# Error codes > Every error code the HTTP API answers with, its status, what it means and what its details hold. When the API refuses a request, the response body is an error envelope: ```json excerpt { "error": { "code": "agent-not-found", "message": "…", "requestId": "…" } } ``` - `code` says what went wrong. Match on it: it stays the same, while `message` is written for people and can change. - `details`, when present, holds the facts the code needs: a limit, the field at fault, when to retry. - `requestId` identifies the request in the runtime's logs. Quote it when you report a problem. The TypeScript and Python clients raise these as typed errors with the same `code`. The codes below are grouped by their HTTP status. ## 400 Bad Request ### `auth-not-session-token` **Synopsis** `400 Bad Request`, code `auth-not-session-token` `POST /v1/auth/refresh` or `POST /v1/auth/logout` was called with a token that isn't a session token (`kgi_sk_*`). Bearer API tokens are managed through `/v1/tokens`. **Details** None. **Example** ```json excerpt { "error": { "code": "auth-not-session-token", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/identity/me/second-factor`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymesecondfactor.md) - [`POST /v1/identity/me/second-factor`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymestartsecondfactor.md) - [`POST /v1/identity/me/second-factor/confirm`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeconfirmsecondfactor.md) - [`POST /v1/identity/me/second-factor/recovery-codes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymenewrecoverycodes.md) - [`POST /v1/identity/me/second-factor/remove`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeremovesecondfactor.md) - [Sessions](https://docs.kindgi.com/v0.4.0/guides/sso/sessions.md) ### `bad-input` **Synopsis** `400 Bad Request`, code `bad-input` The request is malformed: the body isn't valid JSON or isn't an object, a JSON body nests objects and arrays deeper than the limit, a field has the wrong type or value, a `projectId` isn't a UUID, or a `cursor` wasn't issued by this list. Fix the input named in the message. **Details** - `maxDepth`: the most levels a JSON body may nest, when it nests deeper **Example** ```json excerpt { "error": { "code": "bad-input", "message": "…", "details": { "maxDepth": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) - [`PATCH /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsupdate.md) - [`PUT /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvsetcloudsecret.md) - [`GET /v1/system/usage`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemusageread.md) - [`GET /v1/usage`](https://docs.kindgi.com/v0.4.0/reference/api/operations/usageread.md) - [`POST /v1/system/deployments/round`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsclaimround.md) - 60 more operations name it in their responses - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `blob-hash-mismatch` **Synopsis** `400 Bad Request`, code `blob-hash-mismatch` The uploaded bytes don't match the `expectedHash` you sent. Nothing is stored; recompute the hash or resend the bytes. **Details** - `expected`: the hash you declared - `actual`: the hash of the bytes received **Example** ```json excerpt { "error": { "code": "blob-hash-mismatch", "message": "…", "details": { "expected": "…", "actual": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/artifacts`](https://docs.kindgi.com/v0.4.0/reference/api/operations/artifactsupload.md) ### `blob-size-mismatch` **Synopsis** `400 Bad Request`, code `blob-size-mismatch` The uploaded bytes aren't the size you declared. Nothing is stored; send the right `size` or the full body. **Details** - `declared`: the size you declared - `actual`: the size of the bytes received **Example** ```json excerpt { "error": { "code": "blob-size-mismatch", "message": "…", "details": { "declared": "…", "actual": "…" }, "requestId": "…" } } ``` **See also** - [Keep files with a run](https://docs.kindgi.com/v0.4.0/guides/runs/keep-files-with-a-run.md) ### `cloud-secret-invalid` **Synopsis** `400 Bad Request`, code `cloud-secret-invalid` `cloudSecret` isn't a numbered version of a Google Cloud Secret Manager secret, `projects//secrets//versions/`: a version is a number, never `latest` or an alias, and a secret whose id starts with `kp-` is refused, since those are the pack services' own copies. The message says which part, and never repeats what was sent. **Details** None. **Example** ```json excerpt { "error": { "code": "cloud-secret-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvsetcloudsecret.md) - [`PUT /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvsetcloudsecret.md) ### `connection-app-invalid` **Synopsis** `400 Bad Request`, code `connection-app-invalid` An app registration that doesn't fit its app's entry, or no registration that fits a connect. A project uses one registration of an app, so a registration that would serve a project another registration of the app serves answers it too (field `projects`). So does changing a registration's client (its client id, its directory, or its GitHub App) while it has live connections: disconnect them first, then change it and connect again. The message says what's wrong. **Details** - `field`: the input field at fault, when there is one **Example** ```json excerpt { "error": { "code": "connection-app-invalid", "message": "…", "details": { "field": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/connection-apps`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionappscreate.md) - [`PATCH /v1/connection-apps/{appId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionappsupdate.md) - [`POST /v1/connections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsconnect.md) - [Microsoft](https://docs.kindgi.com/v0.4.0/guides/connections/microsoft.md) ### `connection-app-unknown-entry` **Synopsis** `400 Bad Request`, code `connection-app-unknown-entry` A registration or a connect names an app this server has no entry for, or no longer has. `GET /v1/connection-entries` lists the apps it knows. **Details** - `field`: the input field that names the app (`app`) **Example** ```json excerpt { "error": { "code": "connection-app-unknown-entry", "message": "…", "details": { "field": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/connection-apps`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionappscreate.md) - [`POST /v1/connections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsconnect.md) ### `connection-notice-invalid` **Synopsis** `400 Bad Request`, code `connection-notice-invalid` An app's notice to `POST /v1/connection-notices/{tenantId}/{appId}` wasn't accepted. It's one answer for every reason, such as a signature or token that doesn't check out, so the sender learns nothing from it. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-notice-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connection-notices/{tenantId}/{appId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionnoticesreceive.md) ### `cookie-session-not-refreshable` **Synopsis** `400 Bad Request`, code `cookie-session-not-refreshable` `POST /v1/auth/refresh` was called with a browser (cookie) session. These sessions aren't refreshed; sign in again when the session ends. **Details** None. **Example** ```json excerpt { "error": { "code": "cookie-session-not-refreshable", "message": "…", "requestId": "…" } } ``` **See also** - [Sessions](https://docs.kindgi.com/v0.4.0/guides/sso/sessions.md) ### `corrector-group-not-applicable` **Synopsis** `400 Bad Request`, code `corrector-group-not-applicable` The corrector group you named doesn't exist, or doesn't apply to this run's project or agent. **Details** None. **Example** ```json excerpt { "error": { "code": "corrector-group-not-applicable", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/corrections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctionscreate.md) ### `deployment-validation-failed` **Synopsis** `400 Bad Request`, code `deployment-validation-failed` The deployment's manifest has invalid definitions, or a tool names a model provider's key. Each problem is listed in `details.issues`; fix them and deploy again. **Details** - `issues`: list of problems, each naming the primitive, its index, id, path and message **Example** ```json excerpt { "error": { "code": "deployment-validation-failed", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Configure a guardrail](https://docs.kindgi.com/v0.4.0/guides/guardrails/configure-a-guardrail.md) - [Use a built-in check](https://docs.kindgi.com/v0.4.0/guides/guardrails/use-a-built-in-check.md) ### `dispatcher-input-invalid` **Synopsis** `400 Bad Request`, code `dispatcher-input-invalid` The test run's input doesn't fit the test set's kind: neither an agent nor a flow reference was given, or the kind's validation rejected the target or comparison. Under `kindgi dev`, a test run of a suggested change's version is also refused with it when a file in the pack holds a block that version pins, at the pinned version but with other content than `kindgi dev` keeps there. The message names the file. **Details** None. **Example** ```json excerpt { "error": { "code": "dispatcher-input-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/test-runs/{testRunId}/rescore`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testrunsrescore.md) ### `endpoint-url-invalid` **Synopsis** `400 Bad Request`, code `endpoint-url-invalid` The pack service URL the operator set for a deployment isn't `https://`: it isn't https, or it has user info, a path, a query or a fragment. The message says which. Send the service's origin only. The refusal is recorded as the deployment's `endpoint.problem`. **Details** None. **Example** ```json excerpt { "error": { "code": "endpoint-url-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) ### `env-cross-scope` **Synopsis** `400 Bad Request`, code `env-cross-scope` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "env-cross-scope", "message": "…", "requestId": "…" } } ``` **See also** - [Set values per environment](https://docs.kindgi.com/v0.4.0/guides/secrets/per-environment-values.md) ### `env-name-mismatch` **Synopsis** `400 Bad Request`, code `env-name-mismatch` The `envName` in the body differs from the `envName` in the query string. Send one, or make them equal. **Details** None. **Example** ```json excerpt { "error": { "code": "env-name-mismatch", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrotate.md) - [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envput.md) ### `env-name-required` **Synopsis** `400 Bad Request`, code `env-name-required` The `envName` query parameter is missing, or isn't a valid environment name (lowercase letters, digits and hyphens, starting with a letter, up to 63 characters). **Details** None. **Example** ```json excerpt { "error": { "code": "env-name-required", "message": "…", "requestId": "…" } } ``` **See also** - [`DELETE /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envdelete.md) ### `image-unverifiable` **Synopsis** `400 Bad Request`, code `image-unverifiable` The runtime couldn't verify the deployment's image: the registry probe failed, or the registry's digest differs from the digest in the image reference. **Details** - `imageRef`: the image reference that was checked - `cause`: when a registry read failed, why: `image-not-found`, `image-file-not-found`, `image-registry-unreachable`, `image-registry-unauthorized`, `image-unreadable` (a layer that isn't an archive the runtime can read), or `image-limit-exceeded` (the image is past one of the runtime's bounds on reading an image). Absent when the read succeeded and the check after it failed - `limit`: with `image-limit-exceeded`, the bound: `manifest`, `file`, `layer`, `read` or `unpack`, the image's own, so the same image is refused again. The tenant's hour of image reads is never this code: reaching it answers `rate-limit-exceeded` with `limit` `tenant-unpack-hour` and `Retry-After` **Example** ```json excerpt { "error": { "code": "image-unverifiable", "message": "…", "details": { "imageRef": "…", "cause": "…", "limit": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [Kindgi 0.1.10](https://docs.kindgi.com/v0.4.0/releases/0.1.10.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) ### `invalid-agent` **Synopsis** `400 Bad Request`, code `invalid-agent` An agent definition breaks the rules. Defining it in code raises this code before anything is sent; the API answers the same problem as `validation-failed`, with each issue in `details.issues`. **Details** - `issues`: each problem: its path and what is wrong **Example** ```json excerpt { "error": { "code": "invalid-agent", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspublish.md) ### `invalid-guardrail` **Synopsis** `400 Bad Request`, code `invalid-guardrail` A guardrail definition breaks the rules, or its kind doesn't match the check it names. Defining it in code raises this code; the API answers `validation-failed`, with each issue in `details.issues`. **Details** - `issues`: each problem: its path and what is wrong **Example** ```json excerpt { "error": { "code": "invalid-guardrail", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/guardrails`](https://docs.kindgi.com/v0.4.0/reference/api/operations/guardrailsregister.md) ### `invalid-mcp-endpoint` **Synopsis** `400 Bad Request`, code `invalid-mcp-endpoint` The body of `POST /v1/mcp/endpoints` isn't a valid MCP endpoint registration: an unknown field, a missing or empty id or name, an id with a `.