# Error codes

> Every error code the HTTP API answers with, its status, what it means and what its details hold.

When the API refuses a request, the response body is an error envelope:

```json excerpt
{
  "error": {
    "code": "agent-not-found",
    "message": "…",
    "requestId": "…"
  }
}
```

- `code` says what went wrong. Match on it: it stays the same, while `message` is written for people and can change.
- `details`, when present, holds the facts the code needs: a limit, the field at fault, when to retry.
- `requestId` identifies the request in the runtime's logs. Quote it when you report a problem.

The TypeScript and Python clients raise these as typed errors with the same `code`. The codes below are grouped by their HTTP status.

## 400 Bad Request

### `auth-not-session-token`

**Synopsis**

`400 Bad Request`, code `auth-not-session-token`

`POST /v1/auth/refresh` or `POST /v1/auth/logout` was called with a token that isn't a session token (`kgi_sk_*`). Bearer API tokens are managed through `/v1/tokens`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "auth-not-session-token", "message": "…", "requestId": "…" } }
```

**See also**

- [Sessions](https://docs.kindgi.com/v0.1.8/guides/sso/sessions.md)

### `bad-input`

**Synopsis**

`400 Bad Request`, code `bad-input`

The request is malformed: the body isn't valid JSON or isn't an object, a JSON body nests objects and arrays deeper than the limit, a field has the wrong type or value, a `projectId` isn't a UUID, or a `cursor` wasn't issued by this list. Fix the input named in the message.

**Details**

- `maxDepth`: the most levels a JSON body may nest, when it nests deeper

**Example**

```json excerpt
{ "error": { "code": "bad-input", "message": "…", "details": { "maxDepth": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint/problem`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentsrecordproblem.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetsuspended.md)
- [`GET /v1/agents/{agentId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentslistversions.md)
- [`GET /v1/flows/{flowId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowslistversions.md)
- [`GET /v1/tools/{toolId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolslistversions.md)
- 13 more operations name it in their responses

### `blob-hash-mismatch`

**Synopsis**

`400 Bad Request`, code `blob-hash-mismatch`

The uploaded bytes don't match the `expectedHash` you sent. Nothing is stored; recompute the hash or resend the bytes.

**Details**

- `expected`: the hash you declared
- `actual`: the hash of the bytes received

**Example**

```json excerpt
{ "error": { "code": "blob-hash-mismatch", "message": "…", "details": { "expected": "…", "actual": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/artifacts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/artifactsupload.md)

### `blob-size-mismatch`

**Synopsis**

`400 Bad Request`, code `blob-size-mismatch`

The uploaded bytes aren't the size you declared. Nothing is stored; send the right `size` or the full body.

**Details**

- `declared`: the size you declared
- `actual`: the size of the bytes received

**Example**

```json excerpt
{ "error": { "code": "blob-size-mismatch", "message": "…", "details": { "declared": "…", "actual": "…" }, "requestId": "…" } }
```

**See also**

- [Keep files with a run](https://docs.kindgi.com/v0.1.8/guides/runs/keep-files-with-a-run.md)

### `cookie-session-not-refreshable`

**Synopsis**

`400 Bad Request`, code `cookie-session-not-refreshable`

`POST /v1/auth/refresh` was called with a browser (cookie) session. These sessions aren't refreshed; sign in again when the session ends.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "cookie-session-not-refreshable", "message": "…", "requestId": "…" } }
```

**See also**

- [Sessions](https://docs.kindgi.com/v0.1.8/guides/sso/sessions.md)

### `deployment-validation-failed`

**Synopsis**

`400 Bad Request`, code `deployment-validation-failed`

The deployment's manifest has invalid definitions, or a tool names a model provider's key. Each problem is listed in `details.issues`; fix them and deploy again.

**Details**

- `issues`: list of problems, each naming the primitive, its index, id, path and message

**Example**

```json excerpt
{ "error": { "code": "deployment-validation-failed", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)
- [Use a built-in check](https://docs.kindgi.com/v0.1.8/guides/guardrails/use-a-built-in-check.md)
- [Give a tool a secret](https://docs.kindgi.com/v0.1.8/guides/tools/give-a-tool-a-secret.md)

### `dispatcher-input-invalid`

**Synopsis**

`400 Bad Request`, code `dispatcher-input-invalid`

The eval run's input doesn't fit the suite's kind: neither an agent nor a flow reference was given, or the kind's validation rejected the target or comparison.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "dispatcher-input-invalid", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/eval-runs/{runId}/rescore`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalrunsrescore.md)

### `endpoint-url-invalid`

**Synopsis**

`400 Bad Request`, code `endpoint-url-invalid`

The pack service URL the operator set for a deployment isn't `https://<host>`: it isn't https, or it has user info, a path, a query or a fragment. The message says which. Send the service's origin only. The refusal is recorded as the deployment's `endpoint.problem`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "endpoint-url-invalid", "message": "…", "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)

### `env-cross-scope`

**Synopsis**

`400 Bad Request`, code `env-cross-scope`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "env-cross-scope", "message": "…", "requestId": "…" } }
```

**See also**

- [Set values per environment](https://docs.kindgi.com/v0.1.8/guides/secrets/per-environment-values.md)

### `env-name-mismatch`

**Synopsis**

`400 Bad Request`, code `env-name-mismatch`

The `envName` in the body differs from the `envName` in the query string. Send one, or make them equal.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "env-name-mismatch", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotate.md)
- [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/envput.md)

### `env-name-required`

**Synopsis**

`400 Bad Request`, code `env-name-required`

The `envName` query parameter is missing, or isn't a valid environment name (lowercase letters, digits and hyphens, starting with a letter, up to 63 characters).

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "env-name-required", "message": "…", "requestId": "…" } }
```

**See also**

- [`DELETE /v1/env/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/envdelete.md)

### `image-unverifiable`

**Synopsis**

`400 Bad Request`, code `image-unverifiable`

The runtime couldn't verify the deployment's image: the registry probe failed, or the registry's digest differs from the digest in the image reference.

**Details**

- `imageRef`: the image reference that was checked

**Example**

```json excerpt
{ "error": { "code": "image-unverifiable", "message": "…", "details": { "imageRef": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)

### `invalid-agent`

**Synopsis**

`400 Bad Request`, code `invalid-agent`

An agent definition breaks the rules. Defining it in code raises this code before anything is sent; the API answers the same problem as `validation-failed`, with each issue in `details.issues`.

**Details**

- `issues`: each problem: its path and what is wrong

**Example**

```json excerpt
{ "error": { "code": "invalid-agent", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/agents`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspublish.md)

### `invalid-guardrail`

**Synopsis**

`400 Bad Request`, code `invalid-guardrail`

A guardrail definition breaks the rules, or its kind doesn't match the check it names. Defining it in code raises this code; the API answers `validation-failed`, with each issue in `details.issues`.

**Details**

- `issues`: each problem: its path and what is wrong

**Example**

```json excerpt
{ "error": { "code": "invalid-guardrail", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/guardrails`](https://docs.kindgi.com/v0.1.8/reference/api/operations/guardrailsregister.md)

### `invalid-mcp-endpoint`

**Synopsis**

`400 Bad Request`, code `invalid-mcp-endpoint`

The body of `POST /v1/mcp/endpoints` isn't a valid MCP endpoint registration: an unknown field, a missing or empty id or name, an unknown transport, or a config that doesn't match its transport.

**Details**

- `reason`: short machine-readable reason, such as `unknown-field`, `empty-endpoint-id`, `unknown-transport`, `missing-config`, `config-transport-mismatch` or `invalid-secret-ref`

**Example**

```json excerpt
{ "error": { "code": "invalid-mcp-endpoint", "message": "…", "details": { "reason": "…" }, "requestId": "…" } }
```

**See also**

- [Use an MCP server's tools](https://docs.kindgi.com/v0.1.8/guides/tools/mcp-servers.md)

### `invalid-provider`

**Synopsis**

`400 Bad Request`, code `invalid-provider`

The provider's metadata is invalid, for example an empty id, an empty region or no models. The message says which.

**Details**

- `reason`: short code for the problem, such as empty-id or empty-region
- `providerId`: the provider id; present on a registry refusal

**Example**

```json excerpt
{ "error": { "code": "invalid-provider", "message": "…", "details": { "reason": "…", "providerId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/providers`](https://docs.kindgi.com/v0.1.8/reference/api/operations/providersregister.md)

### `invalid-provider-config`

**Synopsis**

`400 Bad Request`, code `invalid-provider-config`

The identity provider body is invalid: a field is missing, has the wrong type, isn't a valid URL, is a plaintext secret, or can't be changed. The message names the field.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "invalid-provider-config", "message": "…", "requestId": "…" } }
```

**See also**

- [Set up SSO](https://docs.kindgi.com/v0.1.8/guides/sso.md)

### `invalid-schema`

**Synopsis**

`400 Bad Request`, code `invalid-schema`

A tool's input or output schema isn't a valid JSON Schema. Defining the tool in code raises this code; the API answers `validation-failed`, with the issue's path `/input` or `/output`.

**Details**

- `issues`: each problem: its path and what is wrong

**Example**

```json excerpt
{ "error": { "code": "invalid-schema", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tools`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsregister.md)

### `invalid-tool-definition`

**Synopsis**

`400 Bad Request`, code `invalid-tool-definition`

A tool manifest breaks the rules, for example a missing or inexact `version`, or both or neither of `handler` and `spec`. Defining it in code raises this code; the API answers `validation-failed`, with each issue in `details.issues`.

**Details**

- `issues`: each problem: its path and what is wrong

**Example**

```json excerpt
{ "error": { "code": "invalid-tool-definition", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tools`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsregister.md)

### `item-not-found`

**Synopsis**

`400 Bad Request`, code `item-not-found`

The pointer in `item` resolves to nothing in the run's output. Fix the pointer.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "item-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/judgmentscreate.md)

### `judge-class-not-applicable`

**Synopsis**

`400 Bad Request`, code `judge-class-not-applicable`

The judge class you named doesn't exist, or doesn't apply to this run's project or agent.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "judge-class-not-applicable", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/judgmentscreate.md)

### `kind-not-applied`

**Synopsis**

`400 Bad Request`, code `kind-not-applied`

You publish a policy of a kind this runtime doesn't enforce, so publishing it would change nothing. Publish one of the kinds listed in `details.appliedKinds`.

**Details**

- `kind`: the policy kind you sent
- `appliedKinds`: the policy kinds this runtime applies

**Example**

```json excerpt
{ "error": { "code": "kind-not-applied", "message": "…", "details": { "kind": "…", "appliedKinds": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiespublish.md)

### `provider-key-refused`

**Synopsis**

`400 Bad Request`, code `provider-key-refused`

The request names a model provider's key as a secret for something that isn't that provider, such as a tool, an MCP endpoint or a webhook endpoint. Store the key under its own name and use that name.

**Details**

- `secret`: name of the secret that is a model provider's key
- `providerId`: id of the provider that owns that key

**Example**

```json excerpt
{ "error": { "code": "provider-key-refused", "message": "…", "details": { "secret": "…", "providerId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tools`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsregister.md)
- [`POST /v1/tools/{toolId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsreinstateversion.md)
- [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsregister.md)
- [`POST /v1/webhooks`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhooksregister.md)
- [`POST /v1/webhook-endpoints`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointscreate.md)
- [`PATCH /v1/webhook-endpoints/{endpointId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointsupdate.md)
- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)

### `redirect-uri-mismatch`

**Synopsis**

`400 Bad Request`, code `redirect-uri-mismatch`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "redirect-uri-mismatch", "message": "…", "requestId": "…" } }
```

**See also**

- [Sign in to the console](https://docs.kindgi.com/v0.1.8/guides/sso/sign-in.md)

### `redirect-uri-not-allowed`

**Synopsis**

`400 Bad Request`, code `redirect-uri-not-allowed`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "redirect-uri-not-allowed", "message": "…", "requestId": "…" } }
```

**See also**

- [Sign in to the console](https://docs.kindgi.com/v0.1.8/guides/sso/sign-in.md)

### `reference-out-of-scope`

**Synopsis**

`400 Bad Request`, code `reference-out-of-scope`

A request names an item its project can't reach: a tool, agent, flow, guardrail, data block, check or eval suite that isn't registered in the project, its org or the tenant. Nothing is written. Register the item where the project reaches it, or use it from the project that has it.

**Details**

- `issues`: list of the references refused, each with the `path` it was named at, its `kind` and `id`, and a message

**Example**

```json excerpt
{ "error": { "code": "reference-out-of-scope", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`POST /v1/agents`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspublish.md)
- [`POST /v1/agents/{agentId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsreinstateversion.md)
- [`POST /v1/agents/{agentId}/promotions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspromotionscreate.md)
- [`POST /v1/agents/{agentId}/promotions/check`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspromotionscheck.md)
- [`POST /v1/flows`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowspublish.md)
- 12 more operations name it in their responses

### `reserved-name-prefix`

**Synopsis**

`400 Bad Request`, code `reserved-name-prefix`

The name starts with the prefix reserved for the runtime's own secrets, so you can't write it.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "reserved-name-prefix", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)
- [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantconfigupsert.md)
- [`POST /v1/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsset.md)
- [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotate.md)
- [`POST /v1/webhooks`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhooksregister.md)
- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)
- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)

### `schema-validation-failed`

**Synopsis**

`400 Bad Request`, code `schema-validation-failed`

The API doesn't send this code. A flow definition with this problem is answered `validation-failed`, with the problem in `details.issues`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "schema-validation-failed", "message": "…", "requestId": "…" } }
```

**See also**

- [`validation-failed`](https://docs.kindgi.com/v0.1.8/reference/errors.md#validation-failed)
- [Write a flow](https://docs.kindgi.com/v0.1.8/guides/flows/write-a-flow.md)

### `scope-invalid`

**Synopsis**

`400 Bad Request`, code `scope-invalid`

The scope you sent is malformed or unusable: `scopeKind` and `scopeId` don't fit together, `inherit` isn't true or false, or the org or project doesn't exist for your tenant. Fix the scope fields.

**Details**

- `projectId`: the project that wasn't found (MCP endpoint register only)
- `orgId`: the org that wasn't found (MCP endpoint register only)

**Example**

```json excerpt
{ "error": { "code": "scope-invalid", "message": "…", "details": { "projectId": "…", "orgId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/blocks`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blockslist.md)

### `scope-kind-required`

**Synopsis**

`400 Bad Request`, code `scope-kind-required`

A secrets or env request leaves out the scope: `scopeKind` is missing from the query, or the body's `scope` is missing or has a `kind` other than `tenant`, `org` or `project`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "scope-kind-required", "message": "…", "requestId": "…" } }
```

**See also**

- [`DELETE /v1/env/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/envdelete.md)
- [`DELETE /v1/secrets/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrevoke.md)

### `scope-mismatch`

**Synopsis**

`400 Bad Request`, code `scope-mismatch`

Two scopes in one request disagree: the body `scope` differs from the query `scopeKind`/`scopeId`, or the body `scope.tenantId` isn't your tenant.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "scope-mismatch", "message": "…", "requestId": "…" } }
```

**See also**

- [`DELETE /v1/secrets/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrevoke.md)
- [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/envput.md)

### `secret-name-invalid`

**Synopsis**

`400 Bad Request`, code `secret-name-invalid`

The secrets store can't write a secret under this name. Under `kindgi dev`, a secret is a key in your env files, so its name is capital letters, digits and underscores, not starting with a digit (`ACME_WOO_ORDERS`, not `acme-woo-orders`), and never `KINDGI_*`, the runtime's own configuration. The message says the rule and a name that works.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-name-invalid", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)
- [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantconfigupsert.md)
- [`POST /v1/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsset.md)
- [`POST /v1/webhooks`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhooksregister.md)
- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)
- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)

### `secret-value-invalid`

**Synopsis**

`400 Bad Request`, code `secret-value-invalid`

The secrets store can't hold this value as given. Under `kindgi dev`, a secret is a key in your env files, and no env-file quoting holds a value that has a double quote, or a backslash followed by `n` or `r`, together with a carriage return or with both a single quote and a backtick. Store the value encoded (base64, say), or without one of those characters. The message says why, and never repeats the value.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-value-invalid", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)
- [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantconfigupsert.md)
- [`POST /v1/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsset.md)
- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)
- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)

### `secret-value-too-large`

**Synopsis**

`400 Bad Request`, code `secret-value-too-large`

The secret value is larger than the size limit the secrets store accepts.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-value-too-large", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)
- [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantconfigupsert.md)
- [`POST /v1/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsset.md)
- [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotate.md)
- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)

### `signature-invalid`

**Synopsis**

`400 Bad Request`, code `signature-invalid`

The deployment's signature isn't valid: it isn't base64, can't be verified, or doesn't match the signed envelope of image digest, version, index hash, tenant and publish time.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "signature-invalid", "message": "…", "requestId": "…" } }
```

**See also**

- [Start runs from WooCommerce, Drupal or any signed webhook](https://docs.kindgi.com/v0.1.8/guides/webhooks/start-runs-from-webhooks.md)

### `signing-key-algorithm-unsupported`

**Synopsis**

`400 Bad Request`, code `signing-key-algorithm-unsupported`

The signing key uses an algorithm other than ed25519: a trust request names another `algorithm`, or a stored key can't be used to verify.

**Details**

- `algorithm`: the unsupported algorithm; present only when a stored key fails verification

**Example**

```json excerpt
{ "error": { "code": "signing-key-algorithm-unsupported", "message": "…", "details": { "algorithm": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/signing-keys/{keyId}/revoke`](https://docs.kindgi.com/v0.1.8/reference/api/operations/signingkeysrevoke.md)

### `supervisor-header-missing`

**Synopsis**

`400 Bad Request`, code `supervisor-header-missing`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "supervisor-header-missing", "message": "…", "requestId": "…" } }
```

**See also**

- [How Kindgi fits your app](https://docs.kindgi.com/v0.1.8/concepts/architecture.md)

### `token-sign-in-needs-an-api-token`

**Synopsis**

`400 Bad Request`, code `token-sign-in-needs-an-api-token`

`POST /v1/auth/token-sign-in` was called while signed in by a session. It takes an API token in the Authorization header, so there's nothing to exchange.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "token-sign-in-needs-an-api-token", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authtokensignin.md)

### `trigger-invalid-config`

**Synopsis**

`400 Bad Request`, code `trigger-invalid-config`

The trigger's schedule settings are invalid, for example a cron expression that doesn't parse or fires more often than the minimum interval.

