, so a signed audit bundle can't be exported. Export it after a terminal decision.

Details

approvalId: the approval
status: its current status

Example

{ "error": { "code": "approval-not-decided", "message": "…", "details": { "approvalId": "…", "status": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/approvals/{approvalId}/audit-bundle

`approval-terminal`

Synopsis

409 Conflict, code approval-terminal

The approval already ended (decided, expired or withdrawn), so it takes no more decisions.

Details

approvalId: the approval
status: its final status

Example

{ "error": { "code": "approval-terminal", "message": "…", "details": { "approvalId": "…", "status": "…" }, "requestId": "…" } }

Excerpt

See also

Decide an approval

`block-already-registered`

Synopsis

409 Conflict, code block-already-registered

That block version is already published; versions never change, so publish a new version.

Details

blockId: the block id
version: the version that exists

Example

{ "error": { "code": "block-already-registered", "message": "…", "details": { "blockId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/blocks

`block-project-mismatch`

Synopsis

409 Conflict, code block-project-mismatch

The block belongs to another project. Publish its versions in the project that owns it.

Details

blockId: the block id

Example

{ "error": { "code": "block-project-mismatch", "message": "…", "details": { "blockId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/blocks

`conversation-closed`

Synopsis

409 Conflict, code conversation-closed

The conversation you're adding a turn to has been closed. Start a new conversation instead.

Details

conversationId: the closed conversation
runId: the run the failure belongs to, when one was started

Example

{ "error": { "code": "conversation-closed", "message": "…", "details": { "conversationId": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`conversation-project-mismatch`

Synopsis

409 Conflict, code conversation-project-mismatch

The run names a project other than the conversation's. A conversation belongs to one project, and its turns run there. Name its project, or omit projectId to continue it in its own.

Details

conversationId: the conversation the turn was posted into
projectId: the project the run named
conversationProjectId: the conversation's own project

Example

{ "error": { "code": "conversation-project-mismatch", "message": "…", "details": { "conversationId": "…", "projectId": "…", "conversationProjectId": "…" }, "requestId": "…" } }

Excerpt

See also

`deployment-superseded`

Synopsis

409 Conflict, code deployment-superseded

A deployment is promoted only while it serves. With details.environment source: newer deployments in its environment serve every tool version it ships, so it no longer serves there; promote the newer one. With target: the target environment has this build already, superseded there; promote the newer build from the environment before it. Nothing is written.

Details

environment: source (the deployment promoted) or target (the environment it goes to)
newerDeploymentId: the newest deployment there that serves every tool version this one ships; present when there is one

Example

{ "error": { "code": "deployment-superseded", "message": "…", "details": { "environment": "…", "newerDeploymentId": "…" }, "requestId": "…" } }

Excerpt

See also

`duplicate-edge-id`

Synopsis

409 Conflict, code duplicate-edge-id

The API doesn't send this code. A flow definition that uses an edge id twice is answered validation-failed, with the problem in details.issues.

Details

None.

Example

{ "error": { "code": "duplicate-edge-id", "message": "…", "requestId": "…" } }

Excerpt

See also

validation-failed
Write a flow

`duplicate-node-id`

Synopsis

409 Conflict, code duplicate-node-id

The API doesn't send this code. A flow definition that uses a node id twice is answered validation-failed, with the problem in details.issues.

Details

None.

Example

{ "error": { "code": "duplicate-node-id", "message": "…", "requestId": "…" } }

Excerpt

See also

validation-failed
Write a flow

`endpoint-not-pending`

Synopsis

409 Conflict, code endpoint-not-pending

A problem was sent for a deployment that isn't waiting for a pack service. A problem goes with a pending one, or a cleared one listed as needing a pack service again (waiting, once a suspension is lifted).

Details

status: the deployment's endpoint status now: ready, or cleared and not waiting

Example

{ "error": { "code": "endpoint-not-pending", "message": "…", "details": { "status": "…" }, "requestId": "…" } }

Excerpt

See also

`endpoint-not-ready`

Synopsis

409 Conflict, code endpoint-not-ready

What a deployment's pack service runs was recorded for a service that isn't ready. A new service's revision goes with its endpoint (packEnvRevision); record one for a ready service only.

Details

status: the deployment's endpoint status now: pending or cleared

Example

{ "error": { "code": "endpoint-not-ready", "message": "…", "details": { "status": "…" }, "requestId": "…" } }

Excerpt

See also

`endpoint-retired`

Synopsis

409 Conflict, code endpoint-retired

The env of a deployment whose pack service was retired was asked for: it isn't given out. A retired deployment's service is listed to go (GET /v1/system/deployments?endpoint=retire).

Details

retired: why its pack service was retired, as the retire list gives it

Example

{ "error": { "code": "endpoint-retired", "message": "…", "details": { "retired": "…" }, "requestId": "…" } }

Excerpt

See also

`env-not-served`

Synopsis

409 Conflict, code env-not-served

This runtime keeps every value under the one env it serves (KINDGI_REFUSE_OTHER_ENVS), and the request would store a value under another, where it would never be read: a secret or env value written under another env, or a model provider, MCP endpoint or webhook endpoint naming its secret under another. Nothing is stored. Use the env the runtime serves; GET /v1/identity/whoami names it (servedEnv). Reads and deletes under any env still work.

Details

envName: the env the request named
servedEnv: the env this runtime serves, to use instead

Example

{ "error": { "code": "env-not-served", "message": "…", "details": { "envName": "…", "servedEnv": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/providers
POST /v1/mcp/endpoints
POST /v1/deployments/{deploymentId}/secrets
PUT /v1/env/{name}
POST /v1/secrets
POST /v1/secrets/{name}/rotate
2 more operations name it in their responses
Models
Set values per environment
POST /v1/secrets
PUT /v1/env/{name}
POST /v1/providers

`env-write-conflict`

Synopsis

409 Conflict, code env-write-conflict

The env entry changed since the revision you based the write on. Read the entry again and retry with the current revision.

Details

currentRevision: the revision stored now

Example

{ "error": { "code": "env-write-conflict", "message": "…", "details": { "currentRevision": "…" }, "requestId": "…" } }

Excerpt

See also

PUT /v1/env/{name}

`environment-takes-promotions`

Synopsis

409 Conflict, code environment-takes-promotions

The project you named (or the Default project, when you named none) is a later environment of an environment order, and a later environment takes builds only by promotion from the one before it. Deploy into the order's first environment and promote the build from there. A publish through the API into a later environment is refused the same way, and so is an edited version of an agent that names one: new versions are made in the first environment. Nothing is written.

Details

firstProjectId: the order's first environment, where builds and new versions go; present when you can read that project
position: the project's place in the order, from 0 (the first)

Example

{ "error": { "code": "environment-takes-promotions", "message": "…", "details": { "firstProjectId": "…", "position": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/agents
POST /v1/agents/{agentId}/versions
POST /v1/flows
POST /v1/tools
POST /v1/guardrails
POST /v1/blocks
1 more operations name it in their responses

`erasure-in-progress`

Synopsis

409 Conflict, code erasure-in-progress

An erasure of this person's data is running, so no new turn starts and no new fact is stored for them until it completes. Retry after the erasure finishes.

Details

None.

Example

{ "error": { "code": "erasure-in-progress", "message": "…", "requestId": "…" } }

Excerpt

See also

`eval-run-already-terminal`

Synopsis

409 Conflict, code eval-run-already-terminal

The eval run has already finished, failed or been cancelled, so it can't be cancelled.

Details

runId: the eval run
status: its final status

Example

{ "error": { "code": "eval-run-already-terminal", "message": "…", "details": { "runId": "…", "status": "…" }, "requestId": "…" } }

Excerpt

See also

Compare a version on a test set

`eval-run-not-rescorable`

Synopsis

409 Conflict, code eval-run-not-rescorable

Only a completed comparison of a test set can be rescored; this eval run is of another kind or hasn't completed.

Details

runId: the run id

Example

{ "error": { "code": "eval-run-not-rescorable", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`eval-suite-already-registered`

Synopsis

409 Conflict, code eval-suite-already-registered

That eval suite id and version are already registered; versions never change, so publish a new version.

Details

suiteId: the suite id
version: the version that exists

Example

{ "error": { "code": "eval-suite-already-registered", "message": "…", "details": { "suiteId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

`eval-suite-project-mismatch`

Synopsis

409 Conflict, code eval-suite-project-mismatch

The eval suite belongs to another project and suites never move. Publish or build its versions in the project that owns it.

Details

suiteId: the suite id

Example

{ "error": { "code": "eval-suite-project-mismatch", "message": "…", "details": { "suiteId": "…" }, "requestId": "…" } }

Excerpt

See also

`fact-changed`

Synopsis

409 Conflict, code fact-changed

The fact moved on since you read it: its current revision isn't the expectVersion you sent. Read it again, then retry with the new revision.

Details

factId: the fact id
currentVersion: the fact's current revision

Example

{ "error": { "code": "fact-changed", "message": "…", "details": { "factId": "…", "currentVersion": "…" }, "requestId": "…" } }

Excerpt

See also

`flow-already-registered`

Synopsis

409 Conflict, code flow-already-registered

The flow id and version you're publishing already exist. Publish the change under a new version.

Details

flowId: the flow's id
version: the version that is already registered

Example

{ "error": { "code": "flow-already-registered", "message": "…", "details": { "flowId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/flows

`flow-project-mismatch`

Synopsis

409 Conflict, code flow-project-mismatch

The flow id belongs to another project, because its first version was published there, and its versions can't be published from a different project.

Details

flowId: the flow's id (single publish)
primitive: on a deployment: the kind of item refused (flow)
id: on a deployment: the refused item, as id@version

Example

{ "error": { "code": "flow-project-mismatch", "message": "…", "details": { "flowId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }

Excerpt

See also

`gate-policy-already-registered`

Synopsis

409 Conflict, code gate-policy-already-registered

The gate policy already has a version with that number. Publish with a new version number.

Details

None.

Example

{ "error": { "code": "gate-policy-already-registered", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/gate-policies

`gate-policy-descendant-unpinned`

Synopsis

409 Conflict, code gate-policy-descendant-unpinned

The change would also move a narrower scope that a gate policy applies to and that has no live version of its own, bypassing its gate. Pin that scope at its current version first.

Details

None.

Example

{ "error": { "code": "gate-policy-descendant-unpinned", "message": "…", "requestId": "…" } }

Excerpt

See also

`gate-policy-needs-pin`

Synopsis

409 Conflict, code gate-policy-needs-pin

The scope has a gate policy, and a gated scope keeps its own live version, so it can't be unpinned. Unregister the gate policy first, or roll back instead.

Details

None.

Example

{ "error": { "code": "gate-policy-needs-pin", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/agents/{agentId}/live/unpin

`gate-policy-scope-changed`

Synopsis

409 Conflict, code gate-policy-scope-changed

A new version of a gate policy can't change the agent or the scope the policy gates. Create a new policy for the other agent or scope.