`, an unknown transport, or a config that doesn't match its transport. **Details** - `reason`: short machine-readable reason, such as `unknown-field`, `empty-endpoint-id`, `dot-in-endpoint-id`, `unknown-transport`, `missing-config`, `config-transport-mismatch` or `invalid-secret-ref` **Example** ```json excerpt { "error": { "code": "invalid-mcp-endpoint", "message": "…", "details": { "reason": "…" }, "requestId": "…" } } ``` **See also** - [Use an MCP server's tools](https://docs.kindgi.com/v0.4.0/guides/tools/mcp-servers.md) - [Kindgi 0.1.8](https://docs.kindgi.com/v0.4.0/releases/0.1.8.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `invalid-provider` **Synopsis** `400 Bad Request`, code `invalid-provider` The provider's metadata is invalid, for example an empty id, an empty region, no models, or a field the metadata or a model doesn't take (a misspelled one). The message says which. **Details** - `reason`: short code for the problem, such as empty-id, empty-region or unknown-model-field - `providerId`: the provider id; present on a registry refusal **Example** ```json excerpt { "error": { "code": "invalid-provider", "message": "…", "details": { "reason": "…", "providerId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/providersregister.md) ### `invalid-provider-config` **Synopsis** `400 Bad Request`, code `invalid-provider-config` The identity provider body is invalid: a field is missing, has the wrong type, isn't a valid URL, is a plaintext secret, or can't be changed. The message names the field. **Details** None. **Example** ```json excerpt { "error": { "code": "invalid-provider-config", "message": "…", "requestId": "…" } } ``` **See also** - [Set up SSO](https://docs.kindgi.com/v0.4.0/guides/sso.md) ### `invalid-schema` **Synopsis** `400 Bad Request`, code `invalid-schema` A tool's input or output schema isn't a valid JSON Schema. Defining the tool in code raises this code; the API answers `validation-failed`, with the issue's path `/input` or `/output`. **Details** - `issues`: each problem: its path and what is wrong **Example** ```json excerpt { "error": { "code": "invalid-schema", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) ### `invalid-tool-definition` **Synopsis** `400 Bad Request`, code `invalid-tool-definition` A tool manifest breaks the rules, for example a missing or inexact `version`, or both or neither of `handler` and `spec`. Defining it in code raises this code; the API answers `validation-failed`, with each issue in `details.issues`. **Details** - `issues`: each problem: its path and what is wrong **Example** ```json excerpt { "error": { "code": "invalid-tool-definition", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [Wait for another system's answer](https://docs.kindgi.com/v0.4.0/guides/tools/wait-for-another-system.md) - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) ### `item-not-found` **Synopsis** `400 Bad Request`, code `item-not-found` The pointer in `item` resolves to nothing in the run's output. Fix the pointer. **Details** None. **Example** ```json excerpt { "error": { "code": "item-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/test-set/cases`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentstestsetaddcase.md) - [`POST /v1/corrections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctionscreate.md) ### `kind-not-applied` **Synopsis** `400 Bad Request`, code `kind-not-applied` You publish a policy of a kind this runtime doesn't enforce, so publishing it would change nothing. Publish one of the kinds listed in `details.appliedKinds`. **Details** - `kind`: the policy kind you sent - `appliedKinds`: the policy kinds this runtime applies **Example** ```json excerpt { "error": { "code": "kind-not-applied", "message": "…", "details": { "kind": "…", "appliedKinds": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/policies`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiespublish.md) ### `limited-session-not-refreshable` **Synopsis** `400 Bad Request`, code `limited-session-not-refreshable` `POST /v1/auth/refresh` was called with a session limited to a project or a role. Such a session isn't refreshed, so no copy of it can come back without its limits. Get a new one where you got this one. **Details** None. **Example** ```json excerpt { "error": { "code": "limited-session-not-refreshable", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/auth/refresh`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authrefresh.md) - [Let a store's staff ask and approve in WordPress](https://docs.kindgi.com/v0.4.0/sites/wordpress.md) ### `provider-key-refused` **Synopsis** `400 Bad Request`, code `provider-key-refused` The request names a model provider's key as a secret for something that isn't that provider, such as a tool, an MCP endpoint or a webhook endpoint. Store the key under its own name and use that name. **Details** - `secret`: name of the secret that is a model provider's key - `providerId`: id of the provider that owns that key **Example** ```json excerpt { "error": { "code": "provider-key-refused", "message": "…", "details": { "secret": "…", "providerId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) - [`POST /v1/tools/{toolId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsreinstateversion.md) - [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsregister.md) - [`POST /v1/webhooks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksregister.md) - [`PATCH /v1/webhooks/{triggerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksupdate.md) - [`POST /v1/webhook-endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookendpointscreate.md) - 3 more operations name it in their responses - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Use an MCP server's tools](https://docs.kindgi.com/v0.4.0/guides/tools/mcp-servers.md) ### `redirect-uri-mismatch` **Synopsis** `400 Bad Request`, code `redirect-uri-mismatch` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "redirect-uri-mismatch", "message": "…", "requestId": "…" } } ``` **See also** - [Sign in to the console](https://docs.kindgi.com/v0.4.0/guides/sso/sign-in.md) ### `redirect-uri-not-allowed` **Synopsis** `400 Bad Request`, code `redirect-uri-not-allowed` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "redirect-uri-not-allowed", "message": "…", "requestId": "…" } } ``` **See also** - [Sign in to the console](https://docs.kindgi.com/v0.4.0/guides/sso/sign-in.md) ### `reference-out-of-scope` **Synopsis** `400 Bad Request`, code `reference-out-of-scope` A request names an item its project can't reach: a tool, agent, flow, guardrail, data block, check or test set that isn't registered in the project, its org or the tenant, or a version of an agent, flow or test set that the project doesn't run, such as one made in an earlier environment and not yet promoted. Nothing is written. Register the item where the project reaches it, use it from the project that has it, or promote the version first. **Details** - `issues`: list of the references refused, each with the `path` it was named at, its `kind` and `id`, and a message **Example** ```json excerpt { "error": { "code": "reference-out-of-scope", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/agents`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspublish.md) - [`POST /v1/agents/{agentId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentsreinstateversion.md) - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/agents/{agentId}/pinned/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedcheck.md) - [`POST /v1/flows`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspublish.md) - 15 more operations name it in their responses - [Projects, packs and values](https://docs.kindgi.com/v0.4.0/concepts/projects-packs-values.md) - [Organize work by org and project](https://docs.kindgi.com/v0.4.0/guides/projects/organize-by-org-and-project.md) - [Use an MCP server's tools](https://docs.kindgi.com/v0.4.0/guides/tools/mcp-servers.md) ### `repo-connection-not-company-github` **Synopsis** `400 Bad Request`, code `repo-connection-not-company-github` The connection named for the project's repo connection isn't a company-wide GitHub connection. Pull requests for a project's block changes are opened through the company's GitHub connection: connect GitHub for the company, then name that connection. **Details** - `connectionId`: the connection named - `app`: the app entry it was made through - `owner`: who owns it: `member` or `company` **Example** ```json excerpt { "error": { "code": "repo-connection-not-company-github", "message": "…", "details": { "connectionId": "…", "app": "…", "owner": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/projects/{projectId}/repo-connection`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsrepoconnectionset.md) - [`PUT /v1/projects/{projectId}/repo-connection`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsrepoconnectionset.md) - [`GET /v1/connections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionslist.md) ### `reserved-name-prefix` **Synopsis** `400 Bad Request`, code `reserved-name-prefix` The name starts with `kindgi.`, the prefix reserved for the runtime's own secrets. You can't store, rotate or revoke such a secret, or name one in a registration: a tool, an MCP endpoint, a webhook endpoint, a webhook trigger or a connection app. **Details** - `secret`: on a registration, the reserved name it names **Example** ```json excerpt { "error": { "code": "reserved-name-prefix", "message": "…", "details": { "secret": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) - [`POST /v1/tools/{toolId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsreinstateversion.md) - [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsregister.md) - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantconfigupsert.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - 8 more operations name it in their responses - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) - [Kindgi 0.1.8](https://docs.kindgi.com/v0.4.0/releases/0.1.8.md) - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) ### `retention-over-limit` **Synopsis** `400 Bad Request`, code `retention-over-limit` The retention policy keeps its domain's records longer than this server's limit for that domain, or holds them (`graceSeconds: -1`). Publish it with a `graceSeconds` at or under the limit. A version over the limit stays retired: reinstating it is refused the same way. A `*` policy isn't refused: in a limited domain, the server keeps records no longer than the limit. **Details** - `domain`: the policy's retention domain - `graceSeconds`: the policy's grace, in seconds (`-1`: a hold) - `limitSeconds`: this server's limit for the domain, in seconds - `policyId`: the policy id (on a reinstate) - `version`: the version (on a reinstate) **Example** ```json excerpt { "error": { "code": "retention-over-limit", "message": "…", "details": { "domain": "…", "graceSeconds": "…", "limitSeconds": "…", "policyId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/policies`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiespublish.md) - [`POST /v1/policies/{policyId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiesreinstateversion.md) - [Keep and purge deleted data](https://docs.kindgi.com/v0.4.0/deploy/retention.md) ### `schema-validation-failed` **Synopsis** `400 Bad Request`, code `schema-validation-failed` The API doesn't send this code. A flow definition with this problem is answered `validation-failed`, with the problem in `details.issues`. **Details** None. **Example** ```json excerpt { "error": { "code": "schema-validation-failed", "message": "…", "requestId": "…" } } ``` **See also** - [`validation-failed`](https://docs.kindgi.com/v0.4.0/reference/errors.md#validation-failed) - [Write a flow](https://docs.kindgi.com/v0.4.0/guides/flows/write-a-flow.md) ### `scope-invalid` **Synopsis** `400 Bad Request`, code `scope-invalid` The scope you sent is malformed or unusable: `scopeKind` and `scopeId` don't fit together, `inherit` isn't true or false, or the org or project doesn't exist for your tenant. Fix the scope fields. **Details** - `projectId`: the project that wasn't found (MCP endpoint register only) - `orgId`: the org that wasn't found (MCP endpoint register only) **Example** ```json excerpt { "error": { "code": "scope-invalid", "message": "…", "details": { "projectId": "…", "orgId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/flows/{flowId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspinnedpin.md) - [`POST /v1/flows/{flowId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspinnedunpin.md) - [`POST /v1/tools/{toolId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedpin.md) - [`POST /v1/tools/{toolId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedunpin.md) - [`GET /v1/blocks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blockslist.md) ### `scope-kind-required` **Synopsis** `400 Bad Request`, code `scope-kind-required` A secrets or env request leaves out the scope: `scopeKind` is missing from the query, or the body's `scope` is missing or has a `kind` other than `tenant`, `org` or `project`. **Details** None. **Example** ```json excerpt { "error": { "code": "scope-kind-required", "message": "…", "requestId": "…" } } ``` **See also** - [`DELETE /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envdelete.md) - [`DELETE /v1/secrets/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrevoke.md) ### `scope-mismatch` **Synopsis** `400 Bad Request`, code `scope-mismatch` Two scopes in one request disagree: the body `scope` differs from the query `scopeKind`/`scopeId`, or the body `scope.tenantId` isn't your tenant. **Details** None. **Example** ```json excerpt { "error": { "code": "scope-mismatch", "message": "…", "requestId": "…" } } ``` **See also** - [`DELETE /v1/secrets/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrevoke.md) - [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envput.md) ### `secret-name-invalid` **Synopsis** `400 Bad Request`, code `secret-name-invalid` The name isn't one a new secret can have. A new secret's name is 1 to 255 ASCII letters, digits, `.