**Details**

- `triggerId`: the trigger being updated (updates only)

**Example**

```json excerpt
{ "error": { "code": "trigger-invalid-config", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }
```

**See also**

- [`PATCH /v1/schedules/{triggerId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/schedulesupdate.md)
- [Run on a schedule](https://docs.kindgi.com/v0.1.8/guides/runs/run-on-a-schedule.md)

### `unknown-effect`

**Synopsis**

`400 Bad Request`, code `unknown-effect`

A tool declares an effect kind that isn't supported. Defining the tool in code raises this code; the API answers `validation-failed`, with the issue in `details.issues`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "unknown-effect", "message": "…", "requestId": "…" } }
```

**See also**

- [`validation-failed`](https://docs.kindgi.com/v0.1.8/reference/errors.md#validation-failed)
- [Write a tool](https://docs.kindgi.com/v0.1.8/guides/tools/write-a-tool.md)

### `unknown-field`

**Synopsis**

`400 Bad Request`, code `unknown-field`

The request body has a field the endpoint doesn't accept. The message names the field; remove it and resend.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "unknown-field", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmintpublic.md)
- [`POST /v1/webhook-endpoints/{endpointId}/test`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointssendtest.md)

### `unresolved-guardrail`

**Synopsis**

`400 Bad Request`, code `unresolved-guardrail`

An agent names a guardrail that isn't registered, so its turn can't start. Register the missing guardrails or remove them from the agent.

**Details**

- `guardrailIds`: the guardrail ids that aren't registered
- `runId`: the run the turn belongs to, when it has one

**Example**

```json excerpt
{ "error": { "code": "unresolved-guardrail", "message": "…", "details": { "guardrailIds": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Configure a guardrail](https://docs.kindgi.com/v0.1.8/guides/guardrails/configure-a-guardrail.md)

### `unresolved-tool`

**Synopsis**

`400 Bad Request`, code `unresolved-tool`

An agent's turn needs a tool that isn't registered: the agent declares a tool the project doesn't have, or the model asks for a tool the agent doesn't declare. Register the tool or fix the agent definition.

**Details**

- `toolId`: the tool that couldn't be resolved
- `runId`: the run the turn belongs to, when it has one

**Example**

```json excerpt
{ "error": { "code": "unresolved-tool", "message": "…", "details": { "toolId": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)

### `validation-failed`

**Synopsis**

`400 Bad Request`, code `validation-failed`

The request body is well-formed JSON but fails validation, for example an agent, flow, tool, policy or eval suite definition that breaks the rules, or a version pin that can't be resolved. Fix the entries in `details.issues` and resend.

**Details**

- `issues`: list of problems, each with a path to the offending field and a message

**Example**

```json excerpt
{ "error": { "code": "validation-failed", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsderiveversion.md)
- [`POST /v1/tools`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsregister.md)
- [`POST /v1/proposals/improve`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalsimprove.md)
- [`POST /v1/blocks`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blockspublish.md)
- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)

### `webhook-body-not-json`

**Synopsis**

`400 Bad Request`, code `webhook-body-not-json`

The request says its content type is JSON, but the body doesn't parse as JSON.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "webhook-body-not-json", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/hooksreceive.md)

### `webhook-secret-not-found`

**Synopsis**

`400 Bad Request`, code `webhook-secret-not-found`

The secret the endpoint references doesn't exist. Store the secret first, then register the endpoint.

**Details**

- `secretRef`: the secret reference that was not found (name and environment)

**Example**

```json excerpt
{ "error": { "code": "webhook-secret-not-found", "message": "…", "details": { "secretRef": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/webhook-endpoints`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointscreate.md)

### `webhook-secret-too-weak`

**Synopsis**

`400 Bad Request`, code `webhook-secret-too-weak`

The signing secret is too weak: it must be `whsec_` followed by base64 of at least 24 random bytes. `POST /v1/webhook-endpoints/generate-secret` makes a valid one.

**Details**

- `secretRef`: the secret reference that was too weak (name and environment)

**Example**

```json excerpt
{ "error": { "code": "webhook-secret-too-weak", "message": "…", "details": { "secretRef": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/webhook-endpoints`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointscreate.md)

### `webhook-url-refused`

**Synopsis**

`400 Bad Request`, code `webhook-url-refused`

The deployment refuses the endpoint URL, for example because of where it points. The message says why.

**Details**

- `reason`: why the URL was refused

**Example**

```json excerpt
{ "error": { "code": "webhook-url-refused", "message": "…", "details": { "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/webhook-endpoints`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointscreate.md)
- [`PATCH /v1/webhook-endpoints/{endpointId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointsupdate.md)

## 401 Unauthorized

### `auth-expired`

**Synopsis**

`401 Unauthorized`, code `auth-expired`

Your API key or public run token has expired. Use a new one; an expired console session answers `session-expired` instead.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "auth-expired", "message": "…", "requestId": "…" } }
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [`session-expired`](https://docs.kindgi.com/v0.1.8/reference/errors.md#session-expired)

### `auth-missing`

**Synopsis**

`401 Unauthorized`, code `auth-missing`

The request has no usable credentials: the Authorization header is absent or not `Bearer <token>`, or the token isn't recognised. Send a valid API key or session token.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "auth-missing", "message": "…", "requestId": "…" } }
```

**See also**

- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)

### `auth-revoked`

**Synopsis**

`401 Unauthorized`, code `auth-revoked`

The API key you used has been revoked. Use another key. Also sent when a console session was opened with a key that has since been revoked: sign in again.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "auth-revoked", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens/{tokenId}/revoke`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensrevoke.md)

### `refresh-token-invalid`

**Synopsis**

`401 Unauthorized`, code `refresh-token-invalid`

The session token was rotated by a refresh and is no longer valid. Retry with the fresh token from the last refresh.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "refresh-token-invalid", "message": "…", "requestId": "…" } }
```

**See also**

- [Sessions](https://docs.kindgi.com/v0.1.8/guides/sso/sessions.md)

### `session-expired`

**Synopsis**

`401 Unauthorized`, code `session-expired`

A session token's absolute lifetime has ended. Sign in again to get a new session.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "session-expired", "message": "…", "requestId": "…" } }
```

**See also**

- [Sessions](https://docs.kindgi.com/v0.1.8/guides/sso/sessions.md)

### `session-inactive`

**Synopsis**

`401 Unauthorized`, code `session-inactive`

A session token has been idle longer than the deployment's inactivity timeout, so it's refused. Sign in again.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "session-inactive", "message": "…", "requestId": "…" } }
```

**See also**

- [Sessions](https://docs.kindgi.com/v0.1.8/guides/sso/sessions.md)

### `webhook-refused`

**Synopsis**

`401 Unauthorized`, code `webhook-refused`

The inbound webhook request doesn't prove who sent it: an unknown address, a missing, wrong or too old signature, or a secret that can't be read. The answer is the same for every reason; the reason is in the trigger's fires and the access audit.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "webhook-refused", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/hooksreceive.md)

## 403 Forbidden

### `authz-denied`

**Synopsis**

`403 Forbidden`, code `authz-denied`

The API doesn't send this code. A refused action is answered `permission-denied`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "authz-denied", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsregister.md)

### `capability-not-mintable`

**Synopsis**

`403 Forbidden`, code `capability-not-mintable`

A tenant's key can't carry a system capability (`system:*`, or `kindgi:system` on a runtime serving many tenants): those are system keys' alone. Mint the key without them, or mint a system key with `POST /v1/system/keys`.

**Details**

- `capabilities`: the capabilities asked for that a tenant's key can't carry
- `action`: the action that was refused
- `resource`: the resource it was refused on
- `reason`: why the caller was refused

**Example**

```json excerpt
{ "error": { "code": "capability-not-mintable", "message": "…", "details": { "capabilities": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)

### `csrf-origin-mismatch`

**Synopsis**

`403 Forbidden`, code `csrf-origin-mismatch`

A request authenticated by the console session cookie came from an origin the deployment doesn't allow, or carried no Origin header. Use the console at its own address, or an API key.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "csrf-origin-mismatch", "message": "…", "requestId": "…" } }
```

**See also**

- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)

### `host-access-denied`

**Synopsis**

`403 Forbidden`, code `host-access-denied`

The deployment doesn't let tenant configuration reach its host, so a `stdio` MCP endpoint (a command on the host) is refused. Use an HTTP endpoint instead, or ask whoever runs the deployment.

**Details**

- `action`: the action that was refused
- `resource`: the resource it was refused on, as type:id
- `reason`: why the check refused it

**Example**

```json excerpt
{ "error": { "code": "host-access-denied", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsregister.md)
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)
- [Use an MCP server's tools](https://docs.kindgi.com/v0.1.8/guides/tools/mcp-servers.md)

### `identity-providers-operator-managed`

**Synopsis**

`403 Forbidden`, code `identity-providers-operator-managed`

The deployment's operator manages sign-in, so changing identity providers needs the deployment's own token; a tenant admin's key is refused.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "identity-providers-operator-managed", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/auth/providers`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authprovidersregister.md)
- [`PATCH /v1/auth/providers/{providerId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authprovidersupdate.md)
- [`POST /v1/auth/providers/{providerId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authprovidersunregister.md)
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)

### `insufficient-role`

**Synopsis**

`403 Forbidden`, code `insufficient-role`

The reviewer's role ranks below the tier the approval requires, so it can't decide it. Ask a reviewer of a higher role, or escalate.

**Details**

- `reviewerId`: the reviewer
- `reviewerRole`: the reviewer's role
- `requiredRole`: the role the approval needs

**Example**

```json excerpt
{ "error": { "code": "insufficient-role", "message": "…", "details": { "reviewerId": "…", "reviewerRole": "…", "requiredRole": "…" }, "requestId": "…" } }
```

**See also**

- [Decide an approval](https://docs.kindgi.com/v0.1.8/guides/approvals/decide-an-approval.md)

### `judge-class-not-allowed`

**Synopsis**

`403 Forbidden`, code `judge-class-not-allowed`

The judge class limits who may assert it, and your key or role isn't one of them, so you can't record a judgment as that class.

**Details**

- `action`: the action that was refused
- `resource`: the resource it was refused on
- `reason`: why the caller was refused

**Example**

```json excerpt
{ "error": { "code": "judge-class-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/judgmentscreate.md)
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)

### `key-project-mismatch`

**Synopsis**

`403 Forbidden`, code `key-project-mismatch`

Your key is limited to one project, and the request names another project, or asks to mint a key not limited to your project. Use the project the key is limited to.

**Details**

- `keyProjectId`: the project your key is limited to
- `projectId`: the project the request names
- `action`: the action that was refused
- `resource`: the resource it was refused on
- `reason`: why the caller was refused

**Example**

```json excerpt
{ "error": { "code": "key-project-mismatch", "message": "…", "details": { "keyProjectId": "…", "projectId": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [`POST /v1/artifacts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/artifactsupload.md)
- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)

### `license-operator-only`

**Synopsis**

`403 Forbidden`, code `license-operator-only`

`GET /v1/license` and `GET /v1/license/usage` are for the deployment's own token, or a system key holding `system:license`. Where the deployment serves a single tenant, that tenant's admins also read the license's countdown, never its use. Other callers are refused, and the refusal recorded.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "license-operator-only", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/license`](https://docs.kindgi.com/v0.1.8/reference/api/operations/licenseget.md)
- [`GET /v1/license/usage`](https://docs.kindgi.com/v0.1.8/reference/api/operations/licenseusage.md)
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)

### `participant-not-allowed`

**Synopsis**

`403 Forbidden`, code `participant-not-allowed`

A turn would run as a participant, and you may not read that participant's memory. A turn reads and keeps its participant's memory, so running as one takes what the memory API takes: you're the participant yourself (that user, with their session or their own API key, never a service account's key), or you hold `write` on the turn's project. When the turn's project isn't known, only the participant may. It's checked wherever a turn gets a participant: `input.participantId` on `POST /v1/runs`, `participantId` on `POST /v1/conversations`, and a conversation's own participant when you post a turn into it, whatever the body names. Nothing was started or opened. Use a key or role with `write` on the turn's project, or have the participant run it.

**Details**

- `action`: the action that was refused: `write`
- `resource`: what it was refused on, as type:id: `conversation:<id>` when you posted into a conversation (never its participant or project), else `project:<id>`, the turn's project, or `tenant:<id>` when that isn't known
- `reason`: why it was refused; when you posted into a conversation, it names neither the conversation's participant nor its project

**Example**

```json excerpt
{ "error": { "code": "participant-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`POST /v1/conversations`](https://docs.kindgi.com/v0.1.8/reference/api/operations/conversationsopen.md)

### `permission-denied`

**Synopsis**

`403 Forbidden`, code `permission-denied`

Your key or session isn't allowed to do this on this resource, or lacks a capability the route needs, which the message names. For a permission, ask an admin for it. A key carries only the capabilities it was made with, and only ones the person who made it holds: use a key made with that capability.

**Details**

- `action`: the action that was refused
- `resource`: the resource it was refused on, as type:id
- `reason`: why the check refused it

**Example**

```json excerpt
{ "error": { "code": "permission-denied", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmintpublic.md)
- [`POST /v1/memory/facts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorywritefact.md)
- [`DELETE /v1/memory/facts/{factId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorydeletefact.md)
- [`POST /v1/memory/facts/{factId}/supersede`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorysupersedefact.md)
- [`POST /v1/memory/facts/{factId}/verify`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memoryverifyfact.md)
- 16 more operations name it in their responses
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)
- [Memory reference](https://docs.kindgi.com/v0.1.8/guides/agents/memory-reference.md)
- [Approvals reference](https://docs.kindgi.com/v0.1.8/guides/approvals/approvals-reference.md)

### `production-limit-reached`

**Synopsis**

`403 Forbidden`, code `production-limit-reached`

You put a project in production while the tenant already had as many projects in production as its limit allows, or more (`projectsInProduction`, set by whoever runs the server). Nothing changed. A project already in production isn't counted again, and taking one out is never refused. Take a project out of production, or go where `details.next` says when the server names a place, or ask whoever runs it to raise the limit; then put the project in production again.

**Details**

- `projectId`: the project that wasn't put in production
- `limit`: which limit: `projects-in-production`
- `projectsInProduction`: the tenant's limit on projects in production
- `inProduction`: how many of the tenant's projects are in production; over the limit when the limit was lowered below it
- `next`: where to go for a higher limit, for example a billing page (`KINDGI_PRODUCTION_NEXT_URL`); absent when the server names none

**Example**

```json excerpt
{ "error": { "code": "production-limit-reached", "message": "…", "details": { "projectId": "…", "limit": "…", "projectsInProduction": "…", "inProduction": "…", "next": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/projects/{projectId}/production`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsproductionset.md)

### `production-not-allowed`

**Synopsis**

`403 Forbidden`, code `production-not-allowed`

You put a project in production while the tenant isn't allowed to: the server gates production (`KINDGI_PRODUCTION_GATE=on`), and the tenant's `productionAllowed` is `false`. Projects already in production stay so, and staging keeps working. Go where `details.next` says, when the server names a place, or ask whoever runs it; then put the project in production again.

**Details**

- `projectId`: the project that wasn't put in production
- `next`: where to go to be allowed, for example a billing page (`KINDGI_PRODUCTION_NEXT_URL`); absent when the server names none

**Example**

```json excerpt
{ "error": { "code": "production-not-allowed", "message": "…", "details": { "projectId": "…", "next": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/projects/{projectId}/production`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsproductionset.md)

### `role-exceeds-principal`

**Synopsis**

`403 Forbidden`, code `role-exceeds-principal`

An admin key was requested for a principal that isn't a tenant admin. Mint a member key instead.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "role-exceeds-principal", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)

### `separate-approver-required`

**Synopsis**

`403 Forbidden`, code `separate-approver-required`

The approval requires a different person from the one who requested it, and you asked for it. Ask another reviewer to approve.

**Details**

- `approvalId`: the approval that needs another approver

**Example**

```json excerpt
{ "error": { "code": "separate-approver-required", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } }
```

**See also**

- [Decide an approval](https://docs.kindgi.com/v0.1.8/guides/approvals/decide-an-approval.md)

### `signer-not-trusted`

**Synopsis**

`403 Forbidden`, code `signer-not-trusted`

The key that signed the deployment isn't on the tenant's trust list. Trust the key, then deploy again.

**Details**

- `signerKeyId`: id of the signing key that isn't trusted

**Example**

```json excerpt
{ "error": { "code": "signer-not-trusted", "message": "…", "details": { "signerKeyId": "…" }, "requestId": "…" } }
```

**See also**

- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)

### `system-key-expiry-required`

**Synopsis**

`403 Forbidden`, code `system-key-expiry-required`

A full system key minted by another system key must expire: set `expiresAt`. Only the deployment's own token mints one that never expires.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "system-key-expiry-required", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)

### `system-key-on-tenant-route`

**Synopsis**

`403 Forbidden`, code `system-key-on-tenant-route`

A system key was sent to a route it can't use. A system key acts in no tenant, so it reaches `/v1/system/*`, `GET /v1/license` and `GET /v1/license/usage` only: use one of the tenant's keys.

**Details**

- `action`: the action that was refused
- `resource`: the resource it was refused on
- `reason`: why the caller was refused

**Example**

```json excerpt
{ "error": { "code": "system-key-on-tenant-route", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)
- [`GET /v1/system/whoami`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeyswhoami.md)

### `system-principal-required`

**Synopsis**

`403 Forbidden`, code `system-principal-required`

The route is a system route (`/v1/system/*`), and it was called with a tenant's key or a session. Call it with a system key (`kgi_sy_…`).

**Details**

- `action`: the action that was refused
- `resource`: the resource it was refused on
- `reason`: why the caller was refused

**Example**

```json excerpt
{ "error": { "code": "system-principal-required", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)
- [`GET /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeyslist.md)
- [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysrevoke.md)
- [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantscreate.md)
- [`GET /v1/system/tenants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantslist.md)
- [`GET /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantsget.md)
- 14 more operations name it in their responses

### `system-scope-missing`

**Synopsis**

`403 Forbidden`, code `system-scope-missing`

The system key doesn't hold the scope this request takes, which `scope` names: the route's own, or more for what the request asks (creating a tenant without `firstAdmin`, for one). Every `/v1/system/keys` route takes the full system capability, which a scoped key doesn't hold.

**Details**

- `scope`: the scope the request takes
- `action`: the action that was refused
- `resource`: the resource it was refused on
- `reason`: why the caller was refused

**Example**

```json excerpt
{ "error": { "code": "system-scope-missing", "message": "…", "details": { "scope": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)
- [`GET /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeyslist.md)
- [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysrevoke.md)
- [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantscreate.md)
- [`GET /v1/system/tenants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantslist.md)
- [`GET /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantsget.md)
- 13 more operations name it in their responses

### `token-expiry-exceeds-minter`

**Synopsis**

`403 Forbidden`, code `token-expiry-exceeds-minter`

The new key would outlive the key minting it. Give it an `expiresAt` no later than the minting key's expiry.

**Details**

- `latestExpiresAt`: the latest expiry the new key may have
- `action`: the action that was refused
- `resource`: the resource it was refused on
- `reason`: why the caller was refused

**Example**

```json excerpt
{ "error": { "code": "token-expiry-exceeds-minter", "message": "…", "details": { "latestExpiresAt": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)

### `token-sign-in-not-allowed`

**Synopsis**

`403 Forbidden`, code `token-sign-in-not-allowed`

The key can't open a console session: it belongs to a service account, or it is narrowed to a member role or one project. Use a full key of a person, or the identity provider.