Details

None.

Example

{ "error": { "code": "gate-policy-scope-changed", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/gate-policies

`gate-policy-scope-taken`

Synopsis

409 Conflict, code gate-policy-scope-taken

Another gate policy already gates this agent for the same scope. Publish a new version of that policy instead, or unregister it first.

Details

heldBy: id of the policy that holds the scope

Example

{ "error": { "code": "gate-policy-scope-taken", "message": "…", "details": { "heldBy": "…" }, "requestId": "…" } }

Excerpt

See also

`gate-policy-scope-unpinned`

Synopsis

409 Conflict, code gate-policy-scope-unpinned

The scope has no live version of its own, so the gate policy would not take effect. Pin a version for the scope first.

Details

None.

Example

{ "error": { "code": "gate-policy-scope-unpinned", "message": "…", "requestId": "…" } }

Excerpt

See also

`guardrail-already-registered`

Synopsis

409 Conflict, code guardrail-already-registered

A guardrail with this id is already registered. On a deployment, the existing one has a different definition, so unregister it first and deploy again.

Details

guardrailId: the guardrail's id (direct registration)
primitive: on a deployment: the kind of item refused (guardrail)
id: on a deployment: the guardrail id

Example

{ "error": { "code": "guardrail-already-registered", "message": "…", "details": { "guardrailId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }

Excerpt

See also

`guardrail-project-mismatch`

Synopsis

409 Conflict, code guardrail-project-mismatch

A guardrail id in your deployment is already in use in another project. A deployment never takes over a guardrail from another project.

Details

primitive: the kind of item refused (guardrail)
id: the guardrail id

Example

{ "error": { "code": "guardrail-project-mismatch", "message": "…", "details": { "primitive": "…", "id": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/deployments/{deploymentId}/secrets

`hitl-required`

Synopsis

409 Conflict, code hitl-required

The API doesn't send this code. A conversation that reaches its review threshold parks the turn for an approval instead.

Details

None.

Example

{ "error": { "code": "hitl-required", "message": "…", "requestId": "…" } }

Excerpt

See also

Ask before a long conversation continues

`idempotency-key-body-mismatch`

Synopsis

409 Conflict, code idempotency-key-body-mismatch

You reused an Idempotency-Key with a different request body. Send the original body to get its answer back, or use a fresh key.

Details

None.

Example

{ "error": { "code": "idempotency-key-body-mismatch", "message": "…", "requestId": "…" } }

Excerpt

See also

`idempotency-key-in-flight`

Synopsis

409 Conflict, code idempotency-key-in-flight

A request with this Idempotency-Key is still running. Retry after the Retry-After header; you then get its answer.

Details

None.

Example

{ "error": { "code": "idempotency-key-in-flight", "message": "…", "requestId": "…" } }

Excerpt

See also

`idempotency-key-replay-withheld`

Synopsis

409 Conflict, code idempotency-key-replay-withheld

The request with this Idempotency-Key already succeeded, but its answer held a secret that isn't kept, so it can't be replayed. Read what it created, or make a new one with a fresh key.

Details

status: the HTTP status the first request answered with
at: when it succeeded, as an ISO timestamp

Example

{ "error": { "code": "idempotency-key-replay-withheld", "message": "…", "details": { "status": "…", "at": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/tokens
POST /v1/system/keys
POST /v1/system/tenants
POST /v1/tokens/public
POST /v1/auth/token-sign-in
POST /v1/auth/refresh
3 more operations name it in their responses
Operate a self-hosted runtime
Retry a start safely

`identity-provider-already-registered`

Synopsis

409 Conflict, code identity-provider-already-registered

An identity provider with that id is already registered for the tenant. Use a different id, or change the existing provider with a patch.

Details

providerId: the id that is already taken

Example

{ "error": { "code": "identity-provider-already-registered", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }

Excerpt

See also

`identity-providers-need-secrets-store`

Synopsis

409 Conflict, code identity-providers-need-secrets-store

The deployment has no secrets store (KINDGI_SECRETS_BACKEND is none), and an identity provider's client secret and keys are references into one, so no provider is added or changed until the operator sets one up. Removing a provider still works. Continue with Google, Microsoft or GitHub and the emailed link don't need a store.

Details

providerId: the provider that was being added or changed

Example

{ "error": { "code": "identity-providers-need-secrets-store", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }

Excerpt

See also

`identity-user-email-taken`

Synopsis

409 Conflict, code identity-user-email-taken

Another person in this tenant already has that email address.

Details

userId: the existing person who has the email

Example

{ "error": { "code": "identity-user-email-taken", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/identity/users

`identity-user-not-invited`

Synopsis

409 Conflict, code identity-user-not-invited

The person has no invitation to send again: they have signed in already, were added before invitations, or have no email. Nothing changed.

Details

userId: the person

Example

{ "error": { "code": "identity-user-not-invited", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/identity/users/{userId}/invite

`identity-user-unregister-refused`

Synopsis

409 Conflict, code identity-user-unregister-refused

You can't unregister yourself or the seed user. Ask another tenant admin.

Details

reason: why it was refused: 'yourself' or 'seed-user'
userId: the person who was to be unregistered

Example

{ "error": { "code": "identity-user-unregister-refused", "message": "…", "details": { "reason": "…", "userId": "…" }, "requestId": "…" } }

Excerpt

See also

`identity-user-unregistered`

Synopsis

409 Conflict, code identity-user-unregistered

The person was removed from the tenant, so they can't be granted anything.

Details

None.

Example

{ "error": { "code": "identity-user-unregistered", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/identity/users/{userId}/grant

`image-not-allowed`

Synopsis

409 Conflict, code image-not-allowed

The deployment's image is outside the tenant's image repository: a tenant deploys only images at or under its image prefix.

Details

imagePrefix: the tenant's image prefix; from POST /v1/deployments only

Example

{ "error": { "code": "image-not-allowed", "message": "…", "details": { "imagePrefix": "…" }, "requestId": "…" } }

Excerpt

See also

`image-prefix-taken`

Synopsis

409 Conflict, code image-prefix-taken

The image prefix equals, holds or sits inside another tenant's. Each tenant's repository is its own: choose a prefix that doesn't overlap another tenant's.

Details

None.

Example

{ "error": { "code": "image-prefix-taken", "message": "…", "requestId": "…" } }

Excerpt

See also

`image-prefix-unset`

Synopsis

409 Conflict, code image-prefix-unset

The tenant has no image repository set, so it can't register a deployment yet. Its operator sets one with PUT /v1/system/tenants/{tenantId}/image-prefix.

Details

None.

Example

{ "error": { "code": "image-prefix-unset", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/deployments

`improvement-pass-finished`

Synopsis

409 Conflict, code improvement-pass-finished

The improvement pass has already ended, so there is nothing to cancel.

Details

passId: the pass id
status: the status the pass ended with

Example

{ "error": { "code": "improvement-pass-finished", "message": "…", "details": { "passId": "…", "status": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/improvement-passes/{passId}/cancel

`invalid-transition`

Synopsis

409 Conflict, code invalid-transition

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "invalid-transition", "message": "…", "requestId": "…" } }

Excerpt

See also

Propose a change, and test it

`judge-class-name-taken`

Synopsis

409 Conflict, code judge-class-name-taken

A judge class with that name already exists in this scope. Pick another name.

Details

None.

Example

{ "error": { "code": "judge-class-name-taken", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/judge-classes

`judging-item-not-open`

Synopsis

409 Conflict, code judging-item-not-open

The queue item isn't in the state this action needs: dismiss needs it open, and reopen needs it dismissed.

Details

None.

Example

{ "error": { "code": "judging-item-not-open", "message": "…", "requestId": "…" } }

Excerpt

See also

`last-tenant-admin`

Synopsis

409 Conflict, code last-tenant-admin

This person is the only tenant admin, so they can't be unregistered or lose the admin grant. Make someone else a tenant admin first.

Details

reason: on unregister: 'last-tenant-admin'
userId: on unregister: the person

Example

{ "error": { "code": "last-tenant-admin", "message": "…", "details": { "reason": "…", "userId": "…" }, "requestId": "…" } }

Excerpt

See also

`legal-hold`

Synopsis

409 Conflict, code legal-hold

The fact is under legal hold, so it can't be deleted or superseded; or a memory erasure would reach facts under hold, and nothing is erased. Lift the hold first.

Details

factId: the fact under hold (delete or supersede)
factIds: the facts under hold (starting an erasure)

Example

{ "error": { "code": "legal-hold", "message": "…", "details": { "factId": "…", "factIds": "…" }, "requestId": "…" } }

Excerpt

See also

`live-scope-spans-environments`

Synopsis

409 Conflict, code live-scope-spans-environments

An agent with a project in an environment order is made live one project at a time, whether one project serves it or several. A live change for the whole tenant or an organization would reach every environment of the order at once, so it's refused. Name a project in the change's scope, or a segment of it. To take a build from one environment to the next and make it live there, promote it (kindgi promote --make-live). Nothing is changed.

Details

None.

Example

{ "error": { "code": "live-scope-spans-environments", "message": "…", "requestId": "…" } }

Excerpt

See also

`mcp-endpoint-already-registered`

Synopsis

409 Conflict, code mcp-endpoint-already-registered

An MCP endpoint with that id is already registered. Use another id or unregister the existing one.

Details

endpointId: the endpoint id

Example

{ "error": { "code": "mcp-endpoint-already-registered", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/mcp/endpoints

`membership-exists`

Synopsis

409 Conflict, code membership-exists

The user is already a member with another role. Their existing role is kept; change it with a role update instead.

Details

role: the role they already hold

Example

{ "error": { "code": "membership-exists", "message": "…", "details": { "role": "…" }, "requestId": "…" } }

Excerpt

See also

`not-pinned`

Synopsis

409 Conflict, code not-pinned

The scope has no live version of its own, so there's nothing to roll back or unpin. Pin a version for the scope first.

Details

None.

Example

{ "error": { "code": "not-pinned", "message": "…", "requestId": "…" } }

Excerpt

See also

`nothing-to-roll-back`

Synopsis

409 Conflict, code nothing-to-roll-back

The scope's live version has no earlier version to go back to. Unpin the scope to fall back to the scope above, or name a version to roll back to.

Details

None.

Example

{ "error": { "code": "nothing-to-roll-back", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/agents/{agentId}/live/rollback

`org-has-environment-order`

Synopsis

409 Conflict, code org-has-environment-order

An org can't be deleted while it's the parent of an environment order, because deleting it would orphan the order. A tenant admin clears the order first (PUT /v1/environment-orders/orgs/{orgId} with []), then deletes the org.