`, `-` and `_`, starting with a letter, digit or `_`, not ending with `.` and with no two `.` in a row, and a secrets store can narrow that. Under `kindgi dev`, a secret is a key in your env files, so its name is capital letters, digits and underscores, not starting with a digit (`ACME_WOO_ORDERS`, not `acme-woo-orders`), and never `KINDGI_*`, the runtime's own configuration. The message says the rule, and under `kindgi dev` a name that works. **Details** None. **Example** ```json excerpt { "error": { "code": "secret-name-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantconfigupsert.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - [`POST /v1/webhooks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksregister.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) - [Kindgi 0.1.8](https://docs.kindgi.com/v0.4.0/releases/0.1.8.md) - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) ### `secret-value-invalid` **Synopsis** `400 Bad Request`, code `secret-value-invalid` The secrets store can't hold this value as given. Under `kindgi dev`, a secret is a key in your env files, and no env-file quoting holds a value that has a double quote, or a backslash followed by `n` or `r`, together with a carriage return or with both a single quote and a backtick. Store the value encoded (base64, say), or without one of those characters. The message says why, and never repeats the value. **Details** None. **Example** ```json excerpt { "error": { "code": "secret-value-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantconfigupsert.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) - [Kindgi 0.1.8](https://docs.kindgi.com/v0.4.0/releases/0.1.8.md) - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) ### `secret-value-too-large` **Synopsis** `400 Bad Request`, code `secret-value-too-large` The secret value is larger than the size limit the secrets store accepts. **Details** None. **Example** ```json excerpt { "error": { "code": "secret-value-too-large", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantconfigupsert.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrotate.md) - [Kindgi 0.1.8](https://docs.kindgi.com/v0.4.0/releases/0.1.8.md) - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) ### `signature-invalid` **Synopsis** `400 Bad Request`, code `signature-invalid` The deployment's signature isn't valid: it isn't base64, can't be verified, or doesn't match the signed envelope of image digest, version, index hash, tenant and publish time. A promotion checks the signature again, over the fields the deployment keeps, and is refused the same way. **Details** None. **Example** ```json excerpt { "error": { "code": "signature-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromotecheck.md) - [Start runs from WooCommerce, Drupal or any signed webhook](https://docs.kindgi.com/v0.4.0/guides/webhooks/start-runs-from-webhooks.md) ### `signing-key-algorithm-unsupported` **Synopsis** `400 Bad Request`, code `signing-key-algorithm-unsupported` The signing key uses an algorithm other than ed25519: a trust request names another `algorithm`, or a stored key can't be used to verify. **Details** - `algorithm`: the unsupported algorithm; present only when a stored key fails verification **Example** ```json excerpt { "error": { "code": "signing-key-algorithm-unsupported", "message": "…", "details": { "algorithm": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/signing-keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeysrevoke.md) ### `site-invalid` **Synopsis** `400 Bad Request`, code `site-invalid` A site's settings were refused. Registering one needs a `displayName`, an `origin` and an `approvalsUrl`, and a setting the API doesn't know is refused. An `origin` is `https://` with no path, query, fragment or credentials (`http://` only on a loopback host); an `approvalsUrl` is on that origin, with `{approvalId}` in it; `allowedRoles` holds 1 to 20 role names of up to 64 characters (a-z, 0-9, `_` and `-`); a `roleMap` names only roles in `allowedRoles`, and its reviewer roles are `standard` or `senior`, never above `reviewerCeiling`; a `displayName` is 1 to 100 characters, with no control, format or invisible characters; `peopleCap` is a whole number from 1 to 10,000, and `newPeoplePerDay` from 1 to 1,000. The message says the rule that was broken. **Details** - `field`: the setting that was refused **Example** ```json excerpt { "error": { "code": "site-invalid", "message": "…", "details": { "field": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/projects/{projectId}/sites`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesregister.md) - [`PATCH /v1/projects/{projectId}/sites/{siteId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesupdate.md) ### `site-key-invalid` **Synopsis** `400 Bad Request`, code `site-key-invalid` The key a site posts to `POST /v1/auth/sites/enroll` isn't an Ed25519 public JWK: `kty` `OKP`, `crv` `Ed25519`, `x` the 32-byte public key in base64url, and a `kid` of 1 to 64 letters, digits, `.`, `_` and `-`. A JWK with a private part (`d`) is refused too: post the public half only. The message says which part is wrong. **Details** None. **Example** ```json excerpt { "error": { "code": "site-key-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/auth/sites/enroll`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authsitesenroll.md) ### `tenant-slug-mismatch` **Synopsis** `400 Bad Request`, code `tenant-slug-mismatch` A purge's `confirm` isn't the tenant's slug, the second check on its id. Nothing was changed: send its slug, as `GET /v1/system/tenants/{tenantId}` gives it. **Details** - `tenantId`: the tenant **Example** ```json excerpt { "error": { "code": "tenant-slug-mismatch", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants/{tenantId}/purge`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantspurge.md) ### `token-sign-in-needs-an-api-token` **Synopsis** `400 Bad Request`, code `token-sign-in-needs-an-api-token` `POST /v1/auth/token-sign-in` was called while signed in by a session. It takes an API token in the Authorization header, so there's nothing to exchange. **Details** None. **Example** ```json excerpt { "error": { "code": "token-sign-in-needs-an-api-token", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authtokensignin.md) ### `tool-not-pinnable` **Synopsis** `400 Bad Request`, code `tool-not-pinnable` The tool follows its server (a tool an MCP endpoint's catalog lists: its metadata has the catalog's `kindgi.mcp` key) or the runtime (a tool the runtime ships), so a pin couldn't keep it still. Reference it with a version range instead. **Details** - `toolId`: the tool **Example** ```json excerpt { "error": { "code": "tool-not-pinnable", "message": "…", "details": { "toolId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools/{toolId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedpin.md) ### `trigger-invalid-config` **Synopsis** `400 Bad Request`, code `trigger-invalid-config` The trigger's schedule settings are invalid, for example a cron expression that doesn't parse or fires more often than the minimum interval. **Details** - `triggerId`: the trigger being updated (updates only) **Example** ```json excerpt { "error": { "code": "trigger-invalid-config", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/schedules/{triggerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesupdate.md) - [Run on a schedule](https://docs.kindgi.com/v0.4.0/guides/runs/run-on-a-schedule.md) ### `unknown-effect` **Synopsis** `400 Bad Request`, code `unknown-effect` A tool declares an effect kind that isn't supported. Defining the tool in code raises this code; the API answers `validation-failed`, with the issue in `details.issues`. **Details** None. **Example** ```json excerpt { "error": { "code": "unknown-effect", "message": "…", "requestId": "…" } } ``` **See also** - [`validation-failed`](https://docs.kindgi.com/v0.4.0/reference/errors.md#validation-failed) - [Write a tool](https://docs.kindgi.com/v0.4.0/guides/tools/write-a-tool.md) ### `unknown-field` **Synopsis** `400 Bad Request`, code `unknown-field` The request body has a field the endpoint doesn't accept. The message names the field; remove it and resend. **Details** None. **Example** ```json excerpt { "error": { "code": "unknown-field", "message": "…", "requestId": "…" } } ``` **See also** - [`PATCH /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsupdate.md) - [`PATCH /v1/tenant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantupdate.md) - [Use an MCP server's tools](https://docs.kindgi.com/v0.4.0/guides/tools/mcp-servers.md) - [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmintpublic.md) - [`POST /v1/webhook-endpoints/{endpointId}/test`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookendpointssendtest.md) ### `unresolved-guardrail` **Synopsis** `400 Bad Request`, code `unresolved-guardrail` An agent names a guardrail that isn't registered, so its turn can't start. Register the missing guardrails or remove them from the agent. **Details** - `guardrailIds`: the guardrail ids that aren't registered - `runId`: the run the turn belongs to, when it has one **Example** ```json excerpt { "error": { "code": "unresolved-guardrail", "message": "…", "details": { "guardrailIds": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Configure a guardrail](https://docs.kindgi.com/v0.4.0/guides/guardrails/configure-a-guardrail.md) ### `unresolved-tool` **Synopsis** `400 Bad Request`, code `unresolved-tool` An agent's turn needs a tool that isn't registered: the agent declares a tool the project doesn't have, or the model asks for a tool the agent doesn't declare. Register the tool or fix the agent definition. **Details** - `toolId`: the tool that couldn't be resolved - `runId`: the run the turn belongs to, when it has one **Example** ```json excerpt { "error": { "code": "unresolved-tool", "message": "…", "details": { "toolId": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) ### `validation-failed` **Synopsis** `400 Bad Request`, code `validation-failed` The request body is well-formed JSON but fails validation, for example an agent, flow, tool, policy or test set definition that breaks the rules, or a version pin that can't be resolved. Fix the entries in `details.issues` and resend. **Details** - `issues`: list of problems, each with a path to the offending field and a message **Example** ```json excerpt { "error": { "code": "validation-failed", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) - [`POST /v1/suggested-changes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescreate.md) - [`POST /v1/blocks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blockspublish.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [Suggest a change, and test it](https://docs.kindgi.com/v0.4.0/guides/improve/suggest-a-change.