**Details**

- `action`: the action that was refused
- `resource`: the resource it was refused on, as type:id
- `reason`: why the check refused it

**Example**

```json excerpt
{ "error": { "code": "token-sign-in-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authtokensignin.md)
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)
- [Turn on sign-in](https://docs.kindgi.com/v0.1.8/deploy/sign-in.md)

### `token-sign-in-off`

**Synopsis**

`403 Forbidden`, code `token-sign-in-off`

This deployment doesn't allow signing in to the console with an API token. Sign in with the organization's identity provider, or ask whoever runs the deployment to allow it.

**Details**

- `action`: the action that was refused
- `resource`: the resource it was refused on, as type:id
- `reason`: why the check refused it

**Example**

```json excerpt
{ "error": { "code": "token-sign-in-off", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authtokensignin.md)
- [Run with authorization](https://docs.kindgi.com/v0.1.8/deploy/authorization.md)
- [Turn on sign-in](https://docs.kindgi.com/v0.1.8/deploy/sign-in.md)

## 404 Not Found

### `adapter-not-found`

**Synopsis**

`404 Not Found`, code `adapter-not-found`

No adapter is registered with that id in the tenant.

**Details**

- `adapterId`: the adapter id that was looked up

**Example**

```json excerpt
{ "error": { "code": "adapter-not-found", "message": "…", "details": { "adapterId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/adapters/{adapterId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/adaptersget.md)

### `agent-not-found`

**Synopsis**

`404 Not Found`, code `agent-not-found`

The agent, or the agent version, doesn't exist in the project, or your key can't see it. Check the id and version; for a run, the agent version the run started with may have been removed.

**Details**

- `agentId`: the agent id
- `version`: the version asked for, when one was named

**Example**

```json excerpt
{ "error": { "code": "agent-not-found", "message": "…", "details": { "agentId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsderiveversion.md)

### `agent-version-not-found`

**Synopsis**

`404 Not Found`, code `agent-version-not-found`

The agent has no active version with that number: it was never registered or has since been unregistered. Pick a version from the agent's version list.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "agent-version-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/proposals`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalscreate.md)
- [`POST /v1/proposals/{proposalId}/rescore`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalsrescore.md)

### `approval-not-found`

**Synopsis**

`404 Not Found`, code `approval-not-found`

No approval with this id exists, or your role can't see it.

**Details**

- `approvalId`: the approval id

**Example**

```json excerpt
{ "error": { "code": "approval-not-found", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/approvals/{approvalId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/approvalsget.md)
- [`POST /v1/approvals/{approvalId}/complete`](https://docs.kindgi.com/v0.1.8/reference/api/operations/approvalscomplete.md)

### `audit-bundle-not-found`

**Synopsis**

`404 Not Found`, code `audit-bundle-not-found`

The API doesn't send this code. The audit bundle of an approval that doesn't exist is answered `approval-not-found`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "audit-bundle-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`approval-not-found`](https://docs.kindgi.com/v0.1.8/reference/errors.md#approval-not-found)
- [Decide an approval](https://docs.kindgi.com/v0.1.8/guides/approvals/decide-an-approval.md)

### `blob-not-found`

**Synopsis**

`404 Not Found`, code `blob-not-found`

No artifact with that id exists in the tenant, or it's in a project your key can't read.

**Details**

- `blobId`: the artifact id that was looked up

**Example**

```json excerpt
{ "error": { "code": "blob-not-found", "message": "…", "details": { "blobId": "…" }, "requestId": "…" } }
```

**See also**

- [`DELETE /v1/artifacts/{blobId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/artifactsdelete.md)

### `block-not-found`

**Synopsis**

`404 Not Found`, code `block-not-found`

No block exists with that id (or that version), or it's in a project your key can't read.

**Details**

- `blockId`: the block id
- `version`: the version looked up; present only when a version was requested

**Example**

```json excerpt
{ "error": { "code": "block-not-found", "message": "…", "details": { "blockId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/blocks/{blockId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blocksget.md)
- [`GET /v1/blocks/{blockId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blocksversionslist.md)
- [`GET /v1/blocks/{blockId}/versions/{version}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blocksversionsget.md)
- [`POST /v1/blocks/{blockId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blocksversionsunregister.md)
- [`POST /v1/blocks/{blockId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blocksversionsreinstate.md)

### `capability-not-found`

**Synopsis**

`404 Not Found`, code `capability-not-found`

No capability is registered with that id in the tenant.

**Details**

- `capabilityId`: the capability id that was looked up

**Example**

```json excerpt
{ "error": { "code": "capability-not-found", "message": "…", "details": { "capabilityId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/capabilities/{capabilityId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/capabilitiesget.md)

### `compliance-evidence-not-found`

**Synopsis**

`404 Not Found`, code `compliance-evidence-not-found`

No exportable compliance evidence record with that id exists under the tenant.

**Details**

- `evidenceId`: the evidence id that wasn't found

**Example**

```json excerpt
{ "error": { "code": "compliance-evidence-not-found", "message": "…", "details": { "evidenceId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/compliance/evidence/{evidenceId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/complianceevidenceget.md)

### `conversation-not-found`

**Synopsis**

`404 Not Found`, code `conversation-not-found`

The conversation doesn't exist in your tenant. Check the conversation id.

**Details**

- `conversationId`: the conversation id that wasn't found

**Example**

```json excerpt
{ "error": { "code": "conversation-not-found", "message": "…", "details": { "conversationId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/conversations/{conversationId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/conversationsget.md)

### `cost-record-not-found`

**Synopsis**

`404 Not Found`, code `cost-record-not-found`

No cost record exists with that id in the tenant.

**Details**

- `recordId`: the cost record id that was looked up

**Example**

```json excerpt
{ "error": { "code": "cost-record-not-found", "message": "…", "details": { "recordId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/cost/records/{recordId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/costrecordsget.md)

### `deployment-not-found`

**Synopsis**

`404 Not Found`, code `deployment-not-found`

No deployment with that id exists under the tenant.

**Details**

- `deploymentId`: the deployment id that wasn't found

**Example**

```json excerpt
{ "error": { "code": "deployment-not-found", "message": "…", "details": { "deploymentId": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [`DELETE /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentsclearendpoint.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint/problem`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentsrecordproblem.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetsuspended.md)
- [`GET /v1/deployments/{deploymentId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsget.md)
- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)

### `env-not-found`

**Synopsis**

`404 Not Found`, code `env-not-found`

The env entry named in the path doesn't exist in the scope and environment you asked for.

**Details**

- `name`: the env entry name that was not found

**Example**

```json excerpt
{ "error": { "code": "env-not-found", "message": "…", "details": { "name": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/env/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/envget.md)

### `eval-run-not-found`

**Synopsis**

`404 Not Found`, code `eval-run-not-found`

No eval run exists with that id in the tenant.

**Details**

- `runId`: the run id that was looked up

**Example**

```json excerpt
{ "error": { "code": "eval-run-not-found", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Compare a version on a test set](https://docs.kindgi.com/v0.1.8/guides/evals/compare-an-agent-version.md)

### `eval-suite-not-found`

**Synopsis**

`404 Not Found`, code `eval-suite-not-found`

No eval suite is registered with that id.

**Details**

- `suiteId`: the suite id that was looked up

**Example**

```json excerpt
{ "error": { "code": "eval-suite-not-found", "message": "…", "details": { "suiteId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/eval-suites/{suiteId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalsuitesget.md)

### `fact-not-found`

**Synopsis**

`404 Not Found`, code `fact-not-found`

The memory fact doesn't exist in your tenant. Check the fact id.

**Details**

- `factId`: the fact id

**Example**

```json excerpt
{ "error": { "code": "fact-not-found", "message": "…", "details": { "factId": "…" }, "requestId": "…" } }
```

**See also**

- [Memory reference](https://docs.kindgi.com/v0.1.8/guides/agents/memory-reference.md)

### `flow-not-found`

**Synopsis**

`404 Not Found`, code `flow-not-found`

The flow, or the flow version, isn't registered. Check the id and version; a run can't start on an unregistered flow version.

**Details**

- `flowId`: the flow id
- `version`: the version asked for, when one was named

**Example**

```json excerpt
{ "error": { "code": "flow-not-found", "message": "…", "details": { "flowId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/flows/{flowId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowsget.md)
- [`GET /v1/flows/{flowId}/versions/{version}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowsgetversion.md)

### `gate-policy-not-found`

**Synopsis**

`404 Not Found`, code `gate-policy-not-found`

No gate policy with that id exists, or it has no version with that number.

**Details**

- `policyId`: the policy id that was looked up

**Example**

```json excerpt
{ "error": { "code": "gate-policy-not-found", "message": "…", "details": { "policyId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/gate-policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/gatepoliciespublish.md)

### `guardrail-not-found`

**Synopsis**

`404 Not Found`, code `guardrail-not-found`

No guardrail with this id is registered. Check the id.

**Details**

- `guardrailId`: the guardrail id

**Example**

```json excerpt
{ "error": { "code": "guardrail-not-found", "message": "…", "details": { "guardrailId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/guardrails/{guardrailId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/guardrailsget.md)
- [`POST /v1/guardrails/{guardrailId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/guardrailsunregister.md)

### `identity-provider-not-found`

**Synopsis**

`404 Not Found`, code `identity-provider-not-found`

No identity provider with that id is registered for the tenant.

**Details**

- `providerId`: the provider id that wasn't found

**Example**

```json excerpt
{ "error": { "code": "identity-provider-not-found", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }
```

**See also**

- [Set up SSO](https://docs.kindgi.com/v0.1.8/guides/sso.md)

### `identity-user-not-found`

**Synopsis**

`404 Not Found`, code `identity-user-not-found`

No user with that id exists under this tenant (or the person named isn't a member of it).

**Details**

- `userId`: the user id that wasn't found

**Example**

```json excerpt
{ "error": { "code": "identity-user-not-found", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/identity/users/{userId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersunregister.md)
- [`GET /v1/identity/users/{userId}/grants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersgrants.md)
- [`POST /v1/identity/users/{userId}/grant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersgrant.md)
- [`POST /v1/identity/users/{userId}/ungrant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersungrant.md)
- [`POST /v1/teams/{teamId}/memberships`](https://docs.kindgi.com/v0.1.8/reference/api/operations/teamsmembershipsadd.md)
- [`POST /v1/projects/{projectId}/memberships`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsmembershipsadd.md)

### `improvement-pass-not-found`

**Synopsis**

`404 Not Found`, code `improvement-pass-not-found`

The improvement pass doesn't exist, or your key can't read its agent.

**Details**

- `passId`: the pass id that was looked up

**Example**

```json excerpt
{ "error": { "code": "improvement-pass-not-found", "message": "…", "details": { "passId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/improvement-passes/{passId}/cancel`](https://docs.kindgi.com/v0.1.8/reference/api/operations/improvementpassescancel.md)

### `judge-class-not-found`

**Synopsis**

`404 Not Found`, code `judge-class-not-found`

No live judge class exists with that id.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "judge-class-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/projects/{projectId}/judging-rules`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingrulescreate.md)
- [`PATCH /v1/projects/{projectId}/judging-rules/{ruleId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingrulesupdate.md)

### `judging-item-not-found`

**Synopsis**

`404 Not Found`, code `judging-item-not-found`

The run isn't in the project's judging queue.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "judging-item-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/projects/{projectId}/judging-queue/{runId}/dismiss`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingqueuedismiss.md)
- [`POST /v1/projects/{projectId}/judging-queue/{runId}/reopen`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingqueuereopen.md)

### `judging-rule-not-found`

**Synopsis**

`404 Not Found`, code `judging-rule-not-found`

The project has no judging rule with that id.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "judging-rule-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/projects/{projectId}/judging-rules/{ruleId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingrulesget.md)
- [`PATCH /v1/projects/{projectId}/judging-rules/{ruleId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingrulesupdate.md)
- [`POST /v1/projects/{projectId}/judging-rules/{ruleId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingrulesunregister.md)
- [`GET /v1/projects/{projectId}/judging-rules/{ruleId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingrulesversions.md)
- [`GET /v1/projects/{projectId}/judging-rules/{ruleId}/results`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingrulesresults.md)

### `judgment-not-found`

**Synopsis**

`404 Not Found`, code `judgment-not-found`

No judgment exists with that id, or it's in a project your key can't read. Unregistering also needs it to be live.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "judgment-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [Judge a run's output](https://docs.kindgi.com/v0.1.8/guides/evals/judge-a-runs-output.md)

### `mcp-endpoint-not-found`

**Synopsis**

`404 Not Found`, code `mcp-endpoint-not-found`

No MCP endpoint is registered with that id.

**Details**

- `endpointId`: the endpoint id that was looked up

**Example**

```json excerpt
{ "error": { "code": "mcp-endpoint-not-found", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/mcp/endpoints/{endpointId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsget.md)
- [`GET /v1/mcp/endpoints/{endpointId}/resources`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsresourceslist.md)

### `mcp-prompt-not-found`

**Synopsis**

`404 Not Found`, code `mcp-prompt-not-found`

The MCP endpoint is registered, but it has no prompt with the name you asked for.

**Details**

- `endpointId`: id of the MCP endpoint
- `promptName`: the prompt name that wasn't found

**Example**

```json excerpt
{ "error": { "code": "mcp-prompt-not-found", "message": "…", "details": { "endpointId": "…", "promptName": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/mcp/endpoints/{endpointId}/prompts/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointspromptsget.md)

### `mcp-resource-not-found`

**Synopsis**

`404 Not Found`, code `mcp-resource-not-found`

The MCP endpoint is registered, but it has no resource at the URI you asked for.

**Details**

- `endpointId`: id of the MCP endpoint
- `uri`: the resource URI that wasn't found

**Example**

```json excerpt
{ "error": { "code": "mcp-resource-not-found", "message": "…", "details": { "endpointId": "…", "uri": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/mcp/endpoints/{endpointId}/resources/{uri}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsresourcesread.md)

### `not-found`

**Synopsis**

`404 Not Found`, code `not-found`

The token, secret rotation or memory erasure you named doesn't exist for your tenant, or its id isn't valid. Check the id.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [Approvals reference](https://docs.kindgi.com/v0.1.8/guides/approvals/approvals-reference.md)
- [Start runs from your app](https://docs.kindgi.com/v0.1.8/start/call-from-your-app.md)

### `observation-not-found`

**Synopsis**

`404 Not Found`, code `observation-not-found`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "observation-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [Let a pass look for something better](https://docs.kindgi.com/v0.1.8/guides/evals/improve-an-agent.md)

### `org-not-found`

**Synopsis**

`404 Not Found`, code `org-not-found`

The org doesn't exist in the tenant: it never existed or was deleted. Also returned when creating or changing a project or team with an unknown `orgId`.

**Details**

- `orgId`: the org id that wasn't found

**Example**

```json excerpt
{ "error": { "code": "org-not-found", "message": "…", "details": { "orgId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/orgs/{orgId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/orgsget.md)

### `policy-not-found`

**Synopsis**

`404 Not Found`, code `policy-not-found`

No policy exists with that id (or that version) in the tenant.

**Details**

- `policyId`: the policy id

**Example**

```json excerpt
{ "error": { "code": "policy-not-found", "message": "…", "details": { "policyId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/policies/{policyId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiesget.md)
- [`GET /v1/policies/{policyId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiesversionslist.md)

### `principal-not-found`

**Synopsis**

`404 Not Found`, code `principal-not-found`

The person or service account the key is for doesn't exist in this tenant or has been unregistered, or the request names none. Name an existing one with `for`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "principal-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)

### `project-membership-not-found`

**Synopsis**

`404 Not Found`, code `project-membership-not-found`

The user isn't a member of the project.

**Details**

- `projectId`: the project
- `userId`: the user who isn't a member

**Example**

```json excerpt
{ "error": { "code": "project-membership-not-found", "message": "…", "details": { "projectId": "…", "userId": "…" }, "requestId": "…" } }
```

**See also**

- [`PATCH /v1/projects/{projectId}/memberships/{userId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsmembershipsupdaterole.md)

### `project-not-found`

**Synopsis**

`404 Not Found`, code `project-not-found`

The project doesn't exist in the tenant, or your key can't see it. For `GET /v1/projects/default`, the tenant has no Default project.

**Details**

- `projectId`: the project id that wasn't found; absent for the missing Default project

**Example**

```json excerpt
{ "error": { "code": "project-not-found", "message": "…", "details": { "projectId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [`PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetprojectsuspended.md)
- [`POST /v1/service-accounts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/serviceaccountscreate.md)
- [`POST /v1/service-accounts/{serviceAccountId}/grant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/serviceaccountsgrant.md)
- [`POST /v1/agents`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspublish.md)
- 18 more operations name it in their responses
- [Start a run](https://docs.kindgi.com/v0.1.8/guides/runs/start-a-run.md)

### `promotion-not-found`

**Synopsis**

`404 Not Found`, code `promotion-not-found`

No promotion with that id exists for this agent.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "promotion-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [Release an agent version](https://docs.kindgi.com/v0.1.8/guides/evals/release-an-agent-version.md)

### `proposal-not-found`

**Synopsis**

`404 Not Found`, code `proposal-not-found`

The improvement proposal doesn't exist in the tenant, or your key can't see its agent.

**Details**

- `proposalId`: the proposal id that was looked up

**Example**

```json excerpt
{ "error": { "code": "proposal-not-found", "message": "…", "details": { "proposalId": "…" }, "requestId": "…" } }
```

**See also**

- [Propose a change, and test it](https://docs.kindgi.com/v0.1.8/guides/evals/propose-a-change.md)

### `provenance-not-found`

**Synopsis**

`404 Not Found`, code `provenance-not-found`

No provenance record exists for the run id in the path, or the id isn't a valid run id.

**Details**

- `runId`: the run id that was looked up

**Example**

```json excerpt
{ "error": { "code": "provenance-not-found", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/provenance/{runId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/provenanceget.md)

### `provider-not-found`

**Synopsis**

`404 Not Found`, code `provider-not-found`

No model provider is registered with that id in the tenant.

**Details**

- `providerId`: the provider id that was looked up

**Example**

```json excerpt
{ "error": { "code": "provider-not-found", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/providers/{providerId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/providersget.md)
- [`GET /v1/providers/{providerId}/check`](https://docs.kindgi.com/v0.1.8/reference/api/operations/providerscheck.md)

### `reviewer-not-found`

**Synopsis**

`404 Not Found`, code `reviewer-not-found`

No reviewer is registered with this id.

**Details**

- `reviewerId`: the reviewer id

**Example**

```json excerpt
{ "error": { "code": "reviewer-not-found", "message": "…", "details": { "reviewerId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/approvals/reviewers/{reviewerId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/approvalsreviewersget.md)
- [`POST /v1/approvals/reviewers/{reviewerId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/approvalsreviewersunregister.md)

### `run-not-found`

**Synopsis**

`404 Not Found`, code `run-not-found`

The run doesn't exist in your tenant. Check the run id.