Details

orderId: the environment order the org is the parent of

Example

{ "error": { "code": "org-has-environment-order", "message": "…", "details": { "orderId": "…" }, "requestId": "…" } }

Excerpt

See also

`pack-env-conflict`

Synopsis

409 Conflict, code pack-env-conflict

What a pack service runs was recorded against a revision that's no longer the one recorded: another record came first. Read the deployment's pack env again, and record against what's there now.

Details

appliedRevision: the revision the service is recorded as running now, when there is one

Example

{ "error": { "code": "pack-env-conflict", "message": "…", "details": { "appliedRevision": "…" }, "requestId": "…" } }

Excerpt

See also

`pack-suspended`

Synopsis

409 Conflict, code pack-suspended

The operator suspended this deployment's pack, so its pack service can't be set. Lift the suspension first. A promotion of its builds from or into an environment where it's suspended is refused too: details.environment says which.

Details

environment: from a promotion: source (the deployment promoted) or target (the environment it goes to)

Example

{ "error": { "code": "pack-suspended", "message": "…", "details": { "environment": "…" }, "requestId": "…" } }

Excerpt

See also

`policy-already-registered`

Synopsis

409 Conflict, code policy-already-registered

That policy id and version are already registered; policy versions never change, so publish a new version.

Details

policyId: the policy id
version: the version that exists

Example

{ "error": { "code": "policy-already-registered", "message": "…", "details": { "policyId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/policies

`policy-scope-changed`

Synopsis

409 Conflict, code policy-scope-changed

The policy version would move the policy to another scope, but a policy keeps one scope across versions. Publish it under a new id.

Details

policyId: the policy id
version: the version
policyKind: the policy kind
scope: the scope the version covers
previousScope: the scope the policy already holds

Example

{ "error": { "code": "policy-scope-changed", "message": "…", "details": { "policyId": "…", "version": "…", "policyKind": "…", "scope": "…", "previousScope": "…" }, "requestId": "…" } }

Excerpt

See also

`policy-scope-taken`

Synopsis

409 Conflict, code policy-scope-taken

Another policy already holds the scope this one would cover, for example the retention domain. Publish a new version of that policy, or unregister it first.

Details

policyId: the policy being published or reinstated
version: its version
policyKind: the policy kind
scope: the scope requested
heldBy: the policy that holds the scope

Example

{ "error": { "code": "policy-scope-taken", "message": "…", "details": { "policyId": "…", "version": "…", "policyKind": "…", "scope": "…", "heldBy": "…" }, "requestId": "…" } }

Excerpt

See also

`project-default-already-exists`

Synopsis

409 Conflict, code project-default-already-exists

The tenant already has a Default project, so a second one can't be created.

Details

None.

Example

{ "error": { "code": "project-default-already-exists", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/projects

`project-in-another-order`

Synopsis

409 Conflict, code project-in-another-order

A project in the request already belongs to another environment order. A project is in at most one order: set the other order without it, or clear that order, first.

Details

projectId: the project already in another order

Example

{ "error": { "code": "project-in-another-order", "message": "…", "details": { "projectId": "…" }, "requestId": "…" } }

Excerpt

See also

`project-in-environment-order`

Synopsis

409 Conflict, code project-in-environment-order

A project can't be deleted, or moved to another parent, while it's a member of an environment order. Clear it from the order first, then delete or move it.

Details

orderId: the environment order the project belongs to

Example

{ "error": { "code": "project-in-environment-order", "message": "…", "details": { "orderId": "…" }, "requestId": "…" } }

Excerpt

See also

`project-suspended`

Synopsis

409 Conflict, code project-suspended

The project is suspended, so nothing new starts in it until it's restored: a deploy into it (the named project, or the Default for a tenant-wide deploy), a run or a turn started in it, an eval run started in it, an improvement pass for one of its agents, or the operator setting the pack service of one of its deployments. What's already deployed stays. An eval run or a pass already going stops at its next case: it ends cancelled, with project-suspended in its cancelReason. A delivery to one of its webhook triggers isn't refused: one that proves its sender is answered 202 with skipped: project-suspended, and nothing is recorded or kept for it. A schedule's fire on it starts no run or pass: it's recorded skipped, with project-suspended in its detail, and doesn't count toward the schedule's auto-pause, so the schedule stays on and fires again once the project is restored. A webhook delivery taken before the suspension whose run hadn't started is recorded skipped the same way, and its event is dropped. Ask the operator to restore the project. A promotion from it or into it is refused too: details.environment says which.

Details

environment: from a promotion: source (the deployment promoted) or target (the environment it goes to)

Example

{ "error": { "code": "project-suspended", "message": "…", "details": { "environment": "…" }, "requestId": "…" } }

Excerpt

See also

`promotion-not-next-environment`

Synopsis

409 Conflict, code promotion-not-next-environment

A deployment is promoted only to the next environment of its environment order, one environment at a time. The project named isn't that one, or the deployment is in the order's last environment, or in no order. kindgi environments list shows the order. Nothing is written.

Details

position: the next environment's place in the order, from 0 (the first); absent when there's none
nextProjectId: the next environment's project; present when you can read it

Example

{ "error": { "code": "promotion-not-next-environment", "message": "…", "details": { "position": "…", "nextProjectId": "…" }, "requestId": "…" } }

Excerpt

See also

`promotion-superseded`

Synopsis

409 Conflict, code promotion-superseded

The scope's live version changed while the gate was running, so the check no longer applies. Check the promotion again against the new live version.

Details

None.

Example

{ "error": { "code": "promotion-superseded", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/agents/{agentId}/promotions

`promotion-values-not-ready`

Synopsis

409 Conflict, code promotion-values-not-ready

Values the build needs in the target environment aren't ready there: a secret, env value or model key set nowhere a run there looks; one revoked where a run reads it; a pack env name set only as a secret, or both as a secret and as a plain value; or no model provider registered for an agent that runs on any provider. Each one is in details.values: set them in the target, then promote again. The promotion check lists the same, writing nothing. Nothing is written.

Details

values: each value not ready: its name, kind, what needs it (neededBy), where a run finds it (foundAt, when it is set) and why it is not ready (problem); never a value

Example

{ "error": { "code": "promotion-values-not-ready", "message": "…", "details": { "values": "…" }, "requestId": "…" } }

Excerpt

See also

`proposal-invalid-state-transition`

Synopsis

409 Conflict, code proposal-invalid-state-transition

The proposal's status doesn't allow this action, or it changed while the request ran. Read the proposal again and retry if it still applies.

Details

proposalId: the proposal id
status: the proposal status that refused the action; absent when it changed mid-request

Example

{ "error": { "code": "proposal-invalid-state-transition", "message": "…", "details": { "proposalId": "…", "status": "…" }, "requestId": "…" } }

Excerpt

See also

`proposal-needs-pin`

Synopsis

409 Conflict, code proposal-needs-pin

The agent has no live version for the whole tenant, so a new version would serve every scope nothing is pinned for. Promote its current version tenant-wide, then retry.

Details

None.

Example

{ "error": { "code": "proposal-needs-pin", "message": "…", "requestId": "…" } }

Excerpt

See also

`provider-already-registered`

Synopsis

409 Conflict, code provider-already-registered

A provider with that id is already registered in the tenant.

Details

providerId: the provider id that is taken

Example

{ "error": { "code": "provider-already-registered", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/providers

`provider-key-in-use`

Synopsis

409 Conflict, code provider-key-in-use

The secret_ref of the provider being registered names a secret already used by a tool, MCP endpoint, webhook endpoint or webhook trigger. Give each a key of its own.

Details

secret: name of the secret
usedBy: list of the things using it, each with kind and id

Example

{ "error": { "code": "provider-key-in-use", "message": "…", "details": { "secret": "…", "usedBy": "…" }, "requestId": "…" } }

Excerpt

See also

`purge-record-unset`

Synopsis

409 Conflict, code purge-record-unset

A purge on a runtime with nowhere set to keep purge records (KINDGI_TENANT_PURGE_RECORD). Without a record, a restore from a backup older than the purge would bring the tenant back. Set it on the runtime's servers, then purge. Nothing was changed.

Details

tenantId: the tenant

Example

{ "error": { "code": "purge-record-unset", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/system/tenants/{tenantId}/purge

`purge-setting-missing`

Synopsis

409 Conflict, code purge-setting-missing

A purge of a tenant holding something the runtime has no setting to reach: artifacts with no artifacts' store set (KINDGI_ARTIFACTS), or an authorization store with no OpenFGA set (KINDGI_OPENFGA_API_URL). The message says which. Nothing was changed.

Details

tenantId: the tenant

Example

{ "error": { "code": "purge-setting-missing", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/system/tenants/{tenantId}/purge

`registry-read-only`

Synopsis

409 Conflict, code registry-read-only

This registry takes no writes, for example when a local dev server serves the project's own files. The message says what to do instead.

Details

None.

Example

{ "error": { "code": "registry-read-only", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/agents
POST /v1/agents/{agentId}/versions
POST /v1/agents/{agentId}/versions/{version}/unregister
POST /v1/agents/{agentId}/versions/{version}/reinstate
POST /v1/flows
POST /v1/flows/{flowId}/versions/{version}/unregister
9 more operations name it in their responses
Let a pass look for something better
Propose a change, and test it

`reviewer-deactivated`

Synopsis

409 Conflict, code reviewer-deactivated

The reviewer was deactivated, so it can't decide approvals. Ask an admin to reactivate or use another reviewer.

Details

reviewerId: the reviewer id

Example

{ "error": { "code": "reviewer-deactivated", "message": "…", "details": { "reviewerId": "…" }, "requestId": "…" } }

Excerpt

See also

Decide an approval

`run-already-terminal`

Synopsis

409 Conflict, code run-already-terminal

The run has already finished (completed, failed or cancelled), so it can't be cancelled, resumed or given a decision. Start a new run if you need another.

Details

runId: the run
status: the state it ended in

Example

{ "error": { "code": "run-already-terminal", "message": "…", "details": { "runId": "…", "status": "…" }, "requestId": "…" } }

Excerpt

See also

Cancel a run

`run-lease-lost`

Synopsis

409 Conflict, code run-lease-lost

Another executor holds or has taken over the run, so this attempt can't go on. Retry later; the run continues in the executor that holds it.

Details

runId: the run

Example

{ "error": { "code": "run-lease-lost", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }

Excerpt

See also

Operate a self-hosted runtime

`run-not-finished`

Synopsis

409 Conflict, code run-not-finished

The run hasn't completed with an output, so there's nothing to judge. Wait until it completes.

Details

None.

Example

{ "error": { "code": "run-not-finished", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/judgments

`second-factor-enroll-first`

Synopsis

409 Conflict, code second-factor-enroll-first

Requiring a second factor from a session made without one would end that session at its next request. Set up your own second factor and sign in again with it, then require one. An API key may change the setting.

Details

None.