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `wait-token-output-invalid` **Synopsis** `400 Bad Request`, code `wait-token-output-invalid` The answer doesn't fit the output schema of the tool that waits for it. Nothing is taken and the wait stays open: fix the answer and send it again before the wait times out. **Details** - `issues`: list of problems, each with a path to the offending field and a message **Example** ```json excerpt { "error": { "code": "wait-token-output-invalid", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) - [`POST /v1/wait-tokens/{token}/complete`](https://docs.kindgi.com/v0.4.0/reference/api/operations/waittokenscomplete.md) ### `webhook-body-not-json` **Synopsis** `400 Bad Request`, code `webhook-body-not-json` The request says its content type is JSON, but the body doesn't parse as JSON. **Details** None. **Example** ```json excerpt { "error": { "code": "webhook-body-not-json", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/hooksreceive.md) ### `webhook-secret-not-found` **Synopsis** `400 Bad Request`, code `webhook-secret-not-found` The secret the endpoint references doesn't exist. Store the secret first, then register the endpoint. **Details** - `secretRef`: the secret reference that was not found (name and environment) **Example** ```json excerpt { "error": { "code": "webhook-secret-not-found", "message": "…", "details": { "secretRef": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/webhook-endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookendpointscreate.md) ### `webhook-secret-too-weak` **Synopsis** `400 Bad Request`, code `webhook-secret-too-weak` The signing secret is too weak: it must be `whsec_` followed by base64 of at least 24 random bytes. `POST /v1/webhook-endpoints/generate-secret` makes a valid one. **Details** - `secretRef`: the secret reference that was too weak (name and environment) **Example** ```json excerpt { "error": { "code": "webhook-secret-too-weak", "message": "…", "details": { "secretRef": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/webhook-endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookendpointscreate.md) ### `webhook-url-refused` **Synopsis** `400 Bad Request`, code `webhook-url-refused` The deployment refuses the endpoint URL, for example because of where it points. The message says why. **Details** - `reason`: why the URL was refused **Example** ```json excerpt { "error": { "code": "webhook-url-refused", "message": "…", "details": { "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/webhook-endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookendpointscreate.md) - [`PATCH /v1/webhook-endpoints/{endpointId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookendpointsupdate.md) ## 401 Unauthorized ### `auth-expired` **Synopsis** `401 Unauthorized`, code `auth-expired` Your API key or public run token has expired. Use a new one; an expired console session answers `session-expired` instead. **Details** None. **Example** ```json excerpt { "error": { "code": "auth-expired", "message": "…", "requestId": "…" } } ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.4.0/deploy/people-and-keys.md) - [`session-expired`](https://docs.kindgi.com/v0.4.0/reference/errors.md#session-expired) ### `auth-missing` **Synopsis** `401 Unauthorized`, code `auth-missing` The request has no usable credentials: the Authorization header is absent or not `Bearer `, or the token isn't recognised. Send a valid API key or session token. **Details** None. **Example** ```json excerpt { "error": { "code": "auth-missing", "message": "…", "requestId": "…" } } ``` **See also** - [People, API keys and service accounts](https://docs.kindgi.com/v0.4.0/deploy/people-and-keys.md) ### `auth-revoked` **Synopsis** `401 Unauthorized`, code `auth-revoked` The API key you used has been revoked. Use another key. Also sent when a console session was opened with a key that has since been revoked: sign in again. **Details** None. **Example** ```json excerpt { "error": { "code": "auth-revoked", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tokens/{tokenId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensrevoke.md) ### `refresh-token-invalid` **Synopsis** `401 Unauthorized`, code `refresh-token-invalid` The session token was rotated by a refresh and is no longer valid. Retry with the fresh token from the last refresh. **Details** None. **Example** ```json excerpt { "error": { "code": "refresh-token-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [Sessions](https://docs.kindgi.com/v0.4.0/guides/sso/sessions.md) ### `session-expired` **Synopsis** `401 Unauthorized`, code `session-expired` A session token's absolute lifetime has ended. Sign in again to get a new session. **Details** None. **Example** ```json excerpt { "error": { "code": "session-expired", "message": "…", "requestId": "…" } } ``` **See also** - [Sessions](https://docs.kindgi.com/v0.4.0/guides/sso/sessions.md) ### `session-inactive` **Synopsis** `401 Unauthorized`, code `session-inactive` A session token has been idle longer than the deployment's inactivity timeout, so it's refused. Sign in again. **Details** None. **Example** ```json excerpt { "error": { "code": "session-inactive", "message": "…", "requestId": "…" } } ``` **See also** - [Sessions](https://docs.kindgi.com/v0.4.0/guides/sso/sessions.md) ### `site-enrollment-refused` **Synopsis** `401 Unauthorized`, code `site-enrollment-refused` `POST /v1/auth/sites/enroll` was refused: the enrollment code is wrong, used or expired, or its site is paused or unregistered. Each of these gets the same answer. Ask a tenant admin for a new enrollment code. **Details** None. **Example** ```json excerpt { "error": { "code": "site-enrollment-refused", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/auth/sites/enroll`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authsitesenroll.md) ### `site-sign-in-refused` **Synopsis** `401 Unauthorized`, code `site-sign-in-refused` `POST /v1/auth/site-sign-in` refused the site's statement about a person. Until the statement's signature checks out, every refusal has the reason `not-verified`, so a caller learns nothing about the site. After it, the reason is the check that refused it: `site-paused`, `site-not-vouching`, `wrong-audience`, `expired`, `issued-in-the-future`, `too-long-lived`, `replayed`, `role-not-allowed`, `person-removed` or `people-cap`. **Details** - `reason`: why: `not-verified` until the statement's signature checks out, then the check that refused it **Example** ```json excerpt { "error": { "code": "site-sign-in-refused", "message": "…", "details": { "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/auth/site-sign-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authsitesignin.md) - [Let a store's staff ask and approve in WordPress](https://docs.kindgi.com/v0.4.0/sites/wordpress.md) ### `webhook-refused` **Synopsis** `401 Unauthorized`, code `webhook-refused` The inbound webhook request doesn't prove who sent it: an unknown address, a missing, wrong or too old signature, or a secret that can't be read. The answer is the same for every reason; the reason is in the trigger's fires and the access audit. **Details** None. **Example** ```json excerpt { "error": { "code": "webhook-refused", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/hooksreceive.md) ## 403 Forbidden ### `authz-denied` **Synopsis** `403 Forbidden`, code `authz-denied` The API doesn't send this code. A refused action is answered `permission-denied`. **Details** None. **Example** ```json excerpt { "error": { "code": "authz-denied", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsregister.md) ### `capability-not-mintable` **Synopsis** `403 Forbidden`, code `capability-not-mintable` A tenant's key can't carry a system capability (`system:*`, or `kindgi:system` on a runtime serving many tenants): those are system keys' alone. Mint the key without them, or mint a system key with `POST /v1/system/keys`. **Details** - `capabilities`: the capabilities asked for that a tenant's key can't carry - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "capability-not-mintable", "message": "…", "details": { "capabilities": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) ### `cloud-secret-system-only` **Synopsis** `403 Forbidden`, code `cloud-secret-system-only` A tenant's own key tried to set an env name to a cloud secret, on a runtime that keeps them: only the operator does, with a system key holding `system:env-refs`. Set a value or a secret instead, or ask the operator. A runtime that keeps none answers `cloud-secrets-unsupported` instead. **Details** None. **Example** ```json excerpt { "error": { "code": "cloud-secret-system-only", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envput.md) - [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envput.md) - [`PUT /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvsetcloudsecret.md) ### `connection-installation-unreachable` **Synopsis** `403 Forbidden`, code `connection-installation-unreachable` A GitHub App's connect whose person's GitHub account doesn't reach the installation, or any installation of the app. Start that request again with `newInstallation` to install the app on an account they manage, or ask an owner of the account it's installed on. **Details** - `connectRequestId`: the connect request to start again **Example** ```json excerpt { "error": { "code": "connection-installation-unreachable", "message": "…", "details": { "connectRequestId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) - [GitHub](https://docs.kindgi.com/v0.4.0/guides/connections/github.md) ### `connection-not-yours` **Synopsis** `403 Forbidden`, code `connection-not-yours` Finishing a connect that someone else started: only whoever started it can finish it, signed in as themselves. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-not-yours", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) - [GitHub](https://docs.kindgi.com/v0.4.0/guides/connections/github.md) ### `corrector-group-not-allowed` **Synopsis** `403 Forbidden`, code `corrector-group-not-allowed` The corrector group limits who may assert it, and your key or role isn't one of them, so you can't record a correction as that class. **Details** - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "corrector-group-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/corrections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctionscreate.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) ### `csrf-origin-mismatch` **Synopsis** `403 Forbidden`, code `csrf-origin-mismatch` A request authenticated by the console session cookie came from an origin the deployment doesn't allow, or carried no Origin header. Use the console at its own address, or an API key. **Details** None. **Example** ```json excerpt { "error": { "code": "csrf-origin-mismatch", "message": "…", "requestId": "…" } } ``` **See also** - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) ### `host-access-denied` **Synopsis** `403 Forbidden`, code `host-access-denied` The deployment doesn't let tenant configuration reach its host, so a `stdio` MCP endpoint (a command on the host) is refused. Use an HTTP endpoint instead, or ask whoever runs the deployment. **Details** - `action`: the action that was refused - `resource`: the resource it was refused on, as type:id - `reason`: why the check refused it **Example** ```json excerpt { "error": { "code": "host-access-denied", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsregister.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) - [Use an MCP server's tools](https://docs.kindgi.com/v0.4.0/guides/tools/mcp-servers.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) ### `identity-providers-operator-managed` **Synopsis** `403 Forbidden`, code `identity-providers-operator-managed` The deployment's operator manages sign-in, so changing identity providers needs the deployment's own token; a tenant admin's key is refused. **Details** None. **Example** ```json excerpt { "error": { "code": "identity-providers-operator-managed", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/auth/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authprovidersregister.md) - [`PATCH /v1/auth/providers/{providerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authprovidersupdate.md) - [`POST /v1/auth/providers/{providerId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authprovidersunregister.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) ### `insufficient-role` **Synopsis** `403 Forbidden`, code `insufficient-role` The reviewer's role ranks below the tier the approval requires, so it can't decide it. Ask a reviewer of a higher role, or escalate. **Details** - `reviewerId`: the reviewer - `reviewerRole`: the reviewer's role - `requiredRole`: the role the approval needs **Example** ```json excerpt { "error": { "code": "insufficient-role", "message": "…", "details": { "reviewerId": "…", "reviewerRole": "…", "requiredRole": "…" }, "requestId": "…" } } ``` **See also** - [Decide an approval](https://docs.kindgi.com/v0.4.0/guides/approvals/decide-an-approval.md) ### `key-project-mismatch` **Synopsis** `403 Forbidden`, code `key-project-mismatch` Your key is limited to one project, and the request names another project, or asks to mint a key not limited to your project. Use the project the key is limited to. A promotion reads one project and writes another, so a key or session limited to a project can't promote, or check a promotion. **Details** - `keyProjectId`: the project your key is limited to - `projectId`: the project the request names - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "key-project-mismatch", "message": "…", "details": { "keyProjectId": "…", "projectId": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`POST /v1/artifacts`](https://docs.kindgi.com/v0.4.0/reference/api/operations/artifactsupload.