**Details**

- `runId`: the run id that wasn't found (only some routes)

**Example**

```json excerpt
{ "error": { "code": "run-not-found", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmintpublic.md)
- [`POST /v1/artifacts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/artifactsupload.md)
- [`POST /v1/judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/judgmentscreate.md)

### `secret-not-found`

**Synopsis**

`404 Not Found`, code `secret-not-found`

The secret doesn't exist in the scope and environment you named, or it was revoked. A deployment that references a missing secret gets the same answer.

**Details**

- `name`: the secret name that was not found

**Example**

```json excerpt
{ "error": { "code": "secret-not-found", "message": "…", "details": { "name": "…" }, "requestId": "…" } }
```

**See also**

- [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.1.8/deploy/secret-manager.md)

### `secret-revoked`

**Synopsis**

`404 Not Found`, code `secret-revoked`

The secret was revoked, so its value can't be read or rotated.

**Details**

- `name`: the revoked secret name (in binding results)

**Example**

```json excerpt
{ "error": { "code": "secret-revoked", "message": "…", "details": { "name": "…" }, "requestId": "…" } }
```

**See also**

- [Keep and purge deleted data](https://docs.kindgi.com/v0.1.8/deploy/retention.md)

### `secret-version-not-found`

**Synopsis**

`404 Not Found`, code `secret-version-not-found`

The secret exists but has no version with the number you asked for.

**Details**

- `name`: the secret name
- `versionId`: the version number that was not found

**Example**

```json excerpt
{ "error": { "code": "secret-version-not-found", "message": "…", "details": { "name": "…", "versionId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/secrets/{name}/versions/{versionId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsgetversion.md)

### `service-account-not-found`

**Synopsis**

`404 Not Found`, code `service-account-not-found`

No service account with that id exists in this tenant.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "service-account-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/service-accounts/{serviceAccountId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/serviceaccountsget.md)
- [`POST /v1/service-accounts/{serviceAccountId}/grant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/serviceaccountsgrant.md)
- [`POST /v1/service-accounts/{serviceAccountId}/ungrant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/serviceaccountsungrant.md)
- [`POST /v1/service-accounts/{serviceAccountId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/serviceaccountsunregister.md)

### `session-not-found`

**Synopsis**

`404 Not Found`, code `session-not-found`

`POST /v1/auth/refresh` was called with a session that has been revoked or no longer exists. Sign in again to get a new session.

**Details**

- `sessionId`: id of the session that no longer exists

**Example**

```json excerpt
{ "error": { "code": "session-not-found", "message": "…", "details": { "sessionId": "…" }, "requestId": "…" } }
```

**See also**

- [Sessions](https://docs.kindgi.com/v0.1.8/guides/sso/sessions.md)

### `signing-key-not-found`

**Synopsis**

`404 Not Found`, code `signing-key-not-found`

The signing key id doesn't exist among the tenant's trusted keys, or a signed export asked for a signing key the runtime doesn't sign with. Omit the key id to use the active key.

**Details**

- `signingKeyId`: the key id requested for signing; present only on export signing

**Example**

```json excerpt
{ "error": { "code": "signing-key-not-found", "message": "…", "details": { "signingKeyId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/signing-keys/{keyId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/signingkeysget.md)

### `signing-not-configured`

**Synopsis**

`404 Not Found`, code `signing-not-configured`

The runtime has no export signing key, so signed exports and the features that depend on them are unavailable.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "signing-not-configured", "message": "…", "requestId": "…" } }
```

**See also**

- [Export signed evidence](https://docs.kindgi.com/v0.1.8/guides/observability/export-signed-evidence.md)

### `system-key-not-found`

**Synopsis**

`404 Not Found`, code `system-key-not-found`

No system key has that id.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "system-key-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysrevoke.md)

### `team-grant-not-found`

**Synopsis**

`404 Not Found`, code `team-grant-not-found`

The team has no role on that project.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "team-grant-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [`PATCH /v1/projects/{projectId}/team-grants/{teamId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsteamgrantsupdaterole.md)

### `team-membership-not-found`

**Synopsis**

`404 Not Found`, code `team-membership-not-found`

The user isn't a member of the team.

**Details**

- `teamId`: the team
- `userId`: the user who isn't a member

**Example**

```json excerpt
{ "error": { "code": "team-membership-not-found", "message": "…", "details": { "teamId": "…", "userId": "…" }, "requestId": "…" } }
```

**See also**

- [`PATCH /v1/teams/{teamId}/memberships/{userId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/teamsmembershipsupdaterole.md)

### `team-not-found`

**Synopsis**

`404 Not Found`, code `team-not-found`

No team with that id exists under the tenant.

**Details**

- `teamId`: the team id that wasn't found

**Example**

```json excerpt
{ "error": { "code": "team-not-found", "message": "…", "details": { "teamId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/teams/{teamId}/memberships`](https://docs.kindgi.com/v0.1.8/reference/api/operations/teamsmembershipsadd.md)
- [`POST /v1/projects/{projectId}/team-grants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsteamgrantsadd.md)

### `tenant-config-not-found`

**Synopsis**

`404 Not Found`, code `tenant-config-not-found`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "tenant-config-not-found", "message": "…", "requestId": "…" } }
```

**See also**

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)

### `tenant-not-found`

**Synopsis**

`404 Not Found`, code `tenant-not-found`

The tenant your key belongs to doesn't exist.

**Details**

- `tenantId`: the tenant id that wasn't found

**Example**

```json excerpt
{ "error": { "code": "tenant-not-found", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantsget.md)
- [`POST /v1/system/tenants/{tenantId}/close`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantsclose.md)
- [`PUT /v1/system/tenants/{tenantId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetsuspended.md)
- [`PUT /v1/system/tenants/{tenantId}/image-prefix`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetimageprefix.md)
- [`PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetprojectsuspended.md)
- [`GET /v1/system/tenants/{tenantId}/admins`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantsadmins.md)
- 7 more operations name it in their responses
- [`GET /v1/tenant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantget.md)

### `tool-not-found`

**Synopsis**

`404 Not Found`, code `tool-not-found`

The tool, or the tool version, isn't registered in the project. Check the id and version.

**Details**

- `toolId`: the tool id
- `version`: the version asked for, when one was named

**Example**

```json excerpt
{ "error": { "code": "tool-not-found", "message": "…", "details": { "toolId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/tools/{toolId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsget.md)
- [`GET /v1/tools/{toolId}/versions/{version}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsgetversion.md)

### `trigger-not-found`

**Synopsis**

`404 Not Found`, code `trigger-not-found`

No trigger (schedule, webhook trigger or event trigger) with that id exists for your tenant, or the id belongs to a trigger of another kind.

**Details**

- `triggerId`: the trigger id that was not found

**Example**

```json excerpt
{ "error": { "code": "trigger-not-found", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/schedules/{triggerId}/owner`](https://docs.kindgi.com/v0.1.8/reference/api/operations/schedulestakeownership.md)

### `webhook-delivery-not-found`

**Synopsis**

`404 Not Found`, code `webhook-delivery-not-found`

The endpoint has no delivery with that id.

**Details**

- `deliveryId`: the delivery id that was not found

**Example**

```json excerpt
{ "error": { "code": "webhook-delivery-not-found", "message": "…", "details": { "deliveryId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/webhook-endpoints/{endpointId}/test`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointssendtest.md)

### `webhook-endpoint-not-found`

**Synopsis**

`404 Not Found`, code `webhook-endpoint-not-found`

No outbound webhook endpoint with that id exists in your tenant.

**Details**

- `endpointId`: the endpoint id that was not found

**Example**

```json excerpt
{ "error": { "code": "webhook-endpoint-not-found", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/webhook-endpoints/{endpointId}/test`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookendpointssendtest.md)

## 409 Conflict

### `agent-already-registered`

**Synopsis**

`409 Conflict`, code `agent-already-registered`

That agent id and version is already published, and versions never change. Publish under a new version; `details.nextFreeVersion` suggests the next free one.

**Details**

- `agentId`: the agent id
- `version`: the version already taken
- `nextFreeVersion`: the next unused version, when one can be worked out

**Example**

```json excerpt
{ "error": { "code": "agent-already-registered", "message": "…", "details": { "agentId": "…", "version": "…", "nextFreeVersion": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/agents`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspublish.md)

### `agent-project-mismatch`

**Synopsis**

`409 Conflict`, code `agent-project-mismatch`

The agent belongs to a different project than the one you named; an agent stays in the project its first version went to. Publish its versions there. The answer doesn't name that project.

**Details**

- `agentId`: the agent id (publish, derive)
- `primitive`: the kind of item (deployment only)
- `id`: the item's id and version (deployment only)

**Example**

```json excerpt
{ "error": { "code": "agent-project-mismatch", "message": "…", "details": { "agentId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/agents`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspublish.md)
- [`POST /v1/agents/{agentId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsderiveversion.md)
- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)
- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)
- [Organize work by org and project](https://docs.kindgi.com/v0.1.8/guides/projects/organize-by-org-and-project.md)

### `agent-version-live`

**Synopsis**

`409 Conflict`, code `agent-version-live`

The version is live in one or more scopes, so it can't be unregistered. Roll back, unpin or promote another version there first.

**Details**

- `agentId`: the agent
- `version`: the version
- `scopes`: the scopes where it is live

**Example**

```json excerpt
{ "error": { "code": "agent-version-live", "message": "…", "details": { "agentId": "…", "version": "…", "scopes": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsunregister.md)

### `agent-version-mismatch`

**Synopsis**

`409 Conflict`, code `agent-version-mismatch`

The conversation was opened with one agent version, but the turn or resume names another. Use the version the conversation started with.

**Details**

- `conversationId`: the conversation (new turn only)
- `expectedVersion`: the version the conversation or run is bound to
- `actualVersion`: the version the call used

**Example**

```json excerpt
{ "error": { "code": "agent-version-mismatch", "message": "…", "details": { "conversationId": "…", "expectedVersion": "…", "actualVersion": "…" }, "requestId": "…" } }
```

**See also**

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)

### `already-terminal`

**Synopsis**

`409 Conflict`, code `already-terminal`

The API doesn't send this code. Cancelling an eval run that has finished is answered `eval-run-already-terminal`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "already-terminal", "message": "…", "requestId": "…" } }
```

**See also**

- [`eval-run-already-terminal`](https://docs.kindgi.com/v0.1.8/reference/errors.md#eval-run-already-terminal)

### `approval-already-decided`

**Synopsis**

`409 Conflict`, code `approval-already-decided`

The approval already has a decision recorded; a second decision is refused.

**Details**

- `approvalId`: the approval

**Example**

```json excerpt
{ "error": { "code": "approval-already-decided", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } }
```

**See also**

- [Decide an approval](https://docs.kindgi.com/v0.1.8/guides/approvals/decide-an-approval.md)

### `approval-not-decided`

**Synopsis**

`409 Conflict`, code `approval-not-decided`

The approval is still pending, so a signed audit bundle can't be exported. Export it after a terminal decision.

**Details**

- `approvalId`: the approval
- `status`: its current status

**Example**

```json excerpt
{ "error": { "code": "approval-not-decided", "message": "…", "details": { "approvalId": "…", "status": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/approvals/{approvalId}/audit-bundle`](https://docs.kindgi.com/v0.1.8/reference/api/operations/approvalsauditbundle.md)

### `approval-terminal`

**Synopsis**

`409 Conflict`, code `approval-terminal`

The approval already ended (decided, expired or withdrawn), so it takes no more decisions.

**Details**

- `approvalId`: the approval
- `status`: its final status

**Example**

```json excerpt
{ "error": { "code": "approval-terminal", "message": "…", "details": { "approvalId": "…", "status": "…" }, "requestId": "…" } }
```

**See also**

- [Decide an approval](https://docs.kindgi.com/v0.1.8/guides/approvals/decide-an-approval.md)

### `block-already-registered`

**Synopsis**

`409 Conflict`, code `block-already-registered`

That block version is already published; versions never change, so publish a new version.

**Details**

- `blockId`: the block id
- `version`: the version that exists

**Example**

```json excerpt
{ "error": { "code": "block-already-registered", "message": "…", "details": { "blockId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/blocks`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blockspublish.md)

### `block-project-mismatch`

**Synopsis**

`409 Conflict`, code `block-project-mismatch`

The block belongs to another project. Publish its versions in the project that owns it.

**Details**

- `blockId`: the block id

**Example**

```json excerpt
{ "error": { "code": "block-project-mismatch", "message": "…", "details": { "blockId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/blocks`](https://docs.kindgi.com/v0.1.8/reference/api/operations/blockspublish.md)

### `conversation-closed`

**Synopsis**

`409 Conflict`, code `conversation-closed`

The conversation you're adding a turn to has been closed. Start a new conversation instead.

**Details**

- `conversationId`: the closed conversation
- `runId`: the run the failure belongs to, when one was started

**Example**

```json excerpt
{ "error": { "code": "conversation-closed", "message": "…", "details": { "conversationId": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Hold a conversation](https://docs.kindgi.com/v0.1.8/guides/agents/conversations.md)
- [Hold a conversation](https://docs.kindgi.com/v0.1.8/guides/agents/conversations.md)

### `duplicate-edge-id`

**Synopsis**

`409 Conflict`, code `duplicate-edge-id`

The API doesn't send this code. A flow definition that uses an edge id twice is answered `validation-failed`, with the problem in `details.issues`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "duplicate-edge-id", "message": "…", "requestId": "…" } }
```

**See also**

- [`validation-failed`](https://docs.kindgi.com/v0.1.8/reference/errors.md#validation-failed)
- [Write a flow](https://docs.kindgi.com/v0.1.8/guides/flows/write-a-flow.md)

### `duplicate-node-id`

**Synopsis**

`409 Conflict`, code `duplicate-node-id`

The API doesn't send this code. A flow definition that uses a node id twice is answered `validation-failed`, with the problem in `details.issues`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "duplicate-node-id", "message": "…", "requestId": "…" } }
```

**See also**

- [`validation-failed`](https://docs.kindgi.com/v0.1.8/reference/errors.md#validation-failed)
- [Write a flow](https://docs.kindgi.com/v0.1.8/guides/flows/write-a-flow.md)

### `endpoint-not-pending`

**Synopsis**

`409 Conflict`, code `endpoint-not-pending`

A problem was recorded for a deployment whose pack service isn't pending. A problem goes with `pending` only.

**Details**

- `status`: the deployment's endpoint status now: `ready` or `cleared`

**Example**

```json excerpt
{ "error": { "code": "endpoint-not-pending", "message": "…", "details": { "status": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint/problem`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentsrecordproblem.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint/problem`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentsrecordproblem.md)

### `env-write-conflict`

**Synopsis**

`409 Conflict`, code `env-write-conflict`

The env entry changed since the revision you based the write on. Read the entry again and retry with the current revision.

**Details**

- `currentRevision`: the revision stored now

**Example**

```json excerpt
{ "error": { "code": "env-write-conflict", "message": "…", "details": { "currentRevision": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/envput.md)

### `erasure-in-progress`

**Synopsis**

`409 Conflict`, code `erasure-in-progress`

An erasure of this person's data is running, so no new turn starts and no new fact is stored for them until it completes. Retry after the erasure finishes.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "erasure-in-progress", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`POST /v1/memory/facts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorywritefact.md)
- [Memory reference](https://docs.kindgi.com/v0.1.8/guides/agents/memory-reference.md)

### `eval-run-already-terminal`

**Synopsis**

`409 Conflict`, code `eval-run-already-terminal`

The eval run has already finished, failed or been cancelled, so it can't be cancelled.

**Details**

- `runId`: the eval run
- `status`: its final status

**Example**

```json excerpt
{ "error": { "code": "eval-run-already-terminal", "message": "…", "details": { "runId": "…", "status": "…" }, "requestId": "…" } }
```

**See also**

- [Compare a version on a test set](https://docs.kindgi.com/v0.1.8/guides/evals/compare-an-agent-version.md)

### `eval-run-not-rescorable`

**Synopsis**

`409 Conflict`, code `eval-run-not-rescorable`

Only a completed comparison of a test set can be rescored; this eval run is of another kind or hasn't completed.

**Details**

- `runId`: the run id

**Example**

```json excerpt
{ "error": { "code": "eval-run-not-rescorable", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/proposals/{proposalId}/rescore`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalsrescore.md)
- [`POST /v1/eval-runs/{runId}/rescore`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalrunsrescore.md)

### `eval-suite-already-registered`

**Synopsis**

`409 Conflict`, code `eval-suite-already-registered`

That eval suite id and version are already registered; versions never change, so publish a new version.

**Details**

- `suiteId`: the suite id
- `version`: the version that exists

**Example**

```json excerpt
{ "error": { "code": "eval-suite-already-registered", "message": "…", "details": { "suiteId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/eval-suites`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalsuitespublish.md)
- [`POST /v1/eval-suites/{suiteId}/versions/from-judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalsuitesbuildfromjudgments.md)

### `eval-suite-project-mismatch`

**Synopsis**

`409 Conflict`, code `eval-suite-project-mismatch`

The eval suite belongs to another project and suites never move. Publish or build its versions in the project that owns it.

**Details**

- `suiteId`: the suite id

**Example**

```json excerpt
{ "error": { "code": "eval-suite-project-mismatch", "message": "…", "details": { "suiteId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/eval-suites`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalsuitespublish.md)
- [`POST /v1/eval-suites/{suiteId}/versions/from-judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalsuitesbuildfromjudgments.md)
- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)
- [Organize work by org and project](https://docs.kindgi.com/v0.1.8/guides/projects/organize-by-org-and-project.md)

### `fact-changed`

**Synopsis**

`409 Conflict`, code `fact-changed`

The fact moved on since you read it: its current revision isn't the `expectVersion` you sent. Read it again, then retry with the new revision.

**Details**

- `factId`: the fact id
- `currentVersion`: the fact's current revision

**Example**

```json excerpt
{ "error": { "code": "fact-changed", "message": "…", "details": { "factId": "…", "currentVersion": "…" }, "requestId": "…" } }
```

**See also**

- [`DELETE /v1/memory/facts/{factId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorydeletefact.md)
- [`POST /v1/memory/facts/{factId}/supersede`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorysupersedefact.md)
- [`POST /v1/memory/facts/{factId}/verify`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memoryverifyfact.md)
- [Memory reference](https://docs.kindgi.com/v0.1.8/guides/agents/memory-reference.md)

### `flow-already-registered`

**Synopsis**

`409 Conflict`, code `flow-already-registered`

The flow id and version you're publishing already exist. Publish the change under a new version.