Example

{ "error": { "code": "second-factor-enroll-first", "message": "…", "requestId": "…" } }

Excerpt

See also

`second-factor-not-set-up`

Synopsis

409 Conflict, code second-factor-not-set-up

The person has no second factor set up: there are no recovery codes to replace, and nothing to take off. Set one up with POST /v1/identity/me/second-factor.

Details

None.

Example

{ "error": { "code": "second-factor-not-set-up", "message": "…", "requestId": "…" } }

Excerpt

See also

`second-factor-not-started`

Synopsis

409 Conflict, code second-factor-not-started

There is no new key to confirm, or the one given is over an hour old. Start again with POST /v1/identity/me/second-factor, and confirm with a code from the new key.

Details

None.

Example

{ "error": { "code": "second-factor-not-started", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-write-conflict`

Synopsis

409 Conflict, code secret-write-conflict

The secret write collides with what is stored: you used create-new for a name that already exists, or the version you based a write on is no longer current.

Details

currentVersion: the version stored now (present when the secret already exists)

Example

{ "error": { "code": "secret-write-conflict", "message": "…", "details": { "currentVersion": "…" }, "requestId": "…" } }

Excerpt

See also

`seed-user-admin`

Synopsis

409 Conflict, code seed-user-admin

The person is the seed user, whom the runtime makes tenant admin at every start, so the admin grant can't be removed while that setting stands. Unset the seed user and restart first.

Details

None.

Example

{ "error": { "code": "seed-user-admin", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/identity/users/{userId}/ungrant

`service-account-name-taken`

Synopsis

409 Conflict, code service-account-name-taken

An active service account in this tenant already has that name. Choose another name.

Details

None.

Example

{ "error": { "code": "service-account-name-taken", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/service-accounts

`service-account-unregistered`

Synopsis

409 Conflict, code service-account-unregistered

The service account has been unregistered, so it can't be granted anything.

Details

None.

Example

{ "error": { "code": "service-account-unregistered", "message": "…", "requestId": "…" } }

Excerpt

See also

`session-revoked`

Synopsis

409 Conflict, code session-revoked

The API doesn't send this code. A revoked session is answered auth-revoked, or session-not-found by POST /v1/auth/refresh.

Details

None.

Example

{ "error": { "code": "session-revoked", "message": "…", "requestId": "…" } }

Excerpt

See also

auth-revoked
Sessions

`signing-key-conflict`

Synopsis

409 Conflict, code signing-key-conflict

The key id is already trusted with a different public key. Trust the new key under a new key id.

Details

None.

Example

{ "error": { "code": "signing-key-conflict", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/signing-keys

`signing-key-revoked`

Synopsis

409 Conflict, code signing-key-revoked

The key id was revoked and revocation is final, so it can't be trusted again. Trust the key under a new key id.

Details

None.

Example

{ "error": { "code": "signing-key-revoked", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/signing-keys

`site-person-restore-refused`

Synopsis

409 Conflict, code site-person-restore-refused

The site's person wasn't let back in, and nothing changed. not-removed: they're in the tenant and their site still knows them, so there's nothing to undo. left: their site said they left it. A site forgets a person who leaves, so if they come back, it signs them in as a new person. linked-elsewhere: they also sign in another way (through another site, or the tenant's own sign-in), and letting them back in would let them in there too: add them again instead, as a new person.

Details

reason: why it was refused: 'not-removed', 'left' or 'linked-elsewhere'
userId: the person who was to be let back in

Example

{ "error": { "code": "site-person-restore-refused", "message": "…", "details": { "reason": "…", "userId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/projects/{projectId}/sites/{siteId}/people/{userId}/restore

`slug-conflict`

Synopsis

409 Conflict, code slug-conflict

The slug is taken: another org, team or project in the tenant already has it, or a project in the same org. Choose another slug.

Details

resource: kind of thing that conflicts: org, team or project
slug: the taken slug; on org delete, slugs lists them instead

Example

{ "error": { "code": "slug-conflict", "message": "…", "details": { "resource": "…", "slug": "…" }, "requestId": "…" } }

Excerpt

See also

`team-grant-exists`

Synopsis

409 Conflict, code team-grant-exists

The team already holds another role on the project. Change the role instead of adding it again.

Details

role: the role the team already holds

Example

{ "error": { "code": "team-grant-exists", "message": "…", "details": { "role": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/projects/{projectId}/team-grants

`tenant-closing`

Synopsis

409 Conflict, code tenant-closing

The tenant is closing. Its own keys and sessions can read and export it until it's deleted, but not change it: deletes, revocations, erasures, signing in and out, and the signed exports still work. A delivery to one of its webhook triggers that proves its sender is refused the same way, and nothing is recorded for it. A schedule's or webhook trigger's fire whose run starts as the tenant starts closing is recorded skipped, with tenant-closing in its detail, and doesn't count toward a schedule's auto-pause. An eval run or an improvement pass going as it starts closing stops at its next case: it ends cancelled, with tenant-closing in its cancelReason. The system routes that change its settings, limits, image prefix, a suspension or a deployment's endpoint refuse a closing tenant; clearing its deployments' endpoints, which retires its pack services, still works. On the S3-compatible surface, the same refusal is S3's 403 AllAccessDisabled.

Details

state: closing
tenantId: the tenant; from a system route, or from renaming one

Example

{ "error": { "code": "tenant-closing", "message": "…", "details": { "state": "…", "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

PATCH /v1/system/tenants/{tenantId}
PUT /v1/system/tenants/{tenantId}/suspended
PUT /v1/system/tenants/{tenantId}/image-prefix
PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended
PUT /v1/system/tenants/{tenantId}/production-allowed
PUT /v1/system/tenants/{tenantId}/limits
7 more operations name it in their responses
Kindgi 0.1.9

`tenant-config-revision-conflict`

Synopsis

409 Conflict, code tenant-config-revision-conflict

The tenant config entry changed since the revision you sent in ifRevision, so the write is refused. Read the entry again and retry with its current revision.

Details

currentRevision: the revision stored now

Example

{ "error": { "code": "tenant-config-revision-conflict", "message": "…", "details": { "currentRevision": "…" }, "requestId": "…" } }

Excerpt

See also

PATCH /v1/tenant/config

`tenant-export-window-open`

Synopsis

409 Conflict, code tenant-export-window-open

A purge of a closing tenant whose 30-day export window hasn't passed: its own keys and sessions can still read and export it. Purge it once windowEndsAt has passed. Nothing was changed.

Details

tenantId: the tenant
windowEndsAt: when its export window ends

Example

{ "error": { "code": "tenant-export-window-open", "message": "…", "details": { "tenantId": "…", "windowEndsAt": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/system/tenants/{tenantId}/purge

`tenant-not-closing`

Synopsis

409 Conflict, code tenant-not-closing

A purge of a tenant that is active or suspended. Only a closing tenant is purged, once its 30-day export window has passed: close it first (POST /v1/system/tenants/{tenantId}/close). Nothing was changed.

Details

tenantId: the tenant
state: active or suspended

Example

{ "error": { "code": "tenant-not-closing", "message": "…", "details": { "tenantId": "…", "state": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/system/tenants/{tenantId}/purge

`tenant-setup-pending`

Synopsis

409 Conflict, code tenant-setup-pending

The tenant's setup hasn't finished, so it can't be renamed yet. Sending the request that created it again finishes it.

Details

tenantId: the tenant

Example

{ "error": { "code": "tenant-setup-pending", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

`tenant-slug-in-config`

Synopsis

409 Conflict, code tenant-slug-in-config

A tenant's slug can't change while the server's KINDGI_AUTH_VERIFIED_DOMAINS names a tenant by it. When it names this tenant by its current slug, the server would find no tenant by it when it next starts: the server's operator names the tenant there by its id instead and restarts the server, and then it can be renamed. When it names the new slug, the server's next start would give those domains to this tenant: choose another slug.

Details

slug: the slug the setting names: the current one, or the new one
domains: the domains that name this tenant by its current slug; absent when the setting names the new one

Example

{ "error": { "code": "tenant-slug-in-config", "message": "…", "details": { "slug": "…", "domains": "…" }, "requestId": "…" } }

Excerpt

See also

`tenant-slug-taken`

Synopsis

409 Conflict, code tenant-slug-taken

Another tenant has that slug, creating a tenant or renaming one. A purged tenant keeps its slug. Choose another.

Details

slug: the slug that is taken

Example

{ "error": { "code": "tenant-slug-taken", "message": "…", "details": { "slug": "…" }, "requestId": "…" } }

Excerpt

See also

`tenant-suspended`

Synopsis

409 Conflict, code tenant-suspended

The tenant is suspended. Its own keys and sessions can read and export it, but not change it until it's restored: deletes, revocations, erasures, signing in and out, and the signed exports still work. A delivery to one of its webhook triggers isn't refused: one that proves its sender is answered 202 with skipped: tenant-suspended, and nothing is recorded or kept for it. A sender that can redeliver by hand can resend it once the tenant is restored, and a restore is seen within 5 seconds. Its schedules don't fire while it's suspended, and nothing is caught up: at the restore, a schedule's or webhook trigger's fire whose run or pass hadn't started is recorded skipped, with tenant-suspended in its detail, and a schedule that's on fires next at its first occurrence after the restore, whatever its catchUp. An eval run or an improvement pass going as it's suspended stops at its next case: it ends cancelled, with tenant-suspended in its cancelReason. A fire whose run was starting as the tenant was suspended is recorded skipped right away, with tenant-suspended in its detail. None of it counts toward a schedule's auto-pause. Setting a deployment's endpoint (PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint) refuses a suspended tenant too. On the S3-compatible surface, the same refusal is S3's 403 AllAccessDisabled.

Details

state: suspended
tenantId: the tenant; from a system route only

Example

{ "error": { "code": "tenant-suspended", "message": "…", "details": { "state": "…", "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

`tool-already-registered`

Synopsis

409 Conflict, code tool-already-registered

The tool id and version you're publishing already exist. Published versions are immutable, so publish under a new version number.

Details

toolId: the tool's id
version: the version that is already registered

Example

{ "error": { "code": "tool-already-registered", "message": "…", "details": { "toolId": "…", "version": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/tools

`tool-kind-mismatch`

Synopsis

409 Conflict, code tool-kind-mismatch

A tool's active versions are all one kind: an MCP endpoint's tool, which the runtime registers from the endpoint's listing, or tools published here. This version is the other kind, so nothing was written. Publish or deploy it under another id, or unregister the endpoint (or the other kind's versions) first.

Details

toolId: the tool's id (single publish or reinstate)
version: the version refused (single publish or reinstate)
endpointId: when the id is an MCP endpoint's tool: that endpoint's id
primitive: on a deployment: the kind of item refused (tool)
id: on a deployment: the refused item, as id@version

Example

{ "error": { "code": "tool-kind-mismatch", "message": "…", "details": { "toolId": "…", "version": "…", "endpointId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }

Excerpt

See also

`tool-project-mismatch`

Synopsis

409 Conflict, code tool-project-mismatch

The tool id belongs to another project, because its first version was published there, and versions can't be published from a different project.