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromotecheck.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) ### `license-operator-only` **Synopsis** `403 Forbidden`, code `license-operator-only` `GET /v1/license` and `GET /v1/license/usage` are for the deployment's own token, or a system key holding `system:license`. Where the deployment is set up to serve one tenant (without `KINDGI_TENANCY=multi`) and its database holds only that one, that tenant's admins also read the license's countdown, never its use. Other callers are refused, and the refusal recorded. **Details** None. **Example** ```json excerpt { "error": { "code": "license-operator-only", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/license`](https://docs.kindgi.com/v0.4.0/reference/api/operations/licenseget.md) - [`GET /v1/license/usage`](https://docs.kindgi.com/v0.4.0/reference/api/operations/licenseusage.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) - [Kindgi 0.3.0](https://docs.kindgi.com/v0.4.0/releases/0.3.0.md) ### `limited-session-cannot-mint` **Synopsis** `403 Forbidden`, code `limited-session-cannot-mint` `POST /v1/tokens` was called by a session limited to a project or a role. A limited session mints no keys: a key would outlive whatever ends the session. Mint the key with an API key, or with a session that isn't limited. **Details** - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "limited-session-cannot-mint", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [Let a store's staff ask and approve in WordPress](https://docs.kindgi.com/v0.4.0/sites/wordpress.md) ### `named-approver-required` **Synopsis** `403 Forbidden`, code `named-approver-required` The approval is addressed to one person: the call it gates acts with that person's own connection, so only they decide it. You can read it, but not decide it. **Details** - `approvalId`: the approval only its approver decides **Example** ```json excerpt { "error": { "code": "named-approver-required", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } } ``` **See also** - [Use a connection in a tool](https://docs.kindgi.com/v0.4.0/guides/connections/use-a-connection.md) - [Decide an approval](https://docs.kindgi.com/v0.4.0/guides/approvals/decide-an-approval.md) ### `participant-not-allowed` **Synopsis** `403 Forbidden`, code `participant-not-allowed` A turn would run as a participant, and you may not read that participant's memory. A turn reads and keeps its participant's memory, so running as one takes what the memory API takes: you're the participant yourself (that user, with their session or their own API key, never a service account's key), or you hold `write` on the turn's project. When the turn's project isn't known, only the participant may. It's checked wherever a turn gets a participant: `input.participantId` on `POST /v1/runs`, `participantId` on `POST /v1/conversations`, and a conversation's own participant when you post a turn into it, whatever the body names. Into a conversation you can't read, the refusal answers `404 conversation-not-found` instead. Nothing was started or opened. Use a key or role with `write` on the turn's project, or have the participant run it. **Details** - `action`: the action that was refused: `write` - `resource`: what it was refused on, as type:id: `conversation:` when you posted into a conversation (never its participant or project), else `project:`, the turn's project, or `tenant:` when that isn't known - `reason`: why it was refused; when you posted into a conversation, it names neither the conversation's participant nor its project **Example** ```json excerpt { "error": { "code": "participant-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/conversations`](https://docs.kindgi.com/v0.4.0/reference/api/operations/conversationsopen.md) ### `permission-denied` **Synopsis** `403 Forbidden`, code `permission-denied` Your key or session isn't allowed to do this on this resource, or lacks a capability the route needs, which the message names. For a permission, ask an admin for it. A key carries only the capabilities it was made with, and only ones the person who made it holds: use a key made with that capability. **Details** - `action`: the action that was refused - `resource`: the resource it was refused on, as type:id - `reason`: why the check refused it **Example** ```json excerpt { "error": { "code": "permission-denied", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/signing-keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeystrust.md) - [`GET /v1/signing-keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeyslist.md) - [`GET /v1/signing-keys/{keyId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeysget.md) - [`POST /v1/signing-keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeysrevoke.md) - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - 77 more operations name it in their responses - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) - [Memory reference](https://docs.kindgi.com/v0.4.0/guides/agents/memory-reference.md) - [Approvals reference](https://docs.kindgi.com/v0.4.0/guides/approvals/approvals-reference.md) ### `production-limit-reached` **Synopsis** `403 Forbidden`, code `production-limit-reached` You put a project in production while the tenant already had as many projects in production as its limit allows, or more (`projectsInProduction`, set by whoever runs the server). Nothing changed. A project already in production isn't counted again, and taking one out is never refused. Take a project out of production, or go where `details.next` says when the server names a place, or ask whoever runs it to raise the limit; then put the project in production again. **Details** - `projectId`: the project that wasn't put in production - `limit`: which limit: `projects-in-production` - `projectsInProduction`: the tenant's limit on projects in production - `inProduction`: how many of the tenant's projects are in production; over the limit when the limit was lowered below it - `next`: where to go for a higher limit, for example a billing page (`KINDGI_PRODUCTION_NEXT_URL`); absent when the server names none **Example** ```json excerpt { "error": { "code": "production-limit-reached", "message": "…", "details": { "projectId": "…", "limit": "…", "projectsInProduction": "…", "inProduction": "…", "next": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/projects/{projectId}/production`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsproductionset.md) ### `production-not-allowed` **Synopsis** `403 Forbidden`, code `production-not-allowed` You put a project in production while the tenant isn't allowed to: the server gates production (`KINDGI_PRODUCTION_GATE=on`), and the tenant's `productionAllowed` is `false`. Projects already in production stay so, and staging keeps working. Go where `details.next` says, when the server names a place, or ask whoever runs it; then put the project in production again. **Details** - `projectId`: the project that wasn't put in production - `next`: where to go to be allowed, for example a billing page (`KINDGI_PRODUCTION_NEXT_URL`); absent when the server names none **Example** ```json excerpt { "error": { "code": "production-not-allowed", "message": "…", "details": { "projectId": "…", "next": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/projects/{projectId}/production`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsproductionset.md) ### `role-exceeds-principal` **Synopsis** `403 Forbidden`, code `role-exceeds-principal` An admin key was requested for a principal that isn't a tenant admin. Mint a member key instead. **Details** None. **Example** ```json excerpt { "error": { "code": "role-exceeds-principal", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) ### `second-factor-invalid` **Synopsis** `403 Forbidden`, code `second-factor-invalid` The code from the authenticator app, or the recovery code, isn't right: try the code the app shows now. Replacing a second factor that's set up takes a code from it. Too many wrong codes lock it for a while (`second-factor-locked`). **Details** None. **Example** ```json excerpt { "error": { "code": "second-factor-invalid", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/identity/me/second-factor`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymestartsecondfactor.md) - [`POST /v1/identity/me/second-factor/confirm`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeconfirmsecondfactor.md) - [`POST /v1/identity/me/second-factor/recovery-codes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymenewrecoverycodes.md) - [`POST /v1/identity/me/second-factor/remove`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeremovesecondfactor.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ### `second-factor-required` **Synopsis** `403 Forbidden`, code `second-factor-required` The workspace requires a second factor at sign-in. Signing in to the console with an API token is refused, since a token can't give one: sign in another way, with your second factor. Taking your own second factor off is refused too: replace it (`POST /v1/identity/me/second-factor` with a code), or ask a tenant admin to remove it. **Details** - `action`: the action that was refused (token sign-in only) - `resource`: the resource it was refused on, as type:id (token sign-in only) - `reason`: why the check refused it (token sign-in only) **Example** ```json excerpt { "error": { "code": "second-factor-required", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authtokensignin.md) - [`POST /v1/identity/me/second-factor/remove`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeremovesecondfactor.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ### `second-factor-unusable` **Synopsis** `403 Forbidden`, code `second-factor-unusable` The person's authenticator key can't be opened any more: the deployment's sign-in secret changed, and the previous one isn't configured. A recovery code still works, and so does setting the second factor up again with one; otherwise a tenant admin removes it. **Details** None. **Example** ```json excerpt { "error": { "code": "second-factor-unusable", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/identity/me/second-factor`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymestartsecondfactor.md) - [`POST /v1/identity/me/second-factor/recovery-codes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymenewrecoverycodes.md) - [`POST /v1/identity/me/second-factor/remove`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeremovesecondfactor.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ### `separate-approver-required` **Synopsis** `403 Forbidden`, code `separate-approver-required` The approval requires a different person from the one who requested it, and you asked for it. Ask another reviewer to approve. **Details** - `approvalId`: the approval that needs another approver **Example** ```json excerpt { "error": { "code": "separate-approver-required", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } } ``` **See also** - [Decide an approval](https://docs.kindgi.com/v0.4.0/guides/approvals/decide-an-approval.md) ### `signer-not-trusted` **Synopsis** `403 Forbidden`, code `signer-not-trusted` The key that signed the deployment isn't on the tenant's trust list. Trust the key, then deploy again. A promotion is refused the same way when the key that signed the build is no longer trusted: the build isn't promoted. **Details** - `signerKeyId`: id of the signing key that isn't trusted **Example** ```json excerpt { "error": { "code": "signer-not-trusted", "message": "…", "details": { "signerKeyId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromotecheck.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) - [Deploy your agent to Kindgi Cloud](https://docs.kindgi.com/v0.4.0/hosted/deploy-your-agent.md) ### `site-person-grants-managed` **Synopsis** `403 Forbidden`, code `site-person-grants-managed` The request would change what a person a site signs in may do: give them or take away a grant, a tenant role, a project or team membership or its role, or a reviewer role, or mint them a key. Such a person holds only what their site's sign-in writes: their next sign-in would undo a change, and a key would outlive a paused or unregistered site. Change their role on the site, remove the person, or pause the site instead. **Details** None. **Example** ```json excerpt { "error": { "code": "site-person-grants-managed", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`POST /v1/approvals/reviewers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalsreviewersregister.md) - [`POST /v1/approvals/reviewers/{reviewerId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalsreviewersunregister.md) - [`POST /v1/identity/users/{userId}/grant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersgrant.md) - [`POST /v1/teams/{teamId}/memberships`](https://docs.kindgi.com/v0.4.0/reference/api/operations/teamsmembershipsadd.md) - [`DELETE /v1/teams/{teamId}/memberships/{userId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/teamsmembershipsremove.md) - 4 more operations name it in their responses - [Let a store's staff ask and approve in WordPress](https://docs.kindgi.com/v0.4.0/sites/wordpress.md) ### `system-key-expiry-required` **Synopsis** `403 Forbidden`, code `system-key-expiry-required` A full system key minted by another system key must expire: set `expiresAt`. Only the deployment's own token mints one that never expires. **Details** None. **Example** ```json excerpt { "error": { "code": "system-key-expiry-required", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) ### `system-key-on-tenant-route` **Synopsis** `403 Forbidden`, code `system-key-on-tenant-route` A system key was sent to a route it can't use. A system key acts in no tenant, so it reaches `/v1/system/*`, `GET /v1/license` and `GET /v1/license/usage` only: use one of the tenant's keys. **Details** - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "system-key-on-tenant-route", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [`GET /v1/system/whoami`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeyswhoami.md) ### `system-key-scope-not-served` **Synopsis** `403 Forbidden`, code `system-key-scope-not-served` The runtime serves one tenant, where a system key holds `system:license`, or with a pack service per deployment also `system:deployments` and `system:pack-env`, and this key holds anything else, which `scopes` names (`served` lists what it may hold): it was minted while the runtime served many tenants, say. It's refused on every route. Mint one holding what it needs of `served` with the deployment's own token, and revoke this one. **Details** - `scopes`: the scopes the key holds - `served`: the scopes a system key may hold on this runtime - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "system-key-scope-not-served", "message": "…", "details": { "scopes": "…", "served": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) - [`GET /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeyslist.md) - [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysrevoke.md) - [`GET /v1/system/whoami`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeyswhoami.md) - [`GET /v1/license`](https://docs.kindgi.com/v0.4.0/reference/api/operations/licenseget.md) - [`GET /v1/license/usage`](https://docs.kindgi.com/v0.4.0/reference/api/operations/licenseusage.md) - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) - [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysrevoke.md) ### `system-principal-required` **Synopsis** `403 Forbidden`, code `system-principal-required` The route is a system route (`/v1/system/*`), and it was called with a tenant's key or a session. Call it with a system key (`kgi_sy_…`). **Details** - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "system-principal-required", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) - [`GET /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeyslist.md) - [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysrevoke.md) - [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantscreate.md) - [`GET /v1/system/tenants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantslist.md) - [`GET /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsget.md) - 25 more operations name it in their responses ### `system-scope-missing` **Synopsis** `403 Forbidden`, code `system-scope-missing` The system key doesn't hold the scope this request takes, which `scope` names: the route's own, or more for what the request asks (creating a tenant without `firstAdmin`, for one). Every `/v1/system/keys` route takes the full system capability, which a scoped key doesn't hold. A deployment's secret values (`secrets=values` on its pack env) take a key holding `system:pack-env` itself: `kindgi:system` doesn't stand in for it. On a runtime serving one tenant, a system key reaches no `/v1/system/*` route, and `scope` is `kindgi:system`: the system keys take the deployment's own token there. With a pack service per deployment (`KINDGI_PACK_ROUTING=per-deployment`), a key holding `system:deployments` or `system:pack-env` reaches the routes a pack service orchestrator calls there, and no other. **Details** - `scope`: the scope the request takes - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "system-scope-missing", "message": "…", "details": { "scope": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) - [`GET /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeyslist.md) - [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysrevoke.md) - [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantscreate.md) - [`GET /v1/system/tenants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantslist.md) - [`GET /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsget.md) - 25 more operations name it in their responses ### `token-expiry-exceeds-minter` **Synopsis** `403 Forbidden`, code `token-expiry-exceeds-minter` The new key would outlive the key minting it. Give it an `expiresAt` no later than the minting key's expiry. **Details** - `latestExpiresAt`: the latest expiry the new key may have - `action`: the action that was refused - `resource`: the resource it was refused on - `reason`: why the caller was refused **Example** ```json excerpt { "error": { "code": "token-expiry-exceeds-minter", "message": "…", "details": { "latestExpiresAt": "…", "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) ### `token-sign-in-not-allowed` **Synopsis** `403 Forbidden`, code `token-sign-in-not-allowed` The key can't open a console session: it belongs to a service account, or it is narrowed to a member role or one project. Use a full key of a person, or the identity provider. **Details** - `action`: the action that was refused - `resource`: the resource it was refused on, as type:id - `reason`: why the check refused it **Example** ```json excerpt { "error": { "code": "token-sign-in-not-allowed", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authtokensignin.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ### `token-sign-in-off` **Synopsis** `403 Forbidden`, code `token-sign-in-off` This deployment doesn't allow signing in to the console with an API token. Sign in with the organization's identity provider, or ask whoever runs the deployment to allow it. **Details** - `action`: the action that was refused - `resource`: the resource it was refused on, as type:id - `reason`: why the check refused it **Example** ```json excerpt { "error": { "code": "token-sign-in-off", "message": "…", "details": { "action": "…", "resource": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authtokensignin.md) - [Run with authorization](https://docs.kindgi.com/v0.4.0/deploy/authorization.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ## 404 Not Found ### `adapter-not-found` **Synopsis** `404 Not Found`, code `adapter-not-found` No adapter is registered with that id in the tenant. **Details** - `adapterId`: the adapter id that was looked up **Example** ```json excerpt { "error": { "code": "adapter-not-found", "message": "…", "details": { "adapterId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/adapters/{adapterId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/adaptersget.md) ### `agent-not-found` **Synopsis** `404 Not Found`, code `agent-not-found` The agent, or the agent version, doesn't exist in the project, or your key can't see it. Check the id and version; for a run, the agent version the run started with may have been removed. **Details** - `agentId`: the agent id - `version`: the version asked for, when one was named **Example** ```json excerpt { "error": { "code": "agent-not-found", "message": "…", "details": { "agentId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/agents/{agentId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentssetowner.md) - [`GET /v1/agents/{agentId}/test-set`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentstestsetget.md) - [`GET /v1/agents/{agentId}/test-set/cases`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentstestsetlistcases.md) ### `agent-version-not-found` **Synopsis** `404 Not Found`, code `agent-version-not-found` The agent has no active version with that number: it was never registered or has since been unregistered. Pick a version from the agent's version list. **Details** None. **Example** ```json excerpt { "error": { "code": "agent-version-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/suggested-changes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescreate.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescheck.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/add-as-latest`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangesaddaslatest.md) ### `approval-not-found` **Synopsis** `404 Not Found`, code `approval-not-found` No approval with this id exists, or your role can't see it. **Details** - `approvalId`: the approval id **Example** ```json excerpt { "error": { "code": "approval-not-found", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/approvals/{approvalId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalsget.md) - [`POST /v1/approvals/{approvalId}/complete`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalscomplete.md) ### `audit-bundle-not-found` **Synopsis** `404 Not Found`, code `audit-bundle-not-found` The API doesn't send this code. The audit bundle of an approval that doesn't exist is answered `approval-not-found`. **Details** None. **Example** ```json excerpt { "error": { "code": "audit-bundle-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`approval-not-found`](https://docs.kindgi.com/v0.4.0/reference/errors.md#approval-not-found) - [Decide an approval](https://docs.kindgi.com/v0.4.0/guides/approvals/decide-an-approval.md) ### `blob-not-found` **Synopsis** `404 Not Found`, code `blob-not-found` No artifact with that id exists in the tenant, or it's in a project your key can't read. **Details** - `blobId`: the artifact id that was looked up **Example** ```json excerpt { "error": { "code": "blob-not-found", "message": "…", "details": { "blobId": "…" }, "requestId": "…" } } ``` **See also** - [`DELETE /v1/artifacts/{blobId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/artifactsdelete.md) ### `block-not-found` **Synopsis** `404 Not Found`, code `block-not-found` No block exists with that id (or that version), or it's in a project your key can't read. **Details** - `blockId`: the block id - `version`: the version looked up; present only when a version was requested **Example** ```json excerpt { "error": { "code": "block-not-found", "message": "…", "details": { "blockId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/blocks/{blockId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blocksget.md) - [`GET /v1/blocks/{blockId}/versions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blocksversionslist.md) - [`GET /v1/blocks/{blockId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blocksversionsget.md) - [`GET /v1/blocks/{blockId}/runs-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blocksrunsin.md) - [`POST /v1/blocks/{blockId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blocksversionsunregister.md) - [`POST /v1/blocks/{blockId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blocksversionsreinstate.md) ### `capability-not-found` **Synopsis** `404 Not Found`, code `capability-not-found` No capability is registered with that id in the tenant. **Details** - `capabilityId`: the capability id that was looked up **Example** ```json excerpt { "error": { "code": "capability-not-found", "message": "…", "details": { "capabilityId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/capabilities/{capabilityId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/capabilitiesget.md) ### `compliance-evidence-not-found` **Synopsis** `404 Not Found`, code `compliance-evidence-not-found` No exportable compliance evidence record with that id exists under the tenant. **Details** - `evidenceId`: the evidence id that wasn't found **Example** ```json excerpt { "error": { "code": "compliance-evidence-not-found", "message": "…", "details": { "evidenceId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/compliance/evidence/{evidenceId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/complianceevidenceget.md) ### `connection-app-not-found` **Synopsis** `404 Not Found`, code `connection-app-not-found` No app registration with that id in the tenant, or it was removed. On a connect, no registration of the app is set up, or none serves