**Details**

- `flowId`: the flow's id
- `version`: the version that is already registered

**Example**

```json excerpt
{ "error": { "code": "flow-already-registered", "message": "…", "details": { "flowId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/flows`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowspublish.md)

### `flow-project-mismatch`

**Synopsis**

`409 Conflict`, code `flow-project-mismatch`

The flow id belongs to another project, because its first version was published there, and its versions can't be published from a different project.

**Details**

- `flowId`: the flow's id (single publish)
- `primitive`: on a deployment: the kind of item refused (`flow`)
- `id`: on a deployment: the refused item, as `id@version`

**Example**

```json excerpt
{ "error": { "code": "flow-project-mismatch", "message": "…", "details": { "flowId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/flows`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowspublish.md)
- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)

### `gate-policy-already-registered`

**Synopsis**

`409 Conflict`, code `gate-policy-already-registered`

The gate policy already has a version with that number. Publish with a new version number.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "gate-policy-already-registered", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/gate-policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/gatepoliciespublish.md)

### `gate-policy-descendant-unpinned`

**Synopsis**

`409 Conflict`, code `gate-policy-descendant-unpinned`

The change would also move a narrower scope that a gate policy applies to and that has no live version of its own, bypassing its gate. Pin that scope at its current version first.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "gate-policy-descendant-unpinned", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/promotions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspromotionscreate.md)
- [`POST /v1/agents/{agentId}/live/rollback`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsliverollback.md)
- [`POST /v1/agents/{agentId}/live/unpin`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsliveunpin.md)

### `gate-policy-needs-pin`

**Synopsis**

`409 Conflict`, code `gate-policy-needs-pin`

The scope has a gate policy, and a gated scope keeps its own live version, so it can't be unpinned. Unregister the gate policy first, or roll back instead.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "gate-policy-needs-pin", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/live/unpin`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsliveunpin.md)

### `gate-policy-scope-changed`

**Synopsis**

`409 Conflict`, code `gate-policy-scope-changed`

A new version of a gate policy can't change the agent or the scope the policy gates. Create a new policy for the other agent or scope.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "gate-policy-scope-changed", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/gate-policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/gatepoliciespublish.md)

### `gate-policy-scope-taken`

**Synopsis**

`409 Conflict`, code `gate-policy-scope-taken`

Another gate policy already gates this agent for the same scope. Publish a new version of that policy instead, or unregister it first.

**Details**

- `heldBy`: id of the policy that holds the scope

**Example**

```json excerpt
{ "error": { "code": "gate-policy-scope-taken", "message": "…", "details": { "heldBy": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/gate-policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/gatepoliciespublish.md)
- [`POST /v1/gate-policies/{policyId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/gatepoliciesversionsreinstate.md)

### `gate-policy-scope-unpinned`

**Synopsis**

`409 Conflict`, code `gate-policy-scope-unpinned`

The scope has no live version of its own, so the gate policy would not take effect. Pin a version for the scope first.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "gate-policy-scope-unpinned", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/gate-policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/gatepoliciespublish.md)
- [`POST /v1/gate-policies/{policyId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/gatepoliciesversionsreinstate.md)

### `guardrail-already-registered`

**Synopsis**

`409 Conflict`, code `guardrail-already-registered`

A guardrail with this id is already registered. On a deployment, the existing one has a different definition, so unregister it first and deploy again.

**Details**

- `guardrailId`: the guardrail's id (direct registration)
- `primitive`: on a deployment: the kind of item refused (`guardrail`)
- `id`: on a deployment: the guardrail id

**Example**

```json excerpt
{ "error": { "code": "guardrail-already-registered", "message": "…", "details": { "guardrailId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)
- [`POST /v1/guardrails`](https://docs.kindgi.com/v0.1.8/reference/api/operations/guardrailsregister.md)

### `guardrail-project-mismatch`

**Synopsis**

`409 Conflict`, code `guardrail-project-mismatch`

A guardrail id in your deployment is already in use in another project. A deployment never takes over a guardrail from another project.

**Details**

- `primitive`: the kind of item refused (`guardrail`)
- `id`: the guardrail id

**Example**

```json excerpt
{ "error": { "code": "guardrail-project-mismatch", "message": "…", "details": { "primitive": "…", "id": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)

### `hitl-required`

**Synopsis**

`409 Conflict`, code `hitl-required`

The API doesn't send this code. A conversation that reaches its review threshold parks the turn for an approval instead.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "hitl-required", "message": "…", "requestId": "…" } }
```

**See also**

- [Ask before a long conversation continues](https://docs.kindgi.com/v0.1.8/guides/approvals/ask-after-n-turns.md)

### `idempotency-key-body-mismatch`

**Synopsis**

`409 Conflict`, code `idempotency-key-body-mismatch`

You reused an Idempotency-Key with a different request body. Send the original body to get its answer back, or use a fresh key.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "idempotency-key-body-mismatch", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)
- [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmintpublic.md)
- [`POST /v1/auth/refresh`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authrefresh.md)

### `idempotency-key-in-flight`

**Synopsis**

`409 Conflict`, code `idempotency-key-in-flight`

A request with this Idempotency-Key is still running. Retry after the `Retry-After` header; you then get its answer.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "idempotency-key-in-flight", "message": "…", "requestId": "…" } }
```

**See also**

- [Runs, the journal and durability](https://docs.kindgi.com/v0.1.8/concepts/runs.md)
- [Retry a start safely](https://docs.kindgi.com/v0.1.8/guides/runs/retry-a-start-safely.md)

### `idempotency-key-replay-withheld`

**Synopsis**

`409 Conflict`, code `idempotency-key-replay-withheld`

The request with this Idempotency-Key already succeeded, but its answer held a secret that isn't kept, so it can't be replayed. Read what it created, or make a new one with a fresh key.

**Details**

- `status`: the HTTP status the first request answered with
- `at`: when it succeeded, as an ISO timestamp

**Example**

```json excerpt
{ "error": { "code": "idempotency-key-replay-withheld", "message": "…", "details": { "status": "…", "at": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)
- [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantscreate.md)
- [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmintpublic.md)
- [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authtokensignin.md)
- [`POST /v1/auth/refresh`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authrefresh.md)
- 1 more operations name it in their responses
- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)
- [Retry a start safely](https://docs.kindgi.com/v0.1.8/guides/runs/retry-a-start-safely.md)

### `identity-provider-already-registered`

**Synopsis**

`409 Conflict`, code `identity-provider-already-registered`

An identity provider with that id is already registered for the tenant. Use a different id, or change the existing provider with a patch.

**Details**

- `providerId`: the id that is already taken

**Example**

```json excerpt
{ "error": { "code": "identity-provider-already-registered", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }
```

**See also**

- [Set up SSO](https://docs.kindgi.com/v0.1.8/guides/sso.md)

### `identity-user-email-taken`

**Synopsis**

`409 Conflict`, code `identity-user-email-taken`

Another person in this tenant already has that email address.

**Details**

- `userId`: the existing person who has the email

**Example**

```json excerpt
{ "error": { "code": "identity-user-email-taken", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/identity/users`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityuserscreate.md)

### `identity-user-unregister-refused`

**Synopsis**

`409 Conflict`, code `identity-user-unregister-refused`

You can't unregister yourself or the seed user. Ask another tenant admin.

**Details**

- `reason`: why it was refused: 'yourself' or 'seed-user'
- `userId`: the person who was to be unregistered

**Example**

```json excerpt
{ "error": { "code": "identity-user-unregister-refused", "message": "…", "details": { "reason": "…", "userId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/identity/users/{userId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersunregister.md)
- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)

### `identity-user-unregistered`

**Synopsis**

`409 Conflict`, code `identity-user-unregistered`

The person was removed from the tenant, so they can't be granted anything.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "identity-user-unregistered", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/identity/users/{userId}/grant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersgrant.md)

### `image-not-allowed`

**Synopsis**

`409 Conflict`, code `image-not-allowed`

The deployment's image is outside the tenant's image repository: a tenant deploys only images at or under its image prefix.

**Details**

- `imagePrefix`: the tenant's image prefix; from `POST /v1/deployments` only

**Example**

```json excerpt
{ "error": { "code": "image-not-allowed", "message": "…", "details": { "imagePrefix": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)

### `image-prefix-taken`

**Synopsis**

`409 Conflict`, code `image-prefix-taken`

The image prefix equals, holds or sits inside another tenant's. Each tenant's repository is its own: choose a prefix that doesn't overlap another tenant's.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "image-prefix-taken", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantscreate.md)
- [`PUT /v1/system/tenants/{tenantId}/image-prefix`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetimageprefix.md)

### `image-prefix-unset`

**Synopsis**

`409 Conflict`, code `image-prefix-unset`

The tenant has no image repository set, so it can't register a deployment yet. Its operator sets one with `PUT /v1/system/tenants/{tenantId}/image-prefix`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "image-prefix-unset", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)

### `improvement-pass-finished`

**Synopsis**

`409 Conflict`, code `improvement-pass-finished`

The improvement pass has already ended, so there is nothing to cancel.

**Details**

- `passId`: the pass id
- `status`: the status the pass ended with

**Example**

```json excerpt
{ "error": { "code": "improvement-pass-finished", "message": "…", "details": { "passId": "…", "status": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/improvement-passes/{passId}/cancel`](https://docs.kindgi.com/v0.1.8/reference/api/operations/improvementpassescancel.md)

### `invalid-transition`

**Synopsis**

`409 Conflict`, code `invalid-transition`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "invalid-transition", "message": "…", "requestId": "…" } }
```

**See also**

- [Propose a change, and test it](https://docs.kindgi.com/v0.1.8/guides/evals/propose-a-change.md)

### `judge-class-name-taken`

**Synopsis**

`409 Conflict`, code `judge-class-name-taken`

A judge class with that name already exists in this scope. Pick another name.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "judge-class-name-taken", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/judge-classes`](https://docs.kindgi.com/v0.1.8/reference/api/operations/judgeclassescreate.md)

### `judging-item-not-open`

**Synopsis**

`409 Conflict`, code `judging-item-not-open`

The queue item isn't in the state this action needs: dismiss needs it open, and reopen needs it dismissed.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "judging-item-not-open", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/projects/{projectId}/judging-queue/{runId}/dismiss`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingqueuedismiss.md)
- [`POST /v1/projects/{projectId}/judging-queue/{runId}/reopen`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsjudgingqueuereopen.md)

### `last-tenant-admin`

**Synopsis**

`409 Conflict`, code `last-tenant-admin`

This person is the only tenant admin, so they can't be unregistered or lose the admin grant. Make someone else a tenant admin first.

**Details**

- `reason`: on unregister: 'last-tenant-admin'
- `userId`: on unregister: the person

**Example**

```json excerpt
{ "error": { "code": "last-tenant-admin", "message": "…", "details": { "reason": "…", "userId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/identity/users/{userId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersunregister.md)
- [`POST /v1/identity/users/{userId}/ungrant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersungrant.md)
- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)

### `legal-hold`

**Synopsis**

`409 Conflict`, code `legal-hold`

The fact is under legal hold, so it can't be deleted or superseded; or a memory erasure would reach facts under hold, and nothing is erased. Lift the hold first.

**Details**

- `factId`: the fact under hold (delete or supersede)
- `factIds`: the facts under hold (starting an erasure)

**Example**

```json excerpt
{ "error": { "code": "legal-hold", "message": "…", "details": { "factId": "…", "factIds": "…" }, "requestId": "…" } }
```

**See also**

- [`DELETE /v1/memory/facts/{factId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorydeletefact.md)
- [`POST /v1/memory/facts/{factId}/supersede`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorysupersedefact.md)
- [`POST /v1/memory/facts/{factId}/verify`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memoryverifyfact.md)
- [`POST /v1/memory/erasures`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorycreateerasure.md)
- [Memory reference](https://docs.kindgi.com/v0.1.8/guides/agents/memory-reference.md)

### `mcp-endpoint-already-registered`

**Synopsis**

`409 Conflict`, code `mcp-endpoint-already-registered`

An MCP endpoint with that id is already registered. Use another id or unregister the existing one.

**Details**

- `endpointId`: the endpoint id

**Example**

```json excerpt
{ "error": { "code": "mcp-endpoint-already-registered", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsregister.md)

### `membership-exists`

**Synopsis**

`409 Conflict`, code `membership-exists`

The user is already a member with another role. Their existing role is kept; change it with a role update instead.

**Details**

- `role`: the role they already hold

**Example**

```json excerpt
{ "error": { "code": "membership-exists", "message": "…", "details": { "role": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/teams/{teamId}/memberships`](https://docs.kindgi.com/v0.1.8/reference/api/operations/teamsmembershipsadd.md)
- [`POST /v1/projects/{projectId}/memberships`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsmembershipsadd.md)

### `not-pinned`

**Synopsis**

`409 Conflict`, code `not-pinned`

The scope has no live version of its own, so there's nothing to roll back or unpin. Pin a version for the scope first.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "not-pinned", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/live/rollback`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsliverollback.md)
- [`POST /v1/agents/{agentId}/live/unpin`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsliveunpin.md)

### `nothing-to-roll-back`

**Synopsis**

`409 Conflict`, code `nothing-to-roll-back`

The scope's live version has no earlier version to go back to. Unpin the scope to fall back to the scope above, or name a version to roll back to.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "nothing-to-roll-back", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/live/rollback`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsliverollback.md)

### `pack-suspended`

**Synopsis**

`409 Conflict`, code `pack-suspended`

The operator suspended this deployment's pack, so its pack service can't be set. Lift the suspension first.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "pack-suspended", "message": "…", "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetsuspended.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)

### `policy-already-registered`

**Synopsis**

`409 Conflict`, code `policy-already-registered`

That policy id and version are already registered; policy versions never change, so publish a new version.

**Details**

- `policyId`: the policy id
- `version`: the version that exists

**Example**

```json excerpt
{ "error": { "code": "policy-already-registered", "message": "…", "details": { "policyId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiespublish.md)

### `policy-scope-changed`

**Synopsis**

`409 Conflict`, code `policy-scope-changed`

The policy version would move the policy to another scope, but a policy keeps one scope across versions. Publish it under a new id.

**Details**

- `policyId`: the policy id
- `version`: the version
- `policyKind`: the policy kind
- `scope`: the scope the version covers
- `previousScope`: the scope the policy already holds

**Example**

```json excerpt
{ "error": { "code": "policy-scope-changed", "message": "…", "details": { "policyId": "…", "version": "…", "policyKind": "…", "scope": "…", "previousScope": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiespublish.md)
- [`POST /v1/policies/{policyId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiesreinstateversion.md)

### `policy-scope-taken`

**Synopsis**

`409 Conflict`, code `policy-scope-taken`

Another policy already holds the scope this one would cover, for example the retention domain. Publish a new version of that policy, or unregister it first.

**Details**

- `policyId`: the policy being published or reinstated
- `version`: its version
- `policyKind`: the policy kind
- `scope`: the scope requested
- `heldBy`: the policy that holds the scope

**Example**

```json excerpt
{ "error": { "code": "policy-scope-taken", "message": "…", "details": { "policyId": "…", "version": "…", "policyKind": "…", "scope": "…", "heldBy": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/policies`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiespublish.md)
- [`POST /v1/policies/{policyId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiesreinstateversion.md)

### `project-default-already-exists`

**Synopsis**

`409 Conflict`, code `project-default-already-exists`

The tenant already has a Default project, so a second one can't be created.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "project-default-already-exists", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/projects`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectscreate.md)

### `project-suspended`

**Synopsis**

`409 Conflict`, code `project-suspended`

The project is suspended, so nothing new starts in it until it's restored: a deploy into it (the named project, or the Default for a tenant-wide deploy), a run or a turn started in it, or the operator setting the pack service of one of its deployments. What's already deployed stays. A delivery to one of its webhook triggers isn't refused: one that proves its sender is answered `202` with `skipped: project-suspended`, and nothing is recorded or kept for it. A schedule's fire on it starts no run or pass: it's recorded `skipped`, with `project-suspended` in its `detail`, and doesn't count toward the schedule's auto-pause, so the schedule stays on and fires again once the project is restored. A webhook delivery taken before the suspension whose run hadn't started is recorded `skipped` the same way, and its event is dropped. Ask the operator to restore the project.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "project-suspended", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)
- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)

### `promotion-superseded`

**Synopsis**

`409 Conflict`, code `promotion-superseded`

The scope's live version changed while the gate was running, so the check no longer applies. Check the promotion again against the new live version.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "promotion-superseded", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/promotions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspromotionscreate.md)

### `proposal-invalid-state-transition`

**Synopsis**

`409 Conflict`, code `proposal-invalid-state-transition`

The proposal's status doesn't allow this action, or it changed while the request ran. Read the proposal again and retry if it still applies.

**Details**

- `proposalId`: the proposal id
- `status`: the proposal status that refused the action; absent when it changed mid-request

**Example**

```json excerpt
{ "error": { "code": "proposal-invalid-state-transition", "message": "…", "details": { "proposalId": "…", "status": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/proposals/{proposalId}/evaluate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalsevaluate.md)
- [`POST /v1/proposals/{proposalId}/rescore`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalsrescore.md)

### `proposal-needs-pin`

**Synopsis**

`409 Conflict`, code `proposal-needs-pin`

The agent has no live version for the whole tenant, so a new version would serve every scope nothing is pinned for. Promote its current version tenant-wide, then retry.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "proposal-needs-pin", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/proposals/{proposalId}/evaluate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalsevaluate.md)
- [Let a pass look for something better](https://docs.kindgi.com/v0.1.8/guides/evals/improve-an-agent.md)

### `provider-already-registered`

**Synopsis**

`409 Conflict`, code `provider-already-registered`

A provider with that id is already registered in the tenant.

**Details**

- `providerId`: the provider id that is taken

**Example**

```json excerpt
{ "error": { "code": "provider-already-registered", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/providers`](https://docs.kindgi.com/v0.1.8/reference/api/operations/providersregister.md)

### `provider-key-in-use`

**Synopsis**

`409 Conflict`, code `provider-key-in-use`

The `secret_ref` of the provider being registered names a secret already used by a tool, MCP endpoint, webhook endpoint or webhook trigger. Give each a key of its own.

**Details**

- `secret`: name of the secret
- `usedBy`: list of the things using it, each with kind and id

**Example**

```json excerpt
{ "error": { "code": "provider-key-in-use", "message": "…", "details": { "secret": "…", "usedBy": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/providers`](https://docs.kindgi.com/v0.1.8/reference/api/operations/providersregister.md)
- [Models](https://docs.kindgi.com/v0.1.8/guides/models.md)

### `registry-read-only`

**Synopsis**

`409 Conflict`, code `registry-read-only`

This registry takes no writes, for example when a local dev server serves the project's own files. The message says what to do instead.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "registry-read-only", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/agents`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspublish.md)
- [`POST /v1/agents/{agentId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsderiveversion.md)
- [`POST /v1/agents/{agentId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsunregister.md)
- [`POST /v1/agents/{agentId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsreinstateversion.md)
- [`POST /v1/flows`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowspublish.md)
- [`POST /v1/flows/{flowId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowsunregister.md)
- 8 more operations name it in their responses
- [Let a pass look for something better](https://docs.kindgi.com/v0.1.8/guides/evals/improve-an-agent.md)
- [Propose a change, and test it](https://docs.kindgi.com/v0.1.8/guides/evals/propose-a-change.md)

### `reviewer-deactivated`

**Synopsis**

`409 Conflict`, code `reviewer-deactivated`

The reviewer was deactivated, so it can't decide approvals. Ask an admin to reactivate or use another reviewer.