Details

toolId: the tool's id (single publish)
primitive: on a deployment: the kind of item refused (tool)
id: on a deployment: the refused item, as id@version

Example

{ "error": { "code": "tool-project-mismatch", "message": "…", "details": { "toolId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }

Excerpt

See also

`trigger-already-in-state`

Synopsis

409 Conflict, code trigger-already-in-state

The trigger is already in the state you asked for, such as pausing a paused trigger or resuming one that is running.

Details

triggerId: the trigger id

Example

{ "error": { "code": "trigger-already-in-state", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }

Excerpt

See also

Run on a schedule

`trigger-webhook-id-conflict`

Synopsis

409 Conflict, code trigger-webhook-id-conflict

A webhook trigger with that webhookId is already registered for your tenant. Pick another id.

Details

None.

Example

{ "error": { "code": "trigger-webhook-id-conflict", "message": "…", "requestId": "…" } }

Excerpt

See also

Start runs from WooCommerce, Drupal or any signed webhook

`version-already-exists`

Synopsis

409 Conflict, code version-already-exists

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "version-already-exists", "message": "…", "requestId": "…" } }

Excerpt

See also

Propose a change, and test it

`waitpoint-error`

Synopsis

409 Conflict, code waitpoint-error

The wait token the approval or cancel targets isn't pending any more: no pending token, or it was already resolved or cancelled.

Details

tokenId: the wait token

Example

{ "error": { "code": "waitpoint-error", "message": "…", "details": { "tokenId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/approvals/{approvalId}/complete

410 Gone

`agent-gone`

Synopsis

410 Gone, code agent-gone

The agent has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one.

Details

agentId: the agent id

Example

{ "error": { "code": "agent-gone", "message": "…", "details": { "agentId": "…" }, "requestId": "…" } }

Excerpt

See also

Agent and tool versions

`eval-suite-gone`

Synopsis

410 Gone, code eval-suite-gone

The eval suite has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one.

Details

suiteId: the suite id

Example

{ "error": { "code": "eval-suite-gone", "message": "…", "details": { "suiteId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/eval-suites/{suiteId}

`flow-gone`

Synopsis

410 Gone, code flow-gone

The flow has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one.

Details

flowId: the flow id

Example

{ "error": { "code": "flow-gone", "message": "…", "details": { "flowId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/flows/{flowId}

`policy-gone`

Synopsis

410 Gone, code policy-gone

The policy has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one.

Details

policyId: the policy id

Example

{ "error": { "code": "policy-gone", "message": "…", "details": { "policyId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/policies/{policyId}

`run-erased`

Synopsis

410 Gone, code run-erased

An erasure cleared the run's content (a person's words were removed), so there is nothing to judge or replay.

Details

None.

Example

{ "error": { "code": "run-erased", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/judgments

`tool-gone`

Synopsis

410 Gone, code tool-gone

The tool existed but has no active version left, so it can't be read or run. Reinstate a retired version or publish a new one.

Details

toolId: the tool's id

Example

{ "error": { "code": "tool-gone", "message": "…", "details": { "toolId": "…" }, "requestId": "…" } }

Excerpt

See also

GET /v1/tools/{toolId}

`webhook-gone`

Synopsis

410 Gone, code webhook-gone

The webhook trigger the request is addressed to was unregistered. Only a sender that signs correctly learns this.

Details

None.

Example

{ "error": { "code": "webhook-gone", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/hooks/{tenantId}/{webhookId}

413 Content Too Large

`artifact-too-large`

Synopsis

413 Content Too Large, code artifact-too-large

The uploaded artifact is larger than the upload cap. Upload a smaller file.

Details

maxBytes: the largest accepted size, in bytes

Example

{ "error": { "code": "artifact-too-large", "message": "…", "details": { "maxBytes": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/artifacts

`request-too-large`

Synopsis

413 Content Too Large, code request-too-large

The request body is larger than the API's limit. Send a smaller body. An artifact upload and a webhook delivery have limits of their own (artifact-too-large, webhook-body-too-large).

Details

maxBytes: the largest accepted body, in bytes

Example

{ "error": { "code": "request-too-large", "message": "…", "details": { "maxBytes": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/runs
POST /v1/runs/{runId}/resume
POST /v1/signing-keys
POST /v1/signing-keys/{keyId}/revoke
POST /v1/tokens
POST /v1/system/keys
108 more operations name it in their responses

`site-request-too-large`

Synopsis

413 Content Too Large, code site-request-too-large

A body sent to POST /v1/auth/sites/enroll or POST /v1/auth/site-sign-in is over 4096 bytes. Those routes take a few small fields: send only those.

Details

None.

Example

{ "error": { "code": "site-request-too-large", "message": "…", "requestId": "…" } }

Excerpt

See also

`webhook-body-too-large`

Synopsis

413 Content Too Large, code webhook-body-too-large

The request body is larger than the receiver takes: the receiver's overall cap, or the trigger's own bodyLimitBytes.

Details

None.

Example

{ "error": { "code": "webhook-body-too-large", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/hooks/{tenantId}/{webhookId}

422 Unprocessable Content

`agent-turn-aborted`

Synopsis

422 Unprocessable Content, code agent-turn-aborted

The agent's turn was cancelled or timed out before it finished.

Details

reason: external when cancelled by a caller, timeout when it ran out of time
runId: the run that was aborted

Example

{ "error": { "code": "agent-turn-aborted", "message": "…", "details": { "reason": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

Set an agent's budget

`budget-exceeded`

Synopsis

422 Unprocessable Content, code budget-exceeded

The agent's turn went over its budget: the cost cap, or the step cap while the model still wanted another tool call. Raise the budget or simplify the task.

Details

kind: which budget: steps or cost (the type also allows wall-time)
limit: the agent's cap
observed: the value reached
runId: the run that failed

Example

{ "error": { "code": "budget-exceeded", "message": "…", "details": { "kind": "…", "limit": "…", "observed": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`capability-routing-failed`

Synopsis

422 Unprocessable Content, code capability-routing-failed

No model provider could take the agent's call: the agent declares no capabilities, or no provider meets them under your policy, or the pinned route is no longer allowed, or a provider registered for the tenant can't be set up on this runtime (the message says why; GET /v1/providers/{providerId}/check gives the adapter's words).

Details

runId: the run that failed

Example

{ "error": { "code": "capability-routing-failed", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }

Excerpt

See also

See why runs failed

`capability-unsatisfiable`

Synopsis

422 Unprocessable Content, code capability-unsatisfiable

No registered model provider meets what the agent's capabilities ask for, after your organization's model policy is applied. It appears as the cause of capability-routing-failed.

Details

reasons: per provider, why it was rejected (inside cause)
tenantId: the tenant whose policy applied, when one did (inside cause)

Example

{ "error": { "code": "capability-unsatisfiable", "message": "…", "details": { "reasons": "…", "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

`dispatcher-not-registered`

Synopsis

422 Unprocessable Content, code dispatcher-not-registered

The runtime has no eval-run dispatcher for the suite's kind, so it can't start a run of that suite.

Details

evalKind: the suite kind with no dispatcher

Example

{ "error": { "code": "dispatcher-not-registered", "message": "…", "details": { "evalKind": "…" }, "requestId": "…" } }

Excerpt

See also

Compare a version on a test set

`endpoint-host-not-allowed`

Synopsis

422 Unprocessable Content, code endpoint-host-not-allowed

The pack service's host isn't on the operator's allowlist of pack hosts (KINDGI_PACK_ENDPOINT_HOSTS). Use a host the allowlist covers. The refusal is recorded as the deployment's endpoint.problem.

Details

None.

Example

{ "error": { "code": "endpoint-host-not-allowed", "message": "…", "requestId": "…" } }

Excerpt

See also

`endpoint-info-mismatch`

Synopsis

422 Unprocessable Content, code endpoint-info-mismatch

The pack service answered GET /v1/info as another pack or version, so it doesn't serve this deployment's image. The refusal is recorded as the deployment's endpoint.problem.

Details

differs: the names of the /v1/info fields that differed from the deployment's, never their values

Example

{ "error": { "code": "endpoint-info-mismatch", "message": "…", "details": { "differs": "…" }, "requestId": "…" } }

Excerpt

See also

`endpoint-name-mismatch`

Synopsis

422 Unprocessable Content, code endpoint-name-mismatch

The pack service's host doesn't name this deployment's own service. Each deployment's pack service runs under its own name, packServiceName in @kindgi/api. The refusal is recorded as the deployment's endpoint.problem.

Details

expected: the deployment's pack service name, which the host must carry

Example

{ "error": { "code": "endpoint-name-mismatch", "message": "…", "details": { "expected": "…" }, "requestId": "…" } }

Excerpt

See also

`endpoint-unreachable`

Synopsis

422 Unprocessable Content, code endpoint-unreachable

The pack service didn't answer GET /v1/info as this deployment's service. Check that it runs and that the runtime can reach it, then set it again. The refusal is recorded as the deployment's endpoint.problem.

Details

None.

Example

{ "error": { "code": "endpoint-unreachable", "message": "…", "requestId": "…" } }

Excerpt

See also

`flow-resume-not-supported`

Synopsis

422 Unprocessable Content, code flow-resume-not-supported

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "flow-resume-not-supported", "message": "…", "requestId": "…" } }

Excerpt

See also

Wait for an approval

`flow-runs-not-supported`

Synopsis

422 Unprocessable Content, code flow-runs-not-supported

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "flow-runs-not-supported", "message": "…", "requestId": "…" } }

Excerpt

See also

Write a flow

`flow-unbound`

Synopsis

422 Unprocessable Content, code flow-unbound

The flow can't start or resume because a node has nothing to run it: a step names a tool the tenant doesn't have, an agent step can't bind, or a node kind isn't runnable.

Details

nodeIds: the flow nodes that can't be bound

Example

{ "error": { "code": "flow-unbound", "message": "…", "details": { "nodeIds": "…" }, "requestId": "…" } }

Excerpt

See also

`gate-failed`

Synopsis

422 Unprocessable Content, code gate-failed

A gate policy refused the promotion because one or more of its checks failed. The refusal is recorded; read the failing checks and fix what they name.

Details

promotionId: the recorded refused promotion
policy: the gate policy that applied (id and version), or null
checks: every check the gate ran, with whether each passed
proposalId: the proposal, when the request came through a proposal

Example

{ "error": { "code": "gate-failed", "message": "…", "details": { "promotionId": "…", "policy": "…", "checks": "…", "proposalId": "…" }, "requestId": "…" } }

Excerpt

See also

`guardrail-config-invalid`

Synopsis

422 Unprocessable Content, code guardrail-config-invalid

The guardrail's config doesn't satisfy the config schema of the check it names, so the check would refuse it on every call. Fix the config and register again.