the project: a tenant admin adds one. A connect request whose registration has been removed since answers it too: start a new connect once a tenant admin sets the app up again. `GET /v1/connection-apps` lists the registrations. **Details** - `appId`: the registration id that was not found, when the call named it in its path - `field`: on a connect, the field that names the app (`app`, or `appId` when it named a registration) **Example** ```json excerpt { "error": { "code": "connection-app-not-found", "message": "…", "details": { "appId": "…", "field": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/connection-apps/{appId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionappsget.md) - [`PATCH /v1/connection-apps/{appId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionappsupdate.md) - [`DELETE /v1/connection-apps/{appId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionappsremove.md) - [`POST /v1/connections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsconnect.md) ### `connection-not-found` **Synopsis** `404 Not Found`, code `connection-not-found` No connection with that id that the caller can reach. A person's connection is reachable by that person and a tenant admin; the company's, by a tenant admin. It may have been disconnected. **Details** - `connectionId`: the connection id that was not found **Example** ```json excerpt { "error": { "code": "connection-not-found", "message": "…", "details": { "connectionId": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/projects/{projectId}/repo-connection`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsrepoconnectionset.md) - [`GET /v1/connections/{connectionId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsget.md) - [`DELETE /v1/connections/{connectionId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsdisconnect.md) ### `connection-request-not-found` **Synopsis** `404 Not Found`, code `connection-request-not-found` No connect request with that id that the caller can act on, or none for the sign-in that came back from the app. A person's connect request is that person's alone; the company's, a tenant admin's. Start a new connect. **Details** - `requestId`: the connect request id that was not found, when the call named one - `field`: `state`, when the sign-in came back with no state **Example** ```json excerpt { "error": { "code": "connection-request-not-found", "message": "…", "details": { "requestId": "…", "field": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) - [`GET /v1/connections/requests/{requestId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsrequestsget.md) - [`POST /v1/connections/requests/{requestId}/start`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsrequestsstart.md) ### `conversation-not-found` **Synopsis** `404 Not Found`, code `conversation-not-found` The conversation doesn't exist in your tenant, or you can't read it: one you can't read answers as if it weren't there when you read it or its messages, or are refused closing it, unregistering it or adding a turn. Check the conversation id, and that your key or role can read its project. **Details** - `conversationId`: the conversation id that wasn't found **Example** ```json excerpt { "error": { "code": "conversation-not-found", "message": "…", "details": { "conversationId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`GET /v1/conversations/{conversationId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/conversationsget.md) ### `correction-not-found` **Synopsis** `404 Not Found`, code `correction-not-found` No correction exists with that id, or it's in a project your key can't read. Removing one also needs it to be live. **Details** None. **Example** ```json excerpt { "error": { "code": "correction-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) - [Correct a run's output](https://docs.kindgi.com/v0.4.0/guides/improve/correct-a-runs-output.md) ### `corrector-group-not-found` **Synopsis** `404 Not Found`, code `corrector-group-not-found` No live corrector group exists with that id. **Details** None. **Example** ```json excerpt { "error": { "code": "corrector-group-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/projects/{projectId}/queue-rules`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsqueuerulescreate.md) - [`PATCH /v1/projects/{projectId}/queue-rules/{ruleId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsqueuerulesupdate.md) ### `cost-record-not-found` **Synopsis** `404 Not Found`, code `cost-record-not-found` No cost record exists with that id in the tenant. **Details** - `recordId`: the cost record id that was looked up **Example** ```json excerpt { "error": { "code": "cost-record-not-found", "message": "…", "details": { "recordId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/cost/records/{recordId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/costrecordsget.md) ### `deployment-not-found` **Synopsis** `404 Not Found`, code `deployment-not-found` No deployment with that id exists under the tenant. A promotion of a deployment in a project you can't read is answered the same way. **Details** - `deploymentId`: the deployment id that wasn't found **Example** ```json excerpt { "error": { "code": "deployment-not-found", "message": "…", "details": { "deploymentId": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [`DELETE /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsclearendpoint.md) - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordpackenv.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint/problem`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordproblem.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/suspended`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetsuspended.md) - 5 more operations name it in their responses - [`GET /v1/deployments/{deploymentId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsget.md) - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromotecheck.md) ### `env-not-found` **Synopsis** `404 Not Found`, code `env-not-found` The env entry named in the path doesn't exist in the scope and environment you asked for. **Details** - `name`: the env entry name that was not found **Example** ```json excerpt { "error": { "code": "env-not-found", "message": "…", "details": { "name": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envget.md) ### `expert-queue-item-not-found` **Synopsis** `404 Not Found`, code `expert-queue-item-not-found` The run isn't in the project's To review list. **Details** None. **Example** ```json excerpt { "error": { "code": "expert-queue-item-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/projects/{projectId}/expert-queue/{runId}/dismiss`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsexpertqueuedismiss.md) - [`POST /v1/projects/{projectId}/expert-queue/{runId}/reopen`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsexpertqueuereopen.md) ### `fact-not-found` **Synopsis** `404 Not Found`, code `fact-not-found` The memory fact doesn't exist in your tenant. Check the fact id. **Details** - `factId`: the fact id **Example** ```json excerpt { "error": { "code": "fact-not-found", "message": "…", "details": { "factId": "…" }, "requestId": "…" } } ``` **See also** - [Memory reference](https://docs.kindgi.com/v0.4.0/guides/agents/memory-reference.md) ### `flow-not-found` **Synopsis** `404 Not Found`, code `flow-not-found` The flow, or the flow version, isn't registered. Check the id and version; a run can't start on an unregistered flow version. **Details** - `flowId`: the flow id - `version`: the version asked for, when one was named **Example** ```json excerpt { "error": { "code": "flow-not-found", "message": "…", "details": { "flowId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/flows/{flowId}/pinned`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspinnedresolve.md) - [`POST /v1/flows/{flowId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspinnedpin.md) - [`POST /v1/flows/{flowId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspinnedunpin.md) - [`GET /v1/flows/{flowId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowsget.md) - [`GET /v1/flows/{flowId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowsgetversion.md) ### `guardrail-not-found` **Synopsis** `404 Not Found`, code `guardrail-not-found` No guardrail with this id is registered. Check the id. **Details** - `guardrailId`: the guardrail id **Example** ```json excerpt { "error": { "code": "guardrail-not-found", "message": "…", "details": { "guardrailId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/guardrails/{guardrailId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/guardrailsget.md) - [`POST /v1/guardrails/{guardrailId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/guardrailsunregister.md) ### `identity-provider-not-found` **Synopsis** `404 Not Found`, code `identity-provider-not-found` No identity provider with that id is registered for the tenant. **Details** - `providerId`: the provider id that wasn't found **Example** ```json excerpt { "error": { "code": "identity-provider-not-found", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } } ``` **See also** - [Set up SSO](https://docs.kindgi.com/v0.4.0/guides/sso.md) ### `identity-user-not-found` **Synopsis** `404 Not Found`, code `identity-user-not-found` No user with that id exists under this tenant (or the person named isn't a member of it). **Details** - `userId`: the user id that wasn't found **Example** ```json excerpt { "error": { "code": "identity-user-not-found", "message": "…", "details": { "userId": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/agents/{agentId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentssetowner.md) - [`POST /v1/identity/users/{userId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersunregister.md) - [`POST /v1/identity/users/{userId}/invite`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersresendinvite.md) - [`GET /v1/identity/users/{userId}/second-factor`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityuserssecondfactor.md) - [`POST /v1/identity/users/{userId}/second-factor/remove`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersremovesecondfactor.md) - [`GET /v1/identity/users/{userId}/grants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersgrants.md) - 4 more operations name it in their responses ### `improve-run-not-found` **Synopsis** `404 Not Found`, code `improve-run-not-found` The Improve run doesn't exist, or your key can't read its agent. **Details** - `improveRunId`: the Improve run id that was looked up **Example** ```json excerpt { "error": { "code": "improve-run-not-found", "message": "…", "details": { "improveRunId": "…" }, "requestId": "…" } } ``` **See also** - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) - [`POST /v1/improve-runs/{improveRunId}/cancel`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunscancel.md) ### `mcp-endpoint-not-found` **Synopsis** `404 Not Found`, code `mcp-endpoint-not-found` No MCP endpoint is registered with that id. **Details** - `endpointId`: the endpoint id that was looked up **Example** ```json excerpt { "error": { "code": "mcp-endpoint-not-found", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } } ``` **See also** - [Use an MCP server's tools](https://docs.kindgi.com/v0.4.0/guides/tools/mcp-servers.md) - [`GET /v1/mcp/endpoints/{endpointId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsget.md) - [`GET /v1/mcp/endpoints/{endpointId}/resources`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsresourceslist.md) ### `mcp-prompt-not-found` **Synopsis** `404 Not Found`, code `mcp-prompt-not-found` The MCP endpoint is registered, but it has no prompt with the name you asked for. **Details** - `endpointId`: id of the MCP endpoint - `promptName`: the prompt name that wasn't found **Example** ```json excerpt { "error": { "code": "mcp-prompt-not-found", "message": "…", "details": { "endpointId": "…", "promptName": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/mcp/endpoints/{endpointId}/prompts/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointspromptsget.md) ### `mcp-resource-not-found` **Synopsis** `404 Not Found`, code `mcp-resource-not-found` The MCP endpoint is registered, but it has no resource at the URI you asked for. **Details** - `endpointId`: id of the MCP endpoint - `uri`: the resource URI that wasn't found **Example** ```json excerpt { "error": { "code": "mcp-resource-not-found", "message": "…", "details": { "endpointId": "…", "uri": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/mcp/endpoints/{endpointId}/resources/{uri}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsresourcesread.md) ### `not-found` **Synopsis** `404 Not Found`, code `not-found` The token, secret rotation or memory erasure you named doesn't exist for your tenant, or its id isn't valid. Check the id. **Details** None. **Example** ```json excerpt { "error": { "code": "not-found", "message": "…", "requestId": "…" } } ``` **See also** - [Approvals