**Details**

- `reviewerId`: the reviewer id

**Example**

```json excerpt
{ "error": { "code": "reviewer-deactivated", "message": "…", "details": { "reviewerId": "…" }, "requestId": "…" } }
```

**See also**

- [Decide an approval](https://docs.kindgi.com/v0.1.8/guides/approvals/decide-an-approval.md)

### `run-already-terminal`

**Synopsis**

`409 Conflict`, code `run-already-terminal`

The run has already finished (completed, failed or cancelled), so it can't be cancelled, resumed or given a decision. Start a new run if you need another.

**Details**

- `runId`: the run
- `status`: the state it ended in

**Example**

```json excerpt
{ "error": { "code": "run-already-terminal", "message": "…", "details": { "runId": "…", "status": "…" }, "requestId": "…" } }
```

**See also**

- [Cancel a run](https://docs.kindgi.com/v0.1.8/guides/runs/cancel-a-run.md)

### `run-lease-lost`

**Synopsis**

`409 Conflict`, code `run-lease-lost`

Another executor holds or has taken over the run, so this attempt can't go on. Retry later; the run continues in the executor that holds it.

**Details**

- `runId`: the run

**Example**

```json excerpt
{ "error": { "code": "run-lease-lost", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)

### `run-not-finished`

**Synopsis**

`409 Conflict`, code `run-not-finished`

The run hasn't completed with an output, so there's nothing to judge. Wait until it completes.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "run-not-finished", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/judgmentscreate.md)

### `secret-write-conflict`

**Synopsis**

`409 Conflict`, code `secret-write-conflict`

The secret write collides with what is stored: you used `create-new` for a name that already exists, or the version you based a write on is no longer current.

**Details**

- `currentVersion`: the version stored now (present when the secret already exists)

**Example**

```json excerpt
{ "error": { "code": "secret-write-conflict", "message": "…", "details": { "currentVersion": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/webhooks`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhooksregister.md)
- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)
- [Start runs from WooCommerce, Drupal or any signed webhook](https://docs.kindgi.com/v0.1.8/guides/webhooks/start-runs-from-webhooks.md)

### `seed-user-admin`

**Synopsis**

`409 Conflict`, code `seed-user-admin`

The person is the seed user, whom the runtime makes tenant admin at every start, so the admin grant can't be removed while that setting stands. Unset the seed user and restart first.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "seed-user-admin", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/identity/users/{userId}/ungrant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersungrant.md)

### `service-account-name-taken`

**Synopsis**

`409 Conflict`, code `service-account-name-taken`

An active service account in this tenant already has that name. Choose another name.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "service-account-name-taken", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/service-accounts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/serviceaccountscreate.md)

### `service-account-unregistered`

**Synopsis**

`409 Conflict`, code `service-account-unregistered`

The service account has been unregistered, so it can't be granted anything.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "service-account-unregistered", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/service-accounts/{serviceAccountId}/grant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/serviceaccountsgrant.md)
- [People, API keys and service accounts](https://docs.kindgi.com/v0.1.8/deploy/people-and-keys.md)
- [Keep and purge deleted data](https://docs.kindgi.com/v0.1.8/deploy/retention.md)

### `session-revoked`

**Synopsis**

`409 Conflict`, code `session-revoked`

The API doesn't send this code. A revoked session is answered `auth-revoked`, or `session-not-found` by `POST /v1/auth/refresh`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "session-revoked", "message": "…", "requestId": "…" } }
```

**See also**

- [`auth-revoked`](https://docs.kindgi.com/v0.1.8/reference/errors.md#auth-revoked)
- [Sessions](https://docs.kindgi.com/v0.1.8/guides/sso/sessions.md)

### `signing-key-conflict`

**Synopsis**

`409 Conflict`, code `signing-key-conflict`

The key id is already trusted with a different public key. Trust the new key under a new key id.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "signing-key-conflict", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/signing-keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/signingkeystrust.md)

### `signing-key-revoked`

**Synopsis**

`409 Conflict`, code `signing-key-revoked`

The key id was revoked and revocation is final, so it can't be trusted again. Trust the key under a new key id.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "signing-key-revoked", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/signing-keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/signingkeystrust.md)

### `slug-conflict`

**Synopsis**

`409 Conflict`, code `slug-conflict`

The slug is taken: another org, team or project in the tenant already has it, or a project in the same org. Choose another slug.

**Details**

- `resource`: kind of thing that conflicts: `org`, `team` or `project`
- `slug`: the taken slug; on org delete, `slugs` lists them instead

**Example**

```json excerpt
{ "error": { "code": "slug-conflict", "message": "…", "details": { "resource": "…", "slug": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/orgs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/orgscreate.md)

### `team-grant-exists`

**Synopsis**

`409 Conflict`, code `team-grant-exists`

The team already holds another role on the project. Change the role instead of adding it again.

**Details**

- `role`: the role the team already holds

**Example**

```json excerpt
{ "error": { "code": "team-grant-exists", "message": "…", "details": { "role": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/projects/{projectId}/team-grants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsteamgrantsadd.md)

### `tenant-closing`

**Synopsis**

`409 Conflict`, code `tenant-closing`

The tenant is closing. Its own keys and sessions can read and export it until it's deleted, but not change it: deletes, revocations, erasures, signing in and out, and the signed exports still work. A delivery to one of its webhook triggers that proves its sender is refused the same way, and nothing is recorded for it. A schedule's or webhook trigger's fire whose run starts as the tenant starts closing is recorded `skipped`, with `tenant-closing` in its `detail`, and doesn't count toward a schedule's auto-pause. The system routes that change its settings, limits, image prefix, a suspension or a deployment's endpoint refuse a closing tenant; clearing its deployments' endpoints, which retires its pack services, still works. On the S3-compatible surface, the same refusal is S3's `403 AllAccessDisabled`.

**Details**

- `state`: `closing`
- `tenantId`: the tenant; from a system route only

**Example**

```json excerpt
{ "error": { "code": "tenant-closing", "message": "…", "details": { "state": "…", "tenantId": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetsuspended.md)
- [`PUT /v1/system/tenants/{tenantId}/image-prefix`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetimageprefix.md)
- [`PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetprojectsuspended.md)
- [`PUT /v1/system/tenants/{tenantId}/production-allowed`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetproductionallowed.md)
- [`PUT /v1/system/tenants/{tenantId}/limits`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetlimits.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- 2 more operations name it in their responses

### `tenant-config-revision-conflict`

**Synopsis**

`409 Conflict`, code `tenant-config-revision-conflict`

The tenant config entry changed since the revision you sent in `ifRevision`, so the write is refused. Read the entry again and retry with its current revision.

**Details**

- `currentRevision`: the revision stored now

**Example**

```json excerpt
{ "error": { "code": "tenant-config-revision-conflict", "message": "…", "details": { "currentRevision": "…" }, "requestId": "…" } }
```

**See also**

- [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantconfigupsert.md)

### `tenant-slug-taken`

**Synopsis**

`409 Conflict`, code `tenant-slug-taken`

Another tenant has that slug. Choose another.

**Details**

- `slug`: the slug that is taken

**Example**

```json excerpt
{ "error": { "code": "tenant-slug-taken", "message": "…", "details": { "slug": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantscreate.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)

### `tenant-suspended`

**Synopsis**

`409 Conflict`, code `tenant-suspended`

The tenant is suspended. Its own keys and sessions can read and export it, but not change it until it's restored: deletes, revocations, erasures, signing in and out, and the signed exports still work. A delivery to one of its webhook triggers isn't refused: one that proves its sender is answered `202` with `skipped: tenant-suspended`, and nothing is recorded or kept for it. A sender that can redeliver by hand can resend it once the tenant is restored, and a restore is seen within 5 seconds. Its schedules don't fire while it's suspended, and nothing is caught up: at the restore, a schedule's or webhook trigger's fire whose run or pass hadn't started is recorded `skipped`, with `tenant-suspended` in its `detail`, and a schedule that's on fires next at its first occurrence after the restore, whatever its `catchUp`. A fire whose run was starting as the tenant was suspended is recorded `skipped` right away, with `tenant-suspended` in its `detail`. None of it counts toward a schedule's auto-pause. Setting a deployment's endpoint (`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`) refuses a suspended tenant too. On the S3-compatible surface, the same refusal is S3's `403 AllAccessDisabled`.

**Details**

- `state`: `suspended`
- `tenantId`: the tenant; from a system route only

**Example**

```json excerpt
{ "error": { "code": "tenant-suspended", "message": "…", "details": { "state": "…", "tenantId": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)

### `tool-already-registered`

**Synopsis**

`409 Conflict`, code `tool-already-registered`

The tool id and version you're publishing already exist. Published versions are immutable, so publish under a new version number.

**Details**

- `toolId`: the tool's id
- `version`: the version that is already registered

**Example**

```json excerpt
{ "error": { "code": "tool-already-registered", "message": "…", "details": { "toolId": "…", "version": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tools`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsregister.md)

### `tool-project-mismatch`

**Synopsis**

`409 Conflict`, code `tool-project-mismatch`

The tool id belongs to another project, because its first version was published there, and versions can't be published from a different project.

**Details**

- `toolId`: the tool's id (single publish)
- `primitive`: on a deployment: the kind of item refused (`tool`)
- `id`: on a deployment: the refused item, as `id@version`

**Example**

```json excerpt
{ "error": { "code": "tool-project-mismatch", "message": "…", "details": { "toolId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/tools`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsregister.md)
- [`POST /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentsregister.md)

### `trigger-already-in-state`

**Synopsis**

`409 Conflict`, code `trigger-already-in-state`

The trigger is already in the state you asked for, such as pausing a paused trigger or resuming one that is running.

**Details**

- `triggerId`: the trigger id

**Example**

```json excerpt
{ "error": { "code": "trigger-already-in-state", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }
```

**See also**

- [Run on a schedule](https://docs.kindgi.com/v0.1.8/guides/runs/run-on-a-schedule.md)

### `trigger-webhook-id-conflict`

**Synopsis**

`409 Conflict`, code `trigger-webhook-id-conflict`

A webhook trigger with that `webhookId` is already registered for your tenant. Pick another id.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "trigger-webhook-id-conflict", "message": "…", "requestId": "…" } }
```

**See also**

- [Start runs from WooCommerce, Drupal or any signed webhook](https://docs.kindgi.com/v0.1.8/guides/webhooks/start-runs-from-webhooks.md)

### `version-already-exists`

**Synopsis**

`409 Conflict`, code `version-already-exists`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "version-already-exists", "message": "…", "requestId": "…" } }
```

**See also**

- [Propose a change, and test it](https://docs.kindgi.com/v0.1.8/guides/evals/propose-a-change.md)

### `waitpoint-error`

**Synopsis**

`409 Conflict`, code `waitpoint-error`

The wait token the approval or cancel targets isn't pending any more: no pending token, or it was already resolved or cancelled.

**Details**

- `tokenId`: the wait token

**Example**

```json excerpt
{ "error": { "code": "waitpoint-error", "message": "…", "details": { "tokenId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/approvals/{approvalId}/complete`](https://docs.kindgi.com/v0.1.8/reference/api/operations/approvalscomplete.md)

## 410 Gone

### `agent-gone`

**Synopsis**

`410 Gone`, code `agent-gone`

The agent has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one.

**Details**

- `agentId`: the agent id

**Example**

```json excerpt
{ "error": { "code": "agent-gone", "message": "…", "details": { "agentId": "…" }, "requestId": "…" } }
```

**See also**

- [Agent and tool versions](https://docs.kindgi.com/v0.1.8/guides/agents/agent-and-tool-versions.md)

### `eval-suite-gone`

**Synopsis**

`410 Gone`, code `eval-suite-gone`

The eval suite has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one.

**Details**

- `suiteId`: the suite id

**Example**

```json excerpt
{ "error": { "code": "eval-suite-gone", "message": "…", "details": { "suiteId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/eval-suites/{suiteId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalsuitesget.md)

### `flow-gone`

**Synopsis**

`410 Gone`, code `flow-gone`

The flow has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one.

**Details**

- `flowId`: the flow id

**Example**

```json excerpt
{ "error": { "code": "flow-gone", "message": "…", "details": { "flowId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/flows/{flowId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowsget.md)

### `policy-gone`

**Synopsis**

`410 Gone`, code `policy-gone`

The policy has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one.

**Details**

- `policyId`: the policy id

**Example**

```json excerpt
{ "error": { "code": "policy-gone", "message": "…", "details": { "policyId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/policies/{policyId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/policiesget.md)

### `run-erased`

**Synopsis**

`410 Gone`, code `run-erased`

An erasure cleared the run's content (a person's words were removed), so there is nothing to judge or replay.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "run-erased", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/judgmentscreate.md)

### `tool-gone`

**Synopsis**

`410 Gone`, code `tool-gone`

The tool existed but has no active version left, so it can't be read or run. Reinstate a retired version or publish a new one.

**Details**

- `toolId`: the tool's id

**Example**

```json excerpt
{ "error": { "code": "tool-gone", "message": "…", "details": { "toolId": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/tools/{toolId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsget.md)

### `webhook-gone`

**Synopsis**

`410 Gone`, code `webhook-gone`

The webhook trigger the request is addressed to was unregistered. Only a sender that signs correctly learns this.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "webhook-gone", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/hooksreceive.md)

## 413 Content Too Large

### `artifact-too-large`

**Synopsis**

`413 Content Too Large`, code `artifact-too-large`

The uploaded artifact is larger than the upload cap. Upload a smaller file.

**Details**

- `maxBytes`: the largest accepted size, in bytes

**Example**

```json excerpt
{ "error": { "code": "artifact-too-large", "message": "…", "details": { "maxBytes": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/artifacts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/artifactsupload.md)

### `request-too-large`

**Synopsis**

`413 Content Too Large`, code `request-too-large`

The request body is larger than the API's limit. Send a smaller body. An artifact upload and a webhook delivery have limits of their own (`artifact-too-large`, `webhook-body-too-large`).

**Details**

- `maxBytes`: the largest accepted body, in bytes

**Example**

```json excerpt
{ "error": { "code": "request-too-large", "message": "…", "details": { "maxBytes": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsresume.md)
- [`POST /v1/signing-keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/signingkeystrust.md)
- [`POST /v1/signing-keys/{keyId}/revoke`](https://docs.kindgi.com/v0.1.8/reference/api/operations/signingkeysrevoke.md)
- [`POST /v1/tokens`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmint.md)
- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)
- 91 more operations name it in their responses

### `webhook-body-too-large`

**Synopsis**

`413 Content Too Large`, code `webhook-body-too-large`

The request body is larger than the receiver takes: the receiver's overall cap, or the trigger's own `bodyLimitBytes`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "webhook-body-too-large", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/hooksreceive.md)

## 422 Unprocessable Content

### `agent-turn-aborted`

**Synopsis**

`422 Unprocessable Content`, code `agent-turn-aborted`

The agent's turn was cancelled or timed out before it finished.

**Details**

- `reason`: `external` when cancelled by a caller, `timeout` when it ran out of time
- `runId`: the run that was aborted

**Example**

```json excerpt
{ "error": { "code": "agent-turn-aborted", "message": "…", "details": { "reason": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Set an agent's budget](https://docs.kindgi.com/v0.1.8/guides/agents/budgets.md)

### `budget-exceeded`

**Synopsis**

`422 Unprocessable Content`, code `budget-exceeded`

The agent's turn went over its budget: the cost cap, or the step cap while the model still wanted another tool call. Raise the budget or simplify the task.

**Details**

- `kind`: which budget: `steps` or `cost` (the type also allows `wall-time`)
- `limit`: the agent's cap
- `observed`: the value reached
- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "budget-exceeded", "message": "…", "details": { "kind": "…", "limit": "…", "observed": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)
- [See why runs failed](https://docs.kindgi.com/v0.1.8/guides/runs/see-why-runs-failed.md)
- [Start a run](https://docs.kindgi.com/v0.1.8/guides/runs/start-a-run.md)

### `capability-routing-failed`

**Synopsis**

`422 Unprocessable Content`, code `capability-routing-failed`

No model provider could take the agent's call: the agent declares no capabilities, or no provider meets them under your policy, or the pinned route is no longer allowed, or a provider registered for the tenant can't be set up on this runtime (the message says why; `GET /v1/providers/{providerId}/check` gives the adapter's words).

**Details**

- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "capability-routing-failed", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }
```

**See also**

- [See why runs failed](https://docs.kindgi.com/v0.1.8/guides/runs/see-why-runs-failed.md)

### `capability-unsatisfiable`

**Synopsis**

`422 Unprocessable Content`, code `capability-unsatisfiable`

No registered model provider meets what the agent's capabilities ask for, after your organization's model policy is applied. It appears as the cause of capability-routing-failed.

**Details**

- `reasons`: per provider, why it was rejected (inside `cause`)
- `tenantId`: the tenant whose policy applied, when one did (inside `cause`)

**Example**

```json excerpt
{ "error": { "code": "capability-unsatisfiable", "message": "…", "details": { "reasons": "…", "tenantId": "…" }, "requestId": "…" } }
```

**See also**

- [`capability-routing-failed`](https://docs.kindgi.com/v0.1.8/reference/errors.md#capability-routing-failed)
- [Choose the model an agent uses](https://docs.kindgi.com/v0.1.8/guides/agents/choose-a-model.md)

### `dispatcher-not-registered`

**Synopsis**

`422 Unprocessable Content`, code `dispatcher-not-registered`

The runtime has no eval-run dispatcher for the suite's kind, so it can't start a run of that suite.

**Details**

- `evalKind`: the suite kind with no dispatcher

**Example**

```json excerpt
{ "error": { "code": "dispatcher-not-registered", "message": "…", "details": { "evalKind": "…" }, "requestId": "…" } }
```

**See also**

- [Compare a version on a test set](https://docs.kindgi.com/v0.1.8/guides/evals/compare-an-agent-version.md)

### `endpoint-host-not-allowed`

**Synopsis**

`422 Unprocessable Content`, code `endpoint-host-not-allowed`

The pack service's host isn't on the operator's allowlist of pack hosts (`KINDGI_PACK_ENDPOINT_HOSTS`). Use a host the allowlist covers. The refusal is recorded as the deployment's `endpoint.problem`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "endpoint-host-not-allowed", "message": "…", "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)

### `endpoint-info-mismatch`

**Synopsis**

`422 Unprocessable Content`, code `endpoint-info-mismatch`

The pack service answered `GET /v1/info` as another pack or version, so it doesn't serve this deployment's image. The refusal is recorded as the deployment's `endpoint.problem`.

**Details**

- `differs`: the names of the `/v1/info` fields that differed from the deployment's, never their values

**Example**

```json excerpt
{ "error": { "code": "endpoint-info-mismatch", "message": "…", "details": { "differs": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)

### `endpoint-name-mismatch`

**Synopsis**

`422 Unprocessable Content`, code `endpoint-name-mismatch`

The pack service's host doesn't name this deployment's own service. Each deployment's pack service runs under its own name, `packServiceName` in `@kindgi/api`. The refusal is recorded as the deployment's `endpoint.problem`.