Details

issues: one entry per problem found in the config

Example

{ "error": { "code": "guardrail-config-invalid", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/guardrails

`guardrail-violation`

Synopsis

422 Unprocessable Content, code guardrail-violation

A blocking guardrail stopped the agent's turn, or a halting guardrail's check couldn't run. The run fails; the violations say which guardrails fired.

Details

violations: the blocking guardrail results
evaluationErrors: guardrails whose check couldn't run (missing check, bad config)
runId: the run that failed

Example

{ "error": { "code": "guardrail-violation", "message": "…", "details": { "violations": "…", "evaluationErrors": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`identity-provider-invalid`

Synopsis

422 Unprocessable Content, code identity-provider-invalid

The deployment couldn't use the provider's configuration (for example, its issuer discovery failed or its SAML metadata didn't parse), or kind is oauth2, which sign-in doesn't use.

Details

providerId: id of the provider being registered or changed; may be absent for an oauth2 body without one

Example

{ "error": { "code": "identity-provider-invalid", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }

Excerpt

See also

`model-invocation-failed`

Synopsis

422 Unprocessable Content, code model-invocation-failed

The model provider call failed, for example it refused the key or was rate limited. The message carries the provider's own words.

Details

runId: the run that failed

Example

{ "error": { "code": "model-invocation-failed", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`output-schema-violation`

Synopsis

422 Unprocessable Content, code output-schema-violation

The agent declares an output schema and its final answer still didn't match after the allowed repair attempts.

Details

errors: the schema problems from the last attempt
attempts: how many answers were checked
runId: the run that failed

Example

{ "error": { "code": "output-schema-violation", "message": "…", "details": { "errors": "…", "attempts": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`provider-config-invalid`

Synopsis

422 Unprocessable Content, code provider-config-invalid

The provider registration is refused: send_traceparent isn't a boolean, or the provider's adapter rejects its adapter_config, metadata or secret_ref.

Details

issues: list of problems, each with a JSON-pointer path and a message

Example

{ "error": { "code": "provider-config-invalid", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }

Excerpt

See also

`run-resume-not-supported`

Synopsis

422 Unprocessable Content, code run-resume-not-supported

Resuming a run at a waitpoint through POST /v1/runs/{runId}/resume isn't available. A run waiting for an approval continues when a reviewer decides it.

Details

None.

Example

{ "error": { "code": "run-resume-not-supported", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/runs/{runId}/resume

`runtime-not-configured`

Synopsis

422 Unprocessable Content, code runtime-not-configured

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "runtime-not-configured", "message": "…", "requestId": "…" } }

Excerpt

See also

Models

`semantic-unavailable`

Synopsis

422 Unprocessable Content, code semantic-unavailable

A search by meaning (semantic, or the agent's semantic retrieval) can't run because the deployment has no embeddings or the embedding provider isn't answering. Use keyword or both mode, or ask an admin.

Details

intent: for an agent turn: the position of the retrieval intent that failed

Example

{ "error": { "code": "semantic-unavailable", "message": "…", "details": { "intent": "…" }, "requestId": "…" } }

Excerpt

See also

`tool-invocation-failed`

Synopsis

422 Unprocessable Content, code tool-invocation-failed

A tool the agent called failed, and the agent's tool-error policy didn't let the model recover. The message carries the tool's own error.

Details

toolId: the tool that failed
validationIssues: when the model's arguments broke the tool's input schema: the validator's issues
receivedInput: with validationIssues: the arguments the model sent, truncated
toolRetries: failed calls already sent back to the model, when retries ran out
runId: the run that failed

Example

{ "error": { "code": "tool-invocation-failed", "message": "…", "details": { "toolId": "…", "validationIssues": "…", "receivedInput": "…", "toolRetries": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`tool-version-unresolvable`

Synopsis

422 Unprocessable Content, code tool-version-unresolvable

No registered version of a tool the agent uses matches its version range, or the pinned version is no longer registered. Publish a matching version or fix the range.

Details

toolId: the tool
requestedRange: the version range or pin the agent asked for
availableVersions: versions that are registered, when known
runId: the run that failed

Example

{ "error": { "code": "tool-version-unresolvable", "message": "…", "details": { "toolId": "…", "requestedRange": "…", "availableVersions": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

Agent and tool versions

429 Too Many Requests

`approvals-pending-limit`

Synopsis

429 Too Many Requests, code approvals-pending-limit

A gate asked for an approval while the tenant's approvals waiting for a decision were at its limit (set by whoever runs the server). Nothing waits for an approval nobody can see: the step fails, naming the limit. POST /v1/runs answers 429 when the call waits for its run; with options.wait: false it answers 202, and the run fails with this code. A promotion whose gate wants an approval is refused with it. Once some of the approvals waiting are decided, try again.

Details

approvalsPending: the tenant's limit on approvals waiting for a decision; absent when the server doesn't name it

Example

{ "error": { "code": "approvals-pending-limit", "message": "…", "details": { "approvalsPending": "…" }, "requestId": "…" } }

Excerpt

See also

`invite-capped`

Synopsis

429 Too Many Requests, code invite-capped

Too many invitations sent: to this person, from the tenant, or from the whole deployment. The limits are the server's. Nothing changed and nothing was sent. Try again after the Retry-After header, or, if their invitation hasn't expired, tell them to sign in.

Details

userId: the person whose invitation was to be sent again

Example

{ "error": { "code": "invite-capped", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/identity/users/{userId}/invite

`rate-limit-exceeded`

Synopsis

429 Too Many Requests, code rate-limit-exceeded

You sent too many requests, or a tenant reached one of its limits: a webhook trigger got more deliveries than its per-minute limit, a client sent too many refused webhook requests, too many sign-in lookups came from one source, or the tenant reached its limit on API requests or webhook deliveries a minute, or on runs waiting to start. A tenant's API requests to /v1 and /s3 count together; on /s3, its limit answers as S3 does, with 503 SlowDown and Retry-After, not with this code. On a server with budgets kept per tenant (Kindgi Cloud), it's also the answer when the tenant's schemas took their budget compiling, or its instructions templates rendering, in the last 60 seconds; an agent's turn refused this way fails its run with this code. A deploy is refused with it too when the tenant's image reads unpacked as much as they may in an hour. Retry after the Retry-After header; a refusal by the limit on runs waiting to start has none: retry once some have started.

Details

limit: the tenant's limit that was reached: api-requests, webhook-receives, runs-pending, a budget, schema-compile-time or template-render-time, or tenant-unpack-hour, its image reads in the last hour. Absent when the limit isn't the tenant's
runsPending: the tenant's limit on runs waiting to start, on a runs-pending refusal; absent when the server doesn't name it
budgetMs: for a budget, the milliseconds the tenant's work of that kind may take in 60 seconds
runId: when a budget refused an agent's turn, the run the turn belongs to

Example

{ "error": { "code": "rate-limit-exceeded", "message": "…", "details": { "limit": "…", "runsPending": "…", "budgetMs": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/runs
POST /v1/agents
POST /v1/agents/{agentId}/versions
POST /v1/flows
POST /v1/tools
POST /v1/guardrails
5 more operations name it in their responses
Kindgi 0.1.8

`second-factor-locked`

Synopsis

429 Too Many Requests, code second-factor-locked

Too many wrong codes lately for this person: no code is checked until the Retry-After header says. Nothing changed.

Details

None.

Example

{ "error": { "code": "second-factor-locked", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-provider-rate-limited`

Synopsis

429 Too Many Requests, code secret-provider-rate-limited

The external secret provider is rate limiting the runtime. Wait and retry.

Details

retryAfterMs: how long the provider asked to wait, in milliseconds, when it said (in binding results)

Example

{ "error": { "code": "secret-provider-rate-limited", "message": "…", "details": { "retryAfterMs": "…" }, "requestId": "…" } }

Excerpt

See also

`turn-memory-limit-reached`

Synopsis

429 Too Many Requests, code turn-memory-limit-reached

The runtime's agent turns hold more memory than its limit leaves this turn: the tenant's share (KINDGI_TURN_MEMORY_PER_TENANT_MIB) or the runtime's whole (KINDGI_TURN_MEMORY_MIB). The turn's run fails, and every tool call it finished is in the conversation, so a new turn there doesn't call it again. Retry later, or use a smaller conversation.

Details

limit: tenant or server: which limit refused the turn
heldBytes: what that limit's turns held, in bytes
limitBytes: the limit, in bytes
runId: the run that failed

Example

{ "error": { "code": "turn-memory-limit-reached", "message": "…", "details": { "limit": "…", "heldBytes": "…", "limitBytes": "…", "runId": "…" }, "requestId": "…" } }

Excerpt

See also

500 Internal Server Error

`blob-storage-error`

Synopsis

500 Internal Server Error, code blob-storage-error

The runtime's artifact storage failed while reading or writing the bytes. Retry; contact the operator if it persists.

Details

None.

Example

{ "error": { "code": "blob-storage-error", "message": "…", "requestId": "…" } }

Excerpt

See also

Keep files with a run

`compliance-export-failed`

Synopsis

500 Internal Server Error, code compliance-export-failed

Signing the compliance evidence export failed on the server. Retry; if it persists, contact the operator.

Details

None.

Example

{ "error": { "code": "compliance-export-failed", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/compliance/evidence/export

`env-store-error`

Synopsis

500 Internal Server Error, code env-store-error

The env store failed, for example a database error, so the entry wasn't read or written.

Details

None.

Example

{ "error": { "code": "env-store-error", "message": "…", "requestId": "…" } }

Excerpt

See also

Set values per environment

`export-key-error`

Synopsis

500 Internal Server Error, code export-key-error

Signing the export with the deployment's export key failed. The reason is in the runtime's log, not the message.

Details

None.

Example

{ "error": { "code": "export-key-error", "message": "…", "requestId": "…" } }

Excerpt

See also

`identity-revoke-failed`

Synopsis

500 Internal Server Error, code identity-revoke-failed

Revoking all of a user's sessions failed on the server. Retry; if it persists, contact the operator.

Details

userId: the user whose sessions were being revoked

Example

{ "error": { "code": "identity-revoke-failed", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/identity/users/{userId}/revoke-sessions

`internal-server-error`

Synopsis

500 Internal Server Error, code internal-server-error

The server hit an unexpected error while handling the request. Retry; if it persists, contact support with the requestId.

Details

None.

Example

{ "error": { "code": "internal-server-error", "message": "…", "requestId": "…" } }

Excerpt

See also

`journal-error`

Synopsis

500 Internal Server Error, code journal-error

The run's record couldn't be written or read back: the run was started but its row isn't readable, or it couldn't be started or reloaded after cancelling.