reference](https://docs.kindgi.com/v0.4.0/guides/approvals/approvals-reference.md) - [Start runs from your app](https://docs.kindgi.com/v0.4.0/start/call-from-your-app.md) ### `observation-not-found` **Synopsis** `404 Not Found`, code `observation-not-found` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "observation-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [Improve an agent](https://docs.kindgi.com/v0.4.0/guides/improve/improve-an-agent.md) ### `org-not-found` **Synopsis** `404 Not Found`, code `org-not-found` The org doesn't exist in the tenant: it never existed or was deleted. Also returned when creating or changing a project or team with an unknown `orgId`. **Details** - `orgId`: the org id that wasn't found **Example** ```json excerpt { "error": { "code": "org-not-found", "message": "…", "details": { "orgId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/orgs/{orgId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/orgsget.md) ### `pin-not-found` **Synopsis** `404 Not Found`, code `pin-not-found` No entry with that id exists in this agent's pin history. **Details** None. **Example** ```json excerpt { "error": { "code": "pin-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) - [Release an agent version](https://docs.kindgi.com/v0.4.0/guides/improve/release-an-agent-version.md) ### `policy-not-found` **Synopsis** `404 Not Found`, code `policy-not-found` No policy exists with that id (or that version) in the tenant. **Details** - `policyId`: the policy id **Example** ```json excerpt { "error": { "code": "policy-not-found", "message": "…", "details": { "policyId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/policies/{policyId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiesget.md) - [`GET /v1/policies/{policyId}/versions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiesversionslist.md) ### `principal-not-found` **Synopsis** `404 Not Found`, code `principal-not-found` The person or service account the key is for doesn't exist in this tenant or has been unregistered, or the request names none. Name an existing one with `for`. **Details** None. **Example** ```json excerpt { "error": { "code": "principal-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) ### `project-membership-not-found` **Synopsis** `404 Not Found`, code `project-membership-not-found` The user isn't a member of the project. **Details** - `projectId`: the project - `userId`: the user who isn't a member **Example** ```json excerpt { "error": { "code": "project-membership-not-found", "message": "…", "details": { "projectId": "…", "userId": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/projects/{projectId}/memberships/{userId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsmembershipsupdaterole.md) ### `project-not-found` **Synopsis** `404 Not Found`, code `project-not-found` The project doesn't exist in the tenant, or your key can't see it. For `GET /v1/projects/default`, the tenant has no default project. **Details** - `projectId`: the project id that wasn't found; absent for the missing default project **Example** ```json excerpt { "error": { "code": "project-not-found", "message": "…", "details": { "projectId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetprojectsuspended.md) - [`POST /v1/service-accounts`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountscreate.md) - [`POST /v1/service-accounts/{serviceAccountId}/grant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountsgrant.md) - [`POST /v1/agents`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspublish.md) - 23 more operations name it in their responses - [Start a run](https://docs.kindgi.com/v0.4.0/guides/runs/start-a-run.md) ### `provenance-not-found` **Synopsis** `404 Not Found`, code `provenance-not-found` No provenance record exists for the run id in the path, or the id isn't a valid run id. **Details** - `runId`: the run id that was looked up - `recordState`: why the run has no record yet: `being-written` while it's being written, after a flow run ends; `failed` when writing it failed. Absent when the run has no record at all. More states may come - `reason`: with `recordState: failed`, why: `read-failed` (its journal couldn't be read), `build-failed` (the record couldn't be built from it) or `write-failed` (it couldn't be saved). More codes may come **Example** ```json excerpt { "error": { "code": "provenance-not-found", "message": "…", "details": { "runId": "…", "recordState": "…", "reason": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/provenance/{runId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/provenanceget.md) - [`GET /v1/provenance/{runId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/provenanceget.md) ### `provider-not-found` **Synopsis** `404 Not Found`, code `provider-not-found` No model provider is registered with that id in the tenant. **Details** - `providerId`: the provider id that was looked up **Example** ```json excerpt { "error": { "code": "provider-not-found", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/providers/{providerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/providersget.md) - [`GET /v1/providers/{providerId}/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/providerscheck.md) ### `queue-rule-not-found` **Synopsis** `404 Not Found`, code `queue-rule-not-found` The project has no queue rule with that id. **Details** None. **Example** ```json excerpt { "error": { "code": "queue-rule-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/projects/{projectId}/queue-rules/{ruleId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsqueuerulesget.md) - [`PATCH /v1/projects/{projectId}/queue-rules/{ruleId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsqueuerulesupdate.md) - [`POST /v1/projects/{projectId}/queue-rules/{ruleId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsqueuerulesunregister.md) - [`GET /v1/projects/{projectId}/queue-rules/{ruleId}/versions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsqueuerulesversions.md) - [`GET /v1/projects/{projectId}/queue-rules/{ruleId}/results`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsqueuerulesresults.md) - [`POST /v1/projects/{projectId}/queue-rules/{ruleId}/queue-recent`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsqueuerulesqueuerecent.md) ### `release-gate-not-found` **Synopsis** `404 Not Found`, code `release-gate-not-found` No release gate with that id exists, or it has no version with that number. **Details** - `releaseGateId`: the release gate id that was looked up **Example** ```json excerpt { "error": { "code": "release-gate-not-found", "message": "…", "details": { "releaseGateId": "…" }, "requestId": "…" } } ``` **See also** - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) - [`POST /v1/release-gates`](https://docs.kindgi.com/v0.4.0/reference/api/operations/releasegatespublish.md) ### `reviewer-not-found` **Synopsis** `404 Not Found`, code `reviewer-not-found` No reviewer is registered with this id. **Details** - `reviewerId`: the reviewer id **Example** ```json excerpt { "error": { "code": "reviewer-not-found", "message": "…", "details": { "reviewerId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/approvals/reviewers/{reviewerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalsreviewersget.md) - [`POST /v1/approvals/reviewers/{reviewerId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalsreviewersunregister.md) ### `run-not-found` **Synopsis** `404 Not Found`, code `run-not-found` The run doesn't exist in your tenant. Check the run id. **Details** - `runId`: the run id that wasn't found (only some routes) **Example** ```json excerpt { "error": { "code": "run-not-found", "message": "…", "details": { "runId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) - [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmintpublic.md) - [`POST /v1/agents/{agentId}/test-set/cases`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentstestsetaddcase.md) - [`POST /v1/artifacts`](https://docs.kindgi.com/v0.4.0/reference/api/operations/artifactsupload.md) - [`POST /v1/corrections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctionscreate.md) ### `secret-not-found` **Synopsis** `404 Not Found`, code `secret-not-found` The secret doesn't exist in the scope and environment you named, or it was revoked. A deployment that references a missing secret gets the same answer. **Details** - `name`: the secret name that was not found **Example** ```json excerpt { "error": { "code": "secret-not-found", "message": "…", "details": { "name": "…" }, "requestId": "…" } } ``` **See also** - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) ### `secret-revoked` **Synopsis** `404 Not Found`, code `secret-revoked` The secret was revoked, so its value can't be read or rotated. **Details** - `name`: the revoked secret name (in binding results) **Example** ```json excerpt { "error": { "code": "secret-revoked", "message": "…", "details": { "name": "…" }, "requestId": "…" } } ``` **See also** - [Projects, packs and values](https://docs.kindgi.com/v0.4.0/concepts/projects-packs-values.md) - [Keep and purge deleted data](https://docs.kindgi.com/v0.4.0/deploy/retention.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) ### `secret-version-not-found` **Synopsis** `404 Not Found`, code `secret-version-not-found` The secret exists but has no version with the number you asked for. **Details** - `name`: the secret name - `versionId`: the version number that was not found **Example** ```json excerpt { "error": { "code": "secret-version-not-found", "message": "…", "details": { "name": "…", "versionId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/secrets/{name}/versions/{versionId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsgetversion.md) ### `service-account-not-found` **Synopsis** `404 Not Found`, code `service-account-not-found` No service account with that id exists in this tenant. **Details** None. **Example** ```json excerpt { "error": { "code": "service-account-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/service-accounts/{serviceAccountId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountsget.md) - [`POST /v1/service-accounts/{serviceAccountId}/grant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountsgrant.md) - [`POST /v1/service-accounts/{serviceAccountId}/ungrant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountsungrant.md) - [`POST /v1/service-accounts/{serviceAccountId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountsunregister.md) ### `session-not-found` **Synopsis** `404 Not Found`, code `session-not-found` `POST /v1/auth/refresh` was called with a session that has been revoked or no longer exists. Sign in again to get a new session. **Details** - `sessionId`: id of the session that no longer exists **Example** ```json excerpt { "error": { "code": "session-not-found", "message": "…", "details": { "sessionId": "…" }, "requestId": "…" } } ``` **See also** - [Sessions](https://docs.kindgi.com/v0.4.0/guides/sso/sessions.md) ### `signing-key-not-found` **Synopsis** `404 Not Found`, code `signing-key-not-found` The signing key id doesn't exist among the tenant's trusted keys, or a signed export asked for a signing key the runtime doesn't sign with. Omit the key id to use the active key. **Details** - `signingKeyId`: the key id requested for signing; present only on export signing **Example** ```json excerpt { "error": { "code": "signing-key-not-found", "message": "…", "details": { "signingKeyId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/signing-keys/{keyId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeysget.md) ### `signing-not-configured` **Synopsis** `404 Not Found`, code `signing-not-configured` The runtime has no export signing key, so signed exports and the features that depend on them are unavailable. **Details** None. **Example** ```json excerpt { "error": { "code": "signing-not-configured", "message": "…", "requestId": "…" } } ``` **See also** - [Export signed evidence](https://docs.kindgi.com/v0.4.0/guides/observability/export-signed-evidence.md) ### `site-not-found` **Synopsis** `404 Not Found`, code `site-not-found` No site with that id in the project the path names, or, revoking a key, no key with that id on the site. `GET /v1/projects/{projectId}/sites` lists the project's sites. **Details** None. **Example** ```json excerpt { "error": { "code": "site-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/projects/{projectId}/sites/{siteId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesget.md) - [`PATCH /v1/projects/{projectId}/sites/{siteId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesupdate.md) - [`POST /v1/projects/{projectId}/sites/{siteId}/pause`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitespause.md) - [`POST /v1/projects/{projectId}/sites/{siteId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesresume.md) - [`POST /v1/projects/{projectId}/sites/{siteId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesunregister.md) - [`