**Details**

- `expected`: the deployment's pack service name, which the host must carry

**Example**

```json excerpt
{ "error": { "code": "endpoint-name-mismatch", "message": "…", "details": { "expected": "…" }, "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)

### `endpoint-unreachable`

**Synopsis**

`422 Unprocessable Content`, code `endpoint-unreachable`

The pack service didn't answer `GET /v1/info` as this deployment's service. Check that it runs and that the runtime can reach it, then set it again. The refusal is recorded as the deployment's `endpoint.problem`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "endpoint-unreachable", "message": "…", "requestId": "…" } }
```

**See also**

- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)
- [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemdeploymentssetendpoint.md)

### `flow-resume-not-supported`

**Synopsis**

`422 Unprocessable Content`, code `flow-resume-not-supported`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "flow-resume-not-supported", "message": "…", "requestId": "…" } }
```

**See also**

- [Wait for an approval](https://docs.kindgi.com/v0.1.8/guides/flows/wait-for-an-approval.md)

### `flow-runs-not-supported`

**Synopsis**

`422 Unprocessable Content`, code `flow-runs-not-supported`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "flow-runs-not-supported", "message": "…", "requestId": "…" } }
```

**See also**

- [Write a flow](https://docs.kindgi.com/v0.1.8/guides/flows/write-a-flow.md)

### `flow-unbound`

**Synopsis**

`422 Unprocessable Content`, code `flow-unbound`

The flow can't start or resume because a node has nothing to run it: a step names a tool the tenant doesn't have, an agent step can't bind, or a node kind isn't runnable.

**Details**

- `nodeIds`: the flow nodes that can't be bound

**Example**

```json excerpt
{ "error": { "code": "flow-unbound", "message": "…", "details": { "nodeIds": "…" }, "requestId": "…" } }
```

**See also**

- [Write a flow](https://docs.kindgi.com/v0.1.8/guides/flows/write-a-flow.md)
- [Dry-run a flow](https://docs.kindgi.com/v0.1.8/guides/flows/dry-run-a-flow.md)

### `gate-failed`

**Synopsis**

`422 Unprocessable Content`, code `gate-failed`

A gate policy refused the promotion because one or more of its checks failed. The refusal is recorded; read the failing checks and fix what they name.

**Details**

- `promotionId`: the recorded refused promotion
- `policy`: the gate policy that applied (id and version), or null
- `checks`: every check the gate ran, with whether each passed
- `proposalId`: the proposal, when the request came through a proposal

**Example**

```json excerpt
{ "error": { "code": "gate-failed", "message": "…", "details": { "promotionId": "…", "policy": "…", "checks": "…", "proposalId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/promotions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspromotionscreate.md)
- [`POST /v1/proposals/{proposalId}/request`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalsrequest.md)
- [Release an agent version](https://docs.kindgi.com/v0.1.8/guides/evals/release-an-agent-version.md)

### `guardrail-config-invalid`

**Synopsis**

`422 Unprocessable Content`, code `guardrail-config-invalid`

The guardrail's `config` doesn't satisfy the config schema of the check it names, so the check would refuse it on every call. Fix the config and register again.

**Details**

- `issues`: one entry per problem found in the config

**Example**

```json excerpt
{ "error": { "code": "guardrail-config-invalid", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/guardrails`](https://docs.kindgi.com/v0.1.8/reference/api/operations/guardrailsregister.md)

### `guardrail-violation`

**Synopsis**

`422 Unprocessable Content`, code `guardrail-violation`

A blocking guardrail stopped the agent's turn, or a halting guardrail's check couldn't run. The run fails; the violations say which guardrails fired.

**Details**

- `violations`: the blocking guardrail results
- `evaluationErrors`: guardrails whose check couldn't run (missing check, bad config)
- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "guardrail-violation", "message": "…", "details": { "violations": "…", "evaluationErrors": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)
- [Keep and purge deleted data](https://docs.kindgi.com/v0.1.8/deploy/retention.md)
- [Stop a turn or record a violation](https://docs.kindgi.com/v0.1.8/guides/guardrails/halt-or-record.md)

### `identity-provider-invalid`

**Synopsis**

`422 Unprocessable Content`, code `identity-provider-invalid`

The deployment couldn't use the provider's configuration (for example, its issuer discovery failed or its SAML metadata didn't parse), or `kind` is `oauth2`, which sign-in doesn't use.

**Details**

- `providerId`: id of the provider being registered or changed; may be absent for an `oauth2` body without one

**Example**

```json excerpt
{ "error": { "code": "identity-provider-invalid", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/auth/providers`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authprovidersregister.md)
- [`PATCH /v1/auth/providers/{providerId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/authprovidersupdate.md)

### `model-invocation-failed`

**Synopsis**

`422 Unprocessable Content`, code `model-invocation-failed`

The model provider call failed, for example it refused the key or was rate limited. The message carries the provider's own words.

**Details**

- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "model-invocation-failed", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Security](https://docs.kindgi.com/v0.1.8/concepts/security.md)
- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)

### `output-schema-violation`

**Synopsis**

`422 Unprocessable Content`, code `output-schema-violation`

The agent declares an output schema and its final answer still didn't match after the allowed repair attempts.

**Details**

- `errors`: the schema problems from the last attempt
- `attempts`: how many answers were checked
- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "output-schema-violation", "message": "…", "details": { "errors": "…", "attempts": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Give an agent a typed answer](https://docs.kindgi.com/v0.1.8/guides/agents/typed-answer.md)
- [Start runs from your app](https://docs.kindgi.com/v0.1.8/start/call-from-your-app.md)
- [Add Kindgi to a TypeScript or Node app](https://docs.kindgi.com/v0.1.8/start/existing-app-typescript.md)

### `provider-config-invalid`

**Synopsis**

`422 Unprocessable Content`, code `provider-config-invalid`

The provider registration is refused: `send_traceparent` isn't a boolean, or the provider's adapter rejects its `adapter_config`, metadata or `secret_ref`.

**Details**

- `issues`: list of problems, each with a JSON-pointer path and a message

**Example**

```json excerpt
{ "error": { "code": "provider-config-invalid", "message": "…", "details": { "issues": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/providers`](https://docs.kindgi.com/v0.1.8/reference/api/operations/providersregister.md)
- [Models](https://docs.kindgi.com/v0.1.8/guides/models.md)

### `run-resume-not-supported`

**Synopsis**

`422 Unprocessable Content`, code `run-resume-not-supported`

Resuming a run at a waitpoint through `POST /v1/runs/{runId}/resume` isn't available. A run waiting for an approval continues when a reviewer decides it.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "run-resume-not-supported", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsresume.md)

### `runtime-not-configured`

**Synopsis**

`422 Unprocessable Content`, code `runtime-not-configured`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "runtime-not-configured", "message": "…", "requestId": "…" } }
```

**See also**

- [Models](https://docs.kindgi.com/v0.1.8/guides/models.md)

### `semantic-unavailable`

**Synopsis**

`422 Unprocessable Content`, code `semantic-unavailable`

A search by meaning (`semantic`, or the agent's semantic retrieval) can't run because the deployment has no embeddings or the embedding provider isn't answering. Use keyword or `both` mode, or ask an admin.

**Details**

- `intent`: for an agent turn: the position of the retrieval intent that failed

**Example**

```json excerpt
{ "error": { "code": "semantic-unavailable", "message": "…", "details": { "intent": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/memory/retrieve`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memoryretrieve.md)
- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)
- [Memory reference](https://docs.kindgi.com/v0.1.8/guides/agents/memory-reference.md)

### `tool-invocation-failed`

**Synopsis**

`422 Unprocessable Content`, code `tool-invocation-failed`

A tool the agent called failed, and the agent's tool-error policy didn't let the model recover. The message carries the tool's own error.

**Details**

- `toolId`: the tool that failed
- `validationIssues`: when the model's arguments broke the tool's input schema: the validator's issues
- `receivedInput`: with validationIssues: the arguments the model sent, truncated
- `toolRetries`: failed calls already sent back to the model, when retries ran out
- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "tool-invocation-failed", "message": "…", "details": { "toolId": "…", "validationIssues": "…", "receivedInput": "…", "toolRetries": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Limits](https://docs.kindgi.com/v0.1.8/hosted/limits.md)
- [Write a tool](https://docs.kindgi.com/v0.1.8/guides/tools/write-a-tool.md)
- [See why runs failed](https://docs.kindgi.com/v0.1.8/guides/runs/see-why-runs-failed.md)

### `tool-version-unresolvable`

**Synopsis**

`422 Unprocessable Content`, code `tool-version-unresolvable`

No registered version of a tool the agent uses matches its version range, or the pinned version is no longer registered. Publish a matching version or fix the range.

**Details**

- `toolId`: the tool
- `requestedRange`: the version range or pin the agent asked for
- `availableVersions`: versions that are registered, when known
- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "tool-version-unresolvable", "message": "…", "details": { "toolId": "…", "requestedRange": "…", "availableVersions": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Agent and tool versions](https://docs.kindgi.com/v0.1.8/guides/agents/agent-and-tool-versions.md)

## 429 Too Many Requests

### `approvals-pending-limit`

**Synopsis**

`429 Too Many Requests`, code `approvals-pending-limit`

A gate asked for an approval while the tenant's approvals waiting for a decision were at its limit (set by whoever runs the server). Nothing waits for an approval nobody can see: the step fails, naming the limit. `POST /v1/runs` answers `429` when the call waits for its run; with `options.wait: false` it answers `202`, and the run fails with this code. A promotion whose gate wants an approval is refused with it. Once some of the approvals waiting are decided, try again.

**Details**

- `approvalsPending`: the tenant's limit on approvals waiting for a decision; absent when the server doesn't name it

**Example**

```json excerpt
{ "error": { "code": "approvals-pending-limit", "message": "…", "details": { "approvalsPending": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`POST /v1/agents/{agentId}/promotions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspromotionscreate.md)
- [Limits](https://docs.kindgi.com/v0.1.8/hosted/limits.md)

### `rate-limit-exceeded`

**Synopsis**

`429 Too Many Requests`, code `rate-limit-exceeded`

You sent too many requests, or a tenant reached one of its limits: a webhook trigger got more deliveries than its per-minute limit, a client sent too many refused webhook requests, too many sign-in lookups came from one source, or the tenant reached its limit on API requests or webhook deliveries a minute, or on runs waiting to start. A tenant's API requests to `/v1` and `/s3` count together; on `/s3`, its limit answers as S3 does, with `503 SlowDown` and `Retry-After`, not with this code. On a server with budgets kept per tenant (Kindgi Cloud), it's also the answer when the tenant's schemas took their budget compiling, or its instructions templates rendering, in the last 60 seconds; an agent's turn refused this way fails its run with this code. Retry after the `Retry-After` header; a refusal by the limit on runs waiting to start has none: retry once some have started.

**Details**

- `limit`: the tenant's limit that was reached: `api-requests`, `webhook-receives`, `runs-pending`, or a budget, `schema-compile-time` or `template-render-time`. Absent when the limit isn't the tenant's
- `runsPending`: the tenant's limit on runs waiting to start, on a `runs-pending` refusal; absent when the server doesn't name it
- `budgetMs`: for a budget, the milliseconds the tenant's work of that kind may take in 60 seconds
- `runId`: when a budget refused an agent's turn, the run the turn belongs to

**Example**

```json excerpt
{ "error": { "code": "rate-limit-exceeded", "message": "…", "details": { "limit": "…", "runsPending": "…", "budgetMs": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`POST /v1/agents`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspublish.md)
- [`POST /v1/agents/{agentId}/versions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentsderiveversion.md)
- [`POST /v1/flows`](https://docs.kindgi.com/v0.1.8/reference/api/operations/flowspublish.md)
- [`POST /v1/tools`](https://docs.kindgi.com/v0.1.8/reference/api/operations/toolsregister.md)
- [`POST /v1/guardrails`](https://docs.kindgi.com/v0.1.8/reference/api/operations/guardrailsregister.md)
- 5 more operations name it in their responses

### `secret-provider-rate-limited`

**Synopsis**

`429 Too Many Requests`, code `secret-provider-rate-limited`

The external secret provider is rate limiting the runtime. Wait and retry.

**Details**

- `retryAfterMs`: how long the provider asked to wait, in milliseconds, when it said (in binding results)

**Example**

```json excerpt
{ "error": { "code": "secret-provider-rate-limited", "message": "…", "details": { "retryAfterMs": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)
- [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantconfigupsert.md)
- [`POST /v1/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsset.md)
- [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotate.md)
- [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.1.8/deploy/secret-manager.md)

### `turn-memory-limit-reached`

**Synopsis**

`429 Too Many Requests`, code `turn-memory-limit-reached`

The runtime's agent turns hold more memory than its limit leaves this turn: the tenant's share (`KINDGI_TURN_MEMORY_PER_TENANT_MIB`) or the runtime's whole (`KINDGI_TURN_MEMORY_MIB`). The turn's run fails, and every tool call it finished is in the conversation, so a new turn there doesn't call it again. Retry later, or use a smaller conversation.

**Details**

- `limit`: `tenant` or `server`: which limit refused the turn
- `heldBytes`: what that limit's turns held, in bytes
- `limitBytes`: the limit, in bytes
- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "turn-memory-limit-reached", "message": "…", "details": { "limit": "…", "heldBytes": "…", "limitBytes": "…", "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Limits](https://docs.kindgi.com/v0.1.8/hosted/limits.md)
- [`GET /v1/runs/{runId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsget.md)

## 500 Internal Server Error

### `blob-storage-error`

**Synopsis**

`500 Internal Server Error`, code `blob-storage-error`

The runtime's artifact storage failed while reading or writing the bytes. Retry; contact the operator if it persists.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "blob-storage-error", "message": "…", "requestId": "…" } }
```

**See also**

- [Keep files with a run](https://docs.kindgi.com/v0.1.8/guides/runs/keep-files-with-a-run.md)

### `compliance-export-failed`

**Synopsis**

`500 Internal Server Error`, code `compliance-export-failed`

Signing the compliance evidence export failed on the server. Retry; if it persists, contact the operator.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "compliance-export-failed", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/compliance/evidence/export`](https://docs.kindgi.com/v0.1.8/reference/api/operations/complianceevidenceexport.md)

### `env-store-error`

**Synopsis**

`500 Internal Server Error`, code `env-store-error`

The env store failed, for example a database error, so the entry wasn't read or written.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "env-store-error", "message": "…", "requestId": "…" } }
```

**See also**

- [Set values per environment](https://docs.kindgi.com/v0.1.8/guides/secrets/per-environment-values.md)

### `export-key-error`

**Synopsis**

`500 Internal Server Error`, code `export-key-error`

Signing the export with the deployment's export key failed. The message carries the reason.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "export-key-error", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/approvals/{approvalId}/audit-bundle`](https://docs.kindgi.com/v0.1.8/reference/api/operations/approvalsauditbundle.md)
- [`POST /v1/provenance/{runId}/export`](https://docs.kindgi.com/v0.1.8/reference/api/operations/provenanceexport.md)

### `identity-revoke-failed`

**Synopsis**

`500 Internal Server Error`, code `identity-revoke-failed`

Revoking all of a user's sessions failed on the server. Retry; if it persists, contact the operator.

**Details**

- `userId`: the user whose sessions were being revoked

**Example**

```json excerpt
{ "error": { "code": "identity-revoke-failed", "message": "…", "details": { "userId": "…" }, "requestId": "…" } }
```

**See also**

- [`POST /v1/identity/users/{userId}/revoke-sessions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersrevokesessions.md)

### `internal-server-error`

**Synopsis**

`500 Internal Server Error`, code `internal-server-error`

The server hit an unexpected error while handling the request. Retry; if it persists, contact support with the `requestId`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "internal-server-error", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/deployments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentslist.md)

### `journal-error`

**Synopsis**

`500 Internal Server Error`, code `journal-error`

The run's record couldn't be written or read back: the run was started but its row isn't readable, or it couldn't be started or reloaded after cancelling.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "journal-error", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/runs`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsstart.md)
- [`POST /v1/runs/{runId}/cancel`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runscancel.md)

### `persistence-error`

**Synopsis**

`500 Internal Server Error`, code `persistence-error`

The runtime couldn't read or write its storage. Retry; if it persists, contact support.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "persistence-error", "message": "…", "requestId": "…" } }
```

**See also**

- [Stop a turn or record a violation](https://docs.kindgi.com/v0.1.8/guides/guardrails/halt-or-record.md)
- [`GET /v1/audit/authz`](https://docs.kindgi.com/v0.1.8/reference/api/operations/auditauthzlist.md)

### `secret-decryption-failed`

**Synopsis**

`500 Internal Server Error`, code `secret-decryption-failed`

The runtime couldn't decrypt a stored secret value (the key service failed to unwrap its key).

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-decryption-failed", "message": "…", "requestId": "…" } }
```

**See also**

- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)
- [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.1.8/deploy/secret-manager.md)

### `secret-encryption-failed`

**Synopsis**

`500 Internal Server Error`, code `secret-encryption-failed`

The runtime couldn't encrypt the secret value (the key service refused to produce a data key), so nothing was stored.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-encryption-failed", "message": "…", "requestId": "…" } }
```

**See also**

- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)
- [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.1.8/deploy/secret-manager.md)

### `secret-store-error`

**Synopsis**

`500 Internal Server Error`, code `secret-store-error`

The secrets store failed in a way the other secret codes don't cover, such as a database error, an invalid name for the store, or a provider feature it doesn't support.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-store-error", "message": "…", "requestId": "…" } }
```

**See also**

- [Store a secret](https://docs.kindgi.com/v0.1.8/guides/secrets/store-a-secret.md)

### `signing-key-store-error`

**Synopsis**

`500 Internal Server Error`, code `signing-key-store-error`

The API doesn't send this code.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "signing-key-store-error", "message": "…", "requestId": "…" } }
```

**See also**

- [Export signed evidence](https://docs.kindgi.com/v0.1.8/guides/observability/export-signed-evidence.md)

### `stuck`

**Synopsis**

`500 Internal Server Error`, code `stuck`

A flow run reached a point where no step is ready and no branch is left to decide, so the run fails. Check the flow's edges and their conditions.

**Details**

- `runId`: the run that failed

**Example**

```json excerpt
{ "error": { "code": "stuck", "message": "…", "details": { "runId": "…" }, "requestId": "…" } }
```

**See also**

- [Branch a flow](https://docs.kindgi.com/v0.1.8/guides/flows/branch-a-flow.md)
- [Dry-run a flow](https://docs.kindgi.com/v0.1.8/guides/flows/dry-run-a-flow.md)

### `token-mint-failed`

**Synopsis**

`500 Internal Server Error`, code `token-mint-failed`

The runtime couldn't sign a public run token, for example because it has no usable signing key. Report it to an admin of the deployment.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "token-mint-failed", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tokensmintpublic.md)

### `trigger-lifecycle-failed`

**Synopsis**

`500 Internal Server Error`, code `trigger-lifecycle-failed`

The runtime couldn't pause, resume or fire the trigger because of a storage error.