Details

None.

Example

{ "error": { "code": "journal-error", "message": "…", "requestId": "…" } }

Excerpt

See also

`persistence-error`

Synopsis

500 Internal Server Error, code persistence-error

The runtime couldn't read or write its storage. Retry; if it persists, contact support.

Details

None.

Example

{ "error": { "code": "persistence-error", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-decryption-failed`

Synopsis

500 Internal Server Error, code secret-decryption-failed

The runtime couldn't decrypt a stored secret value (the key service failed to unwrap its key).

Details

None.

Example

{ "error": { "code": "secret-decryption-failed", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-encryption-failed`

Synopsis

500 Internal Server Error, code secret-encryption-failed

The runtime couldn't encrypt the secret value (the key service refused to produce a data key), so nothing was stored.

Details

None.

Example

{ "error": { "code": "secret-encryption-failed", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-store-error`

Synopsis

500 Internal Server Error, code secret-store-error

The secrets store failed in a way the other secret codes don't cover, such as a database error, an invalid name for the store, or a provider feature it doesn't support. With your own secret manager, it's also the answer for a secret stored under a name outside the rule for new names: store its value again under a name that fits.

Details

None.

Example

{ "error": { "code": "secret-store-error", "message": "…", "requestId": "…" } }

Excerpt

See also

`signing-key-store-error`

Synopsis

500 Internal Server Error, code signing-key-store-error

The API doesn't send this code.

Details

None.

Example

{ "error": { "code": "signing-key-store-error", "message": "…", "requestId": "…" } }

Excerpt

See also

Export signed evidence

`stuck`

Synopsis

500 Internal Server Error, code stuck

A flow run reached a point where no step is ready and no branch is left to decide, so the run fails. Check the flow's edges and their conditions.

Details

runId: the run that failed

Example

{ "error": { "code": "stuck", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }

Excerpt

See also

`token-mint-failed`

Synopsis

500 Internal Server Error, code token-mint-failed

The runtime couldn't sign a public run token, for example because it has no usable signing key. Report it to an admin of the deployment.

Details

None.

Example

{ "error": { "code": "token-mint-failed", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/tokens/public

`trigger-lifecycle-failed`

Synopsis

500 Internal Server Error, code trigger-lifecycle-failed

The runtime couldn't pause, resume or fire the trigger because of a storage error.

Details

triggerId: the trigger id

Example

{ "error": { "code": "trigger-lifecycle-failed", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }

Excerpt

See also

Run on a schedule

`trigger-register-failed`

Synopsis

500 Internal Server Error, code trigger-register-failed

The runtime couldn't save the new trigger because of a storage error.

Details

None.

Example

{ "error": { "code": "trigger-register-failed", "message": "…", "requestId": "…" } }

Excerpt

See also

Run on a schedule

`trigger-update-failed`

Synopsis

500 Internal Server Error, code trigger-update-failed

The runtime couldn't update the trigger because of a storage error.

Details

triggerId: the trigger id

Example

{ "error": { "code": "trigger-update-failed", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }

Excerpt

See also

Run on a schedule

501 Not Implemented

`authz-membership-unsupported`

Synopsis

501 Not Implemented, code authz-membership-unsupported

Authorization is enforced, and the runtime can't change a team or membership together with its permissions, so it refuses and changes nothing.

Details

method: the missing operation in the runtime's tenant-hierarchy binding

Example

{ "error": { "code": "authz-membership-unsupported", "message": "…", "details": { "method": "…" }, "requestId": "…" } }

Excerpt

See also

DELETE /v1/teams/{teamId}/memberships/{userId}
PATCH /v1/teams/{teamId}/memberships/{userId}
POST /v1/projects/{projectId}/team-grants
PATCH /v1/projects/{projectId}/team-grants/{teamId}
DELETE /v1/projects/{projectId}/team-grants/{teamId}
DELETE /v1/projects/{projectId}/memberships/{userId}
1 more operations name it in their responses

`conversation-unregister-unsupported`

Synopsis

501 Not Implemented, code conversation-unregister-unsupported

This runtime can't unregister conversations.

Details

None.

Example

{ "error": { "code": "conversation-unregister-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/conversations/{conversationId}/unregister

`environments-unsupported`

Synopsis

501 Not Implemented, code environments-unsupported

The runtime's env store or secrets store can't list the env names it holds, so the tenant's environments can't be listed whole. The message names the store.

Details

None.

Example

{ "error": { "code": "environments-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

GET /v1/environments

`guardrail-outcomes-not-supported`

Synopsis

501 Not Implemented, code guardrail-outcomes-not-supported

This deployment doesn't record guardrail outcomes.

Details

None.

Example

{ "error": { "code": "guardrail-outcomes-not-supported", "message": "…", "requestId": "…" } }

Excerpt

See also

GET /v1/guardrails/{guardrailId}/outcomes

`improve-unsupported`

Synopsis

501 Not Implemented, code improve-unsupported

This runtime doesn't run improvement passes.

Details

None.

Example

{ "error": { "code": "improve-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

`memory-operation-unsupported`

Synopsis

501 Not Implemented, code memory-operation-unsupported

This runtime's memory doesn't support the operation: listing fact history, deleting facts or verifying facts.

Details

None.

Example

{ "error": { "code": "memory-operation-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

`pack-env-not-served`

Synopsis

501 Not Implemented, code pack-env-not-served

This server doesn't give a deployment's pack service the env its pack declares, so it lists none of its names: its pack services take theirs from how they're run. kindgi env plan lists the names a pack reads.

Details

None.

Example

{ "error": { "code": "pack-env-not-served", "message": "…", "requestId": "…" } }

Excerpt

See also

`pack-env-secrets-unaudited`

Synopsis

501 Not Implemented, code pack-env-secrets-unaudited

A deployment's secret values were asked for (secrets=values) on a server with nowhere to audit them, so none is read or given. The server's operator sets up its audit store. A request without secrets=values isn't refused for this. A pack service held for this shows it as its deployment's problem: the platform's to fix, with nothing for the pack's owner to do.

Details

None.

Example

{ "error": { "code": "pack-env-secrets-unaudited", "message": "…", "requestId": "…" } }

Excerpt

See also

`pack-env-unsupported`

Synopsis

501 Not Implemented, code pack-env-unsupported

This server doesn't give a pack service its declared env: its pack services take theirs from how they're run. The system pack env routes answer this on a server that doesn't run a pack service per deployment.

Details

None.

Example

{ "error": { "code": "pack-env-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

`permissions-unsupported`

Synopsis

501 Not Implemented, code permissions-unsupported

The runtime runs without an authorization store, so it can't say what the caller may do. Read whoami's tenantAdmin and reviewerRole instead.

Details

None.

Example

{ "error": { "code": "permissions-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

GET /v1/identity/me/permissions

`person-grants-unsupported`

Synopsis

501 Not Implemented, code person-grants-unsupported

The runtime runs without an authorization store, so it can't read or change a person's grants.

Details

None.

Example

{ "error": { "code": "person-grants-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

`production-unsupported`

Synopsis

501 Not Implemented, code production-unsupported

This server's projects can't be put in production: its project store has no production setting. Every run there is a staging run.

Details

None.

Example

{ "error": { "code": "production-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

PUT /v1/projects/{projectId}/production

`project-access-unsupported`

Synopsis

501 Not Implemented, code project-access-unsupported

The runtime has no authorization store, so it can't say who has access to the project.

Details

None.

Example

{ "error": { "code": "project-access-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

GET /v1/projects/{projectId}/access

`promotion-gate-unsupported`

Synopsis

501 Not Implemented, code promotion-gate-unsupported

A gate policy applies to this promotion, and the deployment can't record a gated promotion, so the promotion is refused.

Details

None.

Example

{ "error": { "code": "promotion-gate-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/agents/{agentId}/promotions

`promotions-unsupported`

Synopsis

501 Not Implemented, code promotions-unsupported

This runtime can't promote deployments: it has nowhere to write a promotion. The promotion check still answers. Nothing is written.

Details

None.

Example

{ "error": { "code": "promotions-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

`run-failures-not-supported`

Synopsis

501 Not Implemented, code run-failures-not-supported

This deployment can't group failed runs by cause.

Details

None.

Example

{ "error": { "code": "run-failures-not-supported", "message": "…", "requestId": "…" } }

Excerpt

See also

GET /v1/runs/failures

`secret-operation-unsupported`

Synopsis

501 Not Implemented, code secret-operation-unsupported

The secrets store doesn't support this operation. Under kindgi dev secrets live in env files and have no versions or revocation, so edit or remove the name there.

Details

None.

Example

{ "error": { "code": "secret-operation-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

`tenant-purge-unsupported`

Synopsis

501 Not Implemented, code tenant-purge-unsupported

This runtime doesn't purge tenants through the API.

Details

None.

Example

{ "error": { "code": "tenant-purge-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/system/tenants/{tenantId}/purge

`test-sets-not-supported`

Synopsis

501 Not Implemented, code test-sets-not-supported

This deployment can't list judged runs, so it can't build test sets from judgments.

Details

None.

Example

{ "error": { "code": "test-sets-not-supported", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/eval-suites/{suiteId}/versions/from-judgments

`trigger-operation-unsupported`

Synopsis

501 Not Implemented, code trigger-operation-unsupported

This deployment doesn't support the operation on triggers, such as listing a schedule's fire history or running it now.

Details

None.

Example

{ "error": { "code": "trigger-operation-unsupported", "message": "…", "requestId": "…" } }

Excerpt

See also

502 Bad Gateway

`authz-store-delete-failed`

Synopsis

502 Bad Gateway, code authz-store-delete-failed

A purge's delete of the tenant's authorization store failed; the message gives OpenFGA's answer, if it gave one, and what that left. A tenant's rows go only after its store, so a failure before then leaves every row, though its artifacts' bytes may be deleted. Run the purge again once OpenFGA answers.

Details

tenantId: the tenant

Example

{ "error": { "code": "authz-store-delete-failed", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } }

Excerpt

See also

POST /v1/system/tenants/{tenantId}/purge

`mcp-prompt-get-failed`

Synopsis

502 Bad Gateway, code mcp-prompt-get-failed

The runtime reached the MCP endpoint but listing its prompts or fetching the named prompt failed, for example because the remote server answered with a protocol error.

Details

endpointId: id of the MCP endpoint
promptName: the prompt being fetched; present when fetching one prompt, not when listing

Example

{ "error": { "code": "mcp-prompt-get-failed", "message": "…", "details": { "endpointId": "…", "promptName": "…" }, "requestId": "…" } }

Excerpt

See also

`mcp-resource-read-failed`

Synopsis

502 Bad Gateway, code mcp-resource-read-failed

The runtime reached the MCP endpoint but listing or reading its resources failed, for example because the remote server answered with a protocol error. Retry later or check the endpoint.