**Details**

- `triggerId`: the trigger id

**Example**

```json excerpt
{ "error": { "code": "trigger-lifecycle-failed", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }
```

**See also**

- [Run on a schedule](https://docs.kindgi.com/v0.1.8/guides/runs/run-on-a-schedule.md)

### `trigger-register-failed`

**Synopsis**

`500 Internal Server Error`, code `trigger-register-failed`

The runtime couldn't save the new trigger because of a storage error.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "trigger-register-failed", "message": "…", "requestId": "…" } }
```

**See also**

- [Run on a schedule](https://docs.kindgi.com/v0.1.8/guides/runs/run-on-a-schedule.md)

### `trigger-update-failed`

**Synopsis**

`500 Internal Server Error`, code `trigger-update-failed`

The runtime couldn't update the trigger because of a storage error.

**Details**

- `triggerId`: the trigger id

**Example**

```json excerpt
{ "error": { "code": "trigger-update-failed", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } }
```

**See also**

- [Run on a schedule](https://docs.kindgi.com/v0.1.8/guides/runs/run-on-a-schedule.md)

## 501 Not Implemented

### `authz-membership-unsupported`

**Synopsis**

`501 Not Implemented`, code `authz-membership-unsupported`

Authorization is enforced, and the runtime can't change a team or membership together with its permissions, so it refuses and changes nothing.

**Details**

- `method`: the missing operation in the runtime's tenant-hierarchy binding

**Example**

```json excerpt
{ "error": { "code": "authz-membership-unsupported", "message": "…", "details": { "method": "…" }, "requestId": "…" } }
```

**See also**

- [`DELETE /v1/teams/{teamId}/memberships/{userId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/teamsmembershipsremove.md)
- [`PATCH /v1/teams/{teamId}/memberships/{userId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/teamsmembershipsupdaterole.md)
- [`POST /v1/projects/{projectId}/team-grants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsteamgrantsadd.md)
- [`PATCH /v1/projects/{projectId}/team-grants/{teamId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsteamgrantsupdaterole.md)
- [`DELETE /v1/projects/{projectId}/team-grants/{teamId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsteamgrantsremove.md)
- [`DELETE /v1/projects/{projectId}/memberships/{userId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsmembershipsremove.md)
- 1 more operations name it in their responses

### `conversation-unregister-unsupported`

**Synopsis**

`501 Not Implemented`, code `conversation-unregister-unsupported`

This runtime can't unregister conversations.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "conversation-unregister-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/conversations/{conversationId}/unregister`](https://docs.kindgi.com/v0.1.8/reference/api/operations/conversationsunregister.md)

### `guardrail-outcomes-not-supported`

**Synopsis**

`501 Not Implemented`, code `guardrail-outcomes-not-supported`

This deployment doesn't record guardrail outcomes.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "guardrail-outcomes-not-supported", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/guardrails/{guardrailId}/outcomes`](https://docs.kindgi.com/v0.1.8/reference/api/operations/guardrailsoutcomes.md)

### `improve-unsupported`

**Synopsis**

`501 Not Implemented`, code `improve-unsupported`

This runtime doesn't run improvement passes.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "improve-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/proposals/improve`](https://docs.kindgi.com/v0.1.8/reference/api/operations/proposalsimprove.md)
- [`GET /v1/improvement-passes`](https://docs.kindgi.com/v0.1.8/reference/api/operations/improvementpasseslist.md)
- [`GET /v1/improvement-passes/{passId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/improvementpassesget.md)
- [`POST /v1/improvement-passes/{passId}/cancel`](https://docs.kindgi.com/v0.1.8/reference/api/operations/improvementpassescancel.md)

### `memory-operation-unsupported`

**Synopsis**

`501 Not Implemented`, code `memory-operation-unsupported`

This runtime's memory doesn't support the operation: listing fact history, deleting facts or verifying facts.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "memory-operation-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`DELETE /v1/memory/facts/{factId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorydeletefact.md)
- [`GET /v1/memory/facts/{factId}/revisions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memorylistfactrevisions.md)
- [`POST /v1/memory/facts/{factId}/verify`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memoryverifyfact.md)
- [`POST /v1/memory/retrieve`](https://docs.kindgi.com/v0.1.8/reference/api/operations/memoryretrieve.md)
- [Memory reference](https://docs.kindgi.com/v0.1.8/guides/agents/memory-reference.md)

### `permissions-unsupported`

**Synopsis**

`501 Not Implemented`, code `permissions-unsupported`

The runtime runs without an authorization store, so it can't say what the caller may do. Read whoami's `tenantAdmin` and `reviewerRole` instead.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "permissions-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/identity/me/permissions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identitymepermissions.md)

### `person-grants-unsupported`

**Synopsis**

`501 Not Implemented`, code `person-grants-unsupported`

The runtime runs without an authorization store, so it can't read or change a person's grants.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "person-grants-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/identity/users/{userId}/grants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersgrants.md)
- [`POST /v1/identity/users/{userId}/grant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersgrant.md)
- [`POST /v1/identity/users/{userId}/ungrant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identityusersungrant.md)

### `production-unsupported`

**Synopsis**

`501 Not Implemented`, code `production-unsupported`

This server's projects can't be put in production: its project store has no production setting. Every run there is a staging run.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "production-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`PUT /v1/projects/{projectId}/production`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsproductionset.md)

### `project-access-unsupported`

**Synopsis**

`501 Not Implemented`, code `project-access-unsupported`

The runtime has no authorization store, so it can't say who has access to the project.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "project-access-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/projects/{projectId}/access`](https://docs.kindgi.com/v0.1.8/reference/api/operations/projectsaccesslist.md)

### `promotion-gate-unsupported`

**Synopsis**

`501 Not Implemented`, code `promotion-gate-unsupported`

A gate policy applies to this promotion, and the deployment can't record a gated promotion, so the promotion is refused.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "promotion-gate-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/agents/{agentId}/promotions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/agentspromotionscreate.md)

### `run-failures-not-supported`

**Synopsis**

`501 Not Implemented`, code `run-failures-not-supported`

This deployment can't group failed runs by cause.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "run-failures-not-supported", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/runs/failures`](https://docs.kindgi.com/v0.1.8/reference/api/operations/runsfailures.md)

### `secret-operation-unsupported`

**Synopsis**

`501 Not Implemented`, code `secret-operation-unsupported`

The secrets store doesn't support this operation. Under `kindgi dev` secrets live in env files and have no versions or revocation, so edit or remove the name there.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-operation-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`DELETE /v1/secrets/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrevoke.md)
- [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotate.md)

### `test-sets-not-supported`

**Synopsis**

`501 Not Implemented`, code `test-sets-not-supported`

This deployment can't list judged runs, so it can't build test sets from judgments.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "test-sets-not-supported", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/eval-suites/{suiteId}/versions/from-judgments`](https://docs.kindgi.com/v0.1.8/reference/api/operations/evalsuitesbuildfromjudgments.md)

### `trigger-operation-unsupported`

**Synopsis**

`501 Not Implemented`, code `trigger-operation-unsupported`

This deployment doesn't support the operation on triggers, such as listing a schedule's fire history or running it now.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "trigger-operation-unsupported", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/schedules/{triggerId}/fires`](https://docs.kindgi.com/v0.1.8/reference/api/operations/schedulesfires.md)
- [`POST /v1/schedules/{triggerId}/run-now`](https://docs.kindgi.com/v0.1.8/reference/api/operations/schedulesrunnow.md)
- [`POST /v1/schedules/{triggerId}/owner`](https://docs.kindgi.com/v0.1.8/reference/api/operations/schedulestakeownership.md)
- [`GET /v1/webhooks/{triggerId}/fires`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhooksfires.md)
- [`POST /v1/webhooks/{triggerId}/owner`](https://docs.kindgi.com/v0.1.8/reference/api/operations/webhookstakeownership.md)

## 502 Bad Gateway

### `mcp-prompt-get-failed`

**Synopsis**

`502 Bad Gateway`, code `mcp-prompt-get-failed`

The runtime reached the MCP endpoint but listing its prompts or fetching the named prompt failed, for example because the remote server answered with a protocol error.

**Details**

- `endpointId`: id of the MCP endpoint
- `promptName`: the prompt being fetched; present when fetching one prompt, not when listing

**Example**

```json excerpt
{ "error": { "code": "mcp-prompt-get-failed", "message": "…", "details": { "endpointId": "…", "promptName": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/mcp/endpoints/{endpointId}/prompts`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointspromptslist.md)
- [`POST /v1/mcp/endpoints/{endpointId}/prompts/{name}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointspromptsget.md)

### `mcp-resource-read-failed`

**Synopsis**

`502 Bad Gateway`, code `mcp-resource-read-failed`

The runtime reached the MCP endpoint but listing or reading its resources failed, for example because the remote server answered with a protocol error. Retry later or check the endpoint.

**Details**

- `endpointId`: id of the MCP endpoint
- `uri`: the resource URI being read; present when reading one resource, not when listing

**Example**

```json excerpt
{ "error": { "code": "mcp-resource-read-failed", "message": "…", "details": { "endpointId": "…", "uri": "…" }, "requestId": "…" } }
```

**See also**

- [`GET /v1/mcp/endpoints/{endpointId}/resources`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsresourceslist.md)
- [`GET /v1/mcp/endpoints/{endpointId}/resources/{uri}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/mcpendpointsresourcesread.md)

### `secret-provider-unauthorized`

**Synopsis**

`502 Bad Gateway`, code `secret-provider-unauthorized`

The external secret provider rejected the runtime's credentials, so the secret can't be read or written. Ask an admin to fix the provider access.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-provider-unauthorized", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)
- [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantconfigupsert.md)
- [`POST /v1/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsset.md)
- [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotate.md)
- [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.1.8/deploy/secret-manager.md)

## 503 Service Unavailable

### `access-record-unavailable`

**Synopsis**

`503 Service Unavailable`, code `access-record-unavailable`

The record of the operator's requests couldn't be written, so a system key's request did nothing. Retry after the `Retry-After` header.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "access-record-unavailable", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/system/keys`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysmint.md)
- [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemkeysrevoke.md)
- [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantscreate.md)
- [`POST /v1/system/tenants/{tenantId}/close`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantsclose.md)
- [`PUT /v1/system/tenants/{tenantId}/suspended`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetsuspended.md)
- [`PUT /v1/system/tenants/{tenantId}/image-prefix`](https://docs.kindgi.com/v0.1.8/reference/api/operations/systemtenantssetimageprefix.md)
- 5 more operations name it in their responses
- [Serve many tenants](https://docs.kindgi.com/v0.1.8/deploy/serve-many-tenants.md)

### `authz-backend-unavailable`

**Synopsis**

`503 Service Unavailable`, code `authz-backend-unavailable`

The store that holds permissions couldn't be read, so the runtime can't tell what the caller may do. Try the request again shortly.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "authz-backend-unavailable", "message": "…", "requestId": "…" } }
```

**See also**

- [`GET /v1/identity/me/permissions`](https://docs.kindgi.com/v0.1.8/reference/api/operations/identitymepermissions.md)

### `secret-provider-unavailable`

**Synopsis**

`503 Service Unavailable`, code `secret-provider-unavailable`

The external secret provider can't be reached, or the active secrets store can't do provider-driven rotation, so send the new value yourself.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "secret-provider-unavailable", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/deploymentssyncsecrets.md)
- [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantconfigupsert.md)
- [`POST /v1/secrets`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsset.md)
- [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.1.8/reference/api/operations/secretsrotate.md)
- [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.1.8/deploy/secret-manager.md)

### `tenant-policy-unavailable`

**Synopsis**

`503 Service Unavailable`, code `tenant-policy-unavailable`

A tenant policy that an agent turn must apply couldn't be loaded or evaluated, so the turn fails instead of running without it.

**Details**

- `policyKind`: the kind of policy that failed, for example `hitl`

**Example**

```json excerpt
{ "error": { "code": "tenant-policy-unavailable", "message": "…", "details": { "policyKind": "…" }, "requestId": "…" } }
```

**See also**

- [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.8/deploy/operate.md)

### `tenant-state-unavailable`

**Synopsis**

`503 Service Unavailable`, code `tenant-state-unavailable`

The tenant's state couldn't be read, so the request changed nothing. Retry after the `Retry-After` header. On the S3-compatible surface, the same answer is S3's `503 ServiceUnavailable`.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "tenant-state-unavailable", "message": "…", "requestId": "…" } }
```

**See also**

- [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.1.8/reference/api/operations/hooksreceive.md)
- [`GET /v1/tenant`](https://docs.kindgi.com/v0.1.8/reference/api/operations/tenantget.md)

## Codes with their own status

These come from parts of a deployment that answer outside the API's routes: the build service, the console under `kindgi dev`, and sign-in. Each has the status shown, and the envelope without `requestId`.

### `tarball-hash-missing`

**Synopsis**

`400 Bad Request`, code `tarball-hash-missing`

A request to the build service (the `build` endpoint `kindgi build` and `kindgi deploy` send packs to) has no `X-Content-SHA256` header. `kindgi build` sends it for you.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "tarball-hash-missing", "message": "…" } }
```

**See also**

- [`kindgi build`](https://docs.kindgi.com/v0.1.8/reference/cli/build.md)

### `tarball-hash-invalid`

**Synopsis**

`400 Bad Request`, code `tarball-hash-invalid`

The build request's `X-Content-SHA256` header isn't `sha256:` followed by 64 hex digits, or 64 hex digits alone.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "tarball-hash-invalid", "message": "…" } }
```

**See also**

- [`kindgi build`](https://docs.kindgi.com/v0.1.8/reference/cli/build.md)

### `tarball-too-large`

**Synopsis**

`413 Content Too Large`, code `tarball-too-large`

The pack sent to the build service is larger than 512 MiB. Leave build output and dependencies out of the pack.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "tarball-too-large", "message": "…" } }
```

**See also**

- [`kindgi build`](https://docs.kindgi.com/v0.1.8/reference/cli/build.md)

### `tarball-hash-mismatch`

**Synopsis**

`400 Bad Request`, code `tarball-hash-mismatch`

The pack the build service received doesn't hash to the `X-Content-SHA256` the request named, so it was changed or cut short on the way. Send it again.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "tarball-hash-mismatch", "message": "…" } }
```

**See also**

- [`kindgi build`](https://docs.kindgi.com/v0.1.8/reference/cli/build.md)

### `build-job-not-found`

**Synopsis**

`404 Not Found`, code `build-job-not-found`

The build service has no build job with that id.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "build-job-not-found", "message": "…" } }
```

**See also**

- [`kindgi build`](https://docs.kindgi.com/v0.1.8/reference/cli/build.md)

### `build-job-gone`

**Synopsis**

`410 Gone`, code `build-job-gone`

The build job ended longer ago than the build service keeps jobs, so its status and output are gone. Build again.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "build-job-gone", "message": "…" } }
```

**See also**

- [`kindgi build`](https://docs.kindgi.com/v0.1.8/reference/cli/build.md)

### `forbidden`

**Synopsis**

`403 Forbidden`, code `forbidden`

Under `kindgi dev`, the runtime gives the console its sign-in token only on the same machine (localhost, `127.0.0.1` or `[::1]`). Open the console from that machine.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "forbidden", "message": "…" } }
```

**See also**

- [`kindgi dev`](https://docs.kindgi.com/v0.1.8/reference/cli/dev.md)
- [`kindgi console`](https://docs.kindgi.com/v0.1.8/reference/cli/console.md)

### `sign-in-unavailable`

**Synopsis**

`500 Internal Server Error`, code `sign-in-unavailable`

Signing in failed on the server, for example because its database didn't answer. Nothing about the cause is sent to the browser; a sign-in page shows the code instead of JSON. The runtime's log says why, as an `sso` warning: `sign-in request failed: <reason>`. Try again.

**Details**

None.

**Example**

```json excerpt
{ "error": { "code": "sign-in-unavailable", "message": "…" } }
```

**See also**

- [Turn on sign-in](https://docs.kindgi.com/v0.1.8/deploy/sign-in.md)

## access.kindgi.com

`kindgi license renew` renews a deployment's license key at access.kindgi.com (`POST https://access.kindgi.com/v1/renew`). A refusal comes in that service's own shape, with no `code` wrapper and no `requestId`; the `message` says what to do, and the CLI prints it.

```json excerpt
{ "error": "unavailable", "message": "…" }
```

### `bad-request`

**Synopsis**

`400 Bad Request`, error `bad-request`

The body isn't a renewal request. A body over the size limit is answered the same way, with status `413`.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "bad-request", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `unauthorized`

**Synopsis**

`401 Unauthorized`, error `unauthorized`

No renewer has this deployment's key, or the request's signature doesn't verify. Enroll the deployment with `kindgi license enroll`, then add it at access.kindgi.com.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "unauthorized", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)
- [`kindgi license`](https://docs.kindgi.com/v0.1.8/reference/cli/license.md)

### `stale-request`

**Synopsis**

`401 Unauthorized`, error `stale-request`

The request's time is more than 5 minutes off. Check the clock of the machine that sent it.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "stale-request", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `replayed`

**Synopsis**

`401 Unauthorized`, error `replayed`

This exact request was used before. Send a new one.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "replayed", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `rate-limited`

**Synopsis**

`429 Too Many Requests`, error `rate-limited`

Too many renewals for this key. The next one can go an hour later.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "rate-limited", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `renewer-stopped`

**Synopsis**

`403 Forbidden`, error `renewer-stopped`

This deployment's renewal was stopped. Enroll it again with `kindgi license enroll`, or sign in at access.kindgi.com for a key.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "renewer-stopped", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)
- [`kindgi license`](https://docs.kindgi.com/v0.1.8/reference/cli/license.md)

### `denied`

**Synopsis**

`403 Forbidden`, error `denied`

Dev access isn't available for this account. Write to <contact@kindgi.com>.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "denied", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `key-revoked`

**Synopsis**

`403 Forbidden`, error `key-revoked`

The account's license key was revoked. Write to <contact@kindgi.com>.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "key-revoked", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `not-entitled`

**Synopsis**

`403 Forbidden`, error `not-entitled`

The license has no contract term on record, so access.kindgi.com doesn't renew it. Write to <contact@kindgi.com>.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "not-entitled", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `term-ended`

**Synopsis**

`403 Forbidden`, error `term-ended`

The license's contract term has ended, so it isn't renewed. The key you have runs until its own date. Write to <contact@kindgi.com> to extend the term.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "term-ended", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `held-for-review`

**Synopsis**

`403 Forbidden`, error `held-for-review`

This renewal's counts (`kindgi license renew --runtime`) are above what a non-production key covers, so it got no new key: write to <contact@kindgi.com> about a production license. Kindgi can release the deployment after a review, and its renewals then aren't held until a date. The key you have runs until its own date. A renewal before the key is due gets the same key back.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "held-for-review", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)

### `unavailable`

**Synopsis**

`503 Service Unavailable`, error `unavailable`

No key could be issued: the service failed to store or sign it. Try again later.

**Details**

None: the body has `error` and `message` only.

**Example**

```json excerpt
{ "error": "unavailable", "message": "…" }
```

**See also**

- [Renew the license key](https://docs.kindgi.com/v0.1.8/deploy/renew-the-license-key.md)