Details

endpointId: id of the MCP endpoint
uri: the resource URI being read; present when reading one resource, not when listing

Example

{ "error": { "code": "mcp-resource-read-failed", "message": "…", "details": { "endpointId": "…", "uri": "…" }, "requestId": "…" } }

Excerpt

See also

`secret-provider-unauthorized`

Synopsis

502 Bad Gateway, code secret-provider-unauthorized

The external secret provider rejected the runtime's credentials, so the secret can't be read or written. Ask an admin to fix the provider access.

Details

None.

Example

{ "error": { "code": "secret-provider-unauthorized", "message": "…", "requestId": "…" } }

Excerpt

See also

503 Service Unavailable

`access-record-unavailable`

Synopsis

503 Service Unavailable, code access-record-unavailable

The record of the operator's requests couldn't be written, so a system key's request did nothing. Retry after the Retry-After header.

Details

None.

Example

{ "error": { "code": "access-record-unavailable", "message": "…", "requestId": "…" } }

Excerpt

See also

POST /v1/system/keys
POST /v1/system/keys/{keyId}/revoke
POST /v1/system/tenants
PATCH /v1/system/tenants/{tenantId}
POST /v1/system/tenants/{tenantId}/close
PUT /v1/system/tenants/{tenantId}/suspended
8 more operations name it in their responses
Serve many tenants

`authz-backend-unavailable`

Synopsis

503 Service Unavailable, code authz-backend-unavailable

The store that holds permissions couldn't be read, so the runtime can't tell what the caller may do. Try the request again shortly.

Details

None.

Example

{ "error": { "code": "authz-backend-unavailable", "message": "…", "requestId": "…" } }

Excerpt

See also

GET /v1/identity/me/permissions

`database-busy`

Synopsis

503 Service Unavailable, code database-busy

The database was too busy to answer the read in time: a lock held by other work or a query past the database's time limit ended it, or no database connection came free within the server's wait. Only a GET or HEAD answers it. Retry after the Retry-After header. A request with any other method that the database was too busy for answers a 500 (internal-server-error, or the code of what failed, such as persistence-error), since it may have saved part of its work: check what it changed before you send it again.

Details

None.

Example

{ "error": { "code": "database-busy", "message": "…", "requestId": "…" } }

Excerpt

See also

`pack-env-unavailable`

Synopsis

503 Service Unavailable, code pack-env-unavailable

A deployment's pack env can't be given just now: its secret store failed or is rate-limited, a secret changed while it was read (twice), or the audit rows for its secrets weren't written. No value is given, and the message says which. Ask again; there's nothing for the pack's owner to do.

Details

None.

Example

{ "error": { "code": "pack-env-unavailable", "message": "…", "requestId": "…" } }

Excerpt

See also

`secret-provider-unavailable`

Synopsis

503 Service Unavailable, code secret-provider-unavailable

The external secret provider can't be reached, or the active secrets store can't do provider-driven rotation, so send the new value yourself.

Details

None.

Example

{ "error": { "code": "secret-provider-unavailable", "message": "…", "requestId": "…" } }

Excerpt

See also

`tenant-policy-unavailable`

Synopsis

503 Service Unavailable, code tenant-policy-unavailable

A tenant policy that an agent turn must apply couldn't be loaded or evaluated, so the turn fails instead of running without it.

Details

policyKind: the kind of policy that failed: hitl, model-routing or tool-errors

Example

{ "error": { "code": "tenant-policy-unavailable", "message": "…", "details": { "policyKind": "…" }, "requestId": "…" } }

Excerpt

See also

`tenant-state-unavailable`

Synopsis

503 Service Unavailable, code tenant-state-unavailable

The tenant's state couldn't be read, so the request changed nothing. Retry after the Retry-After header. On the S3-compatible surface, the same answer is S3's 503 ServiceUnavailable.

Details

None.

Example

{ "error": { "code": "tenant-state-unavailable", "message": "…", "requestId": "…" } }

Excerpt

See also

Codes with their own status

These come from parts of a deployment that answer outside the API's routes: the build service, the console under kindgi dev, and sign-in. Each has the status shown, and the envelope without requestId.

`tarball-hash-missing`

Synopsis

400 Bad Request, code tarball-hash-missing

A request to the build service (the build endpoint kindgi build and kindgi deploy send packs to) has no X-Content-SHA256 header. kindgi build sends it for you.

Details

None.

Example

{ "error": { "code": "tarball-hash-missing", "message": "…" } }

Excerpt

See also

kindgi build

`tarball-hash-invalid`

Synopsis

400 Bad Request, code tarball-hash-invalid

The build request's X-Content-SHA256 header isn't sha256: followed by 64 hex digits, or 64 hex digits alone.

Details

None.

Example

{ "error": { "code": "tarball-hash-invalid", "message": "…" } }

Excerpt

See also

kindgi build

`tarball-too-large`

Synopsis

413 Content Too Large, code tarball-too-large

The pack sent to the build service is larger than 512 MiB. Leave build output and dependencies out of the pack.

Details

None.

Example

{ "error": { "code": "tarball-too-large", "message": "…" } }

Excerpt

See also

kindgi build

`tarball-hash-mismatch`

Synopsis

400 Bad Request, code tarball-hash-mismatch

The pack the build service received doesn't hash to the X-Content-SHA256 the request named, so it was changed or cut short on the way. Send it again.

Details

None.

Example

{ "error": { "code": "tarball-hash-mismatch", "message": "…" } }

Excerpt

See also

kindgi build

`build-job-not-found`

Synopsis

404 Not Found, code build-job-not-found

The build service has no build job with that id.

Details

None.

Example

{ "error": { "code": "build-job-not-found", "message": "…" } }

Excerpt

See also

kindgi build

`build-job-gone`

Synopsis

410 Gone, code build-job-gone

The build job ended longer ago than the build service keeps jobs, so its status and output are gone. Build again.

Details

None.

Example

{ "error": { "code": "build-job-gone", "message": "…" } }

Excerpt

See also

kindgi build

`forbidden`

Synopsis

403 Forbidden, code forbidden

Under kindgi dev, the runtime gives the console its sign-in token only on the same machine (localhost, 127.0.0.1 or [::1]). Open the console from that machine.

Details

None.

Example

{ "error": { "code": "forbidden", "message": "…" } }

Excerpt

See also

`sign-in-unavailable`

Synopsis

500 Internal Server Error, code sign-in-unavailable

Signing in failed on the server: its database didn't answer, say, or an identity provider's settings can't start a sign-in, or a SAML response the provider's page posted was refused. Nothing about the cause is sent to the browser; a sign-in page shows the code instead of JSON. The runtime's log says why, as an sso warning: sign-in request failed: <reason>, sign-in with provider <id> didn't start: <reason>, or a SAML response for provider <id> was refused: <status> <code>: <message>. Try again; when it keeps failing, the warning says what to fix.

Details

None.

Example

{ "error": { "code": "sign-in-unavailable", "message": "…" } }

Excerpt

See also

Turn on sign-in

access.kindgi.com

kindgi license renew renews a deployment's license key at access.kindgi.com (POST https://access.kindgi.com/v1/renew). A refusal comes in that service's own shape, with no code wrapper and no requestId; the message says what to do, and the CLI prints it.

{ "error": "unavailable", "message": "…" }

Excerpt

`bad-request`

Synopsis

400 Bad Request, error bad-request

The body isn't a renewal request. A body over the size limit is answered the same way, with status 413.

Details

None: the body has error and message only.

Example

{ "error": "bad-request", "message": "…" }

Excerpt

See also

Renew the license key

`unauthorized`

Synopsis

401 Unauthorized, error unauthorized

No renewer has this deployment's key, or the request's signature doesn't verify. Enroll the deployment with kindgi license enroll, then add it at access.kindgi.com.

Details

None: the body has error and message only.

Example

{ "error": "unauthorized", "message": "…" }

Excerpt

See also

`stale-request`

Synopsis

401 Unauthorized, error stale-request

The request's time is more than 5 minutes off. Check the clock of the machine that sent it.

Details

None: the body has error and message only.

Example

{ "error": "stale-request", "message": "…" }

Excerpt

See also

Renew the license key

`replayed`

Synopsis

401 Unauthorized, error replayed

This exact request was used before. Send a new one.

Details

None: the body has error and message only.

Example

{ "error": "replayed", "message": "…" }

Excerpt

See also

Renew the license key

`rate-limited`

Synopsis

429 Too Many Requests, error rate-limited

Too many renewals for this key. The next one can go an hour later.

Details

None: the body has error and message only.

Example

{ "error": "rate-limited", "message": "…" }

Excerpt

See also

Renew the license key

`renewer-stopped`

Synopsis

403 Forbidden, error renewer-stopped

This deployment's renewal was stopped. Enroll it again with kindgi license enroll, or sign in at access.kindgi.com for a key.

Details

None: the body has error and message only.

Example

{ "error": "renewer-stopped", "message": "…" }

Excerpt

See also

`denied`

Synopsis

403 Forbidden, error denied

Dev access isn't available for this account. Write to contact@kindgi.com.

Details

None: the body has error and message only.

Example

{ "error": "denied", "message": "…" }

Excerpt

See also

Renew the license key

`key-revoked`

Synopsis

403 Forbidden, error key-revoked

The account's license key was revoked. Write to contact@kindgi.com.

Details

None: the body has error and message only.

Example

{ "error": "key-revoked", "message": "…" }

Excerpt

See also

Renew the license key

`not-entitled`

Synopsis

403 Forbidden, error not-entitled

The license has no contract term on record, so access.kindgi.com doesn't renew it. Write to contact@kindgi.com.

Details

None: the body has error and message only.

Example

{ "error": "not-entitled", "message": "…" }

Excerpt

See also

Renew the license key

`term-ended`

Synopsis

403 Forbidden, error term-ended

The license's contract term has ended, so it isn't renewed. The key you have runs until its own date. Write to contact@kindgi.com to extend the term.

Details

None: the body has error and message only.

Example

{ "error": "term-ended", "message": "…" }

Excerpt

See also

Renew the license key

`held-for-review`

Synopsis

403 Forbidden, error held-for-review

This renewal's counts (kindgi license renew --runtime) are above what a non-production key covers, so it got no new key: write to contact@kindgi.com about a production license. Kindgi can release the deployment after a review, and its renewals then aren't held until a date. The key you have runs until its own date. A renewal before the key is due gets the same key back.

Details

None: the body has error and message only.

Example

{ "error": "held-for-review", "message": "…" }

Excerpt

See also

Renew the license key

`unavailable`

Synopsis

503 Service Unavailable, error unavailable

No key could be issued: the service failed to store or sign it. Try again later.

Details

None: the body has error and message only.

Example

{ "error": "unavailable", "message": "…" }

Excerpt

See also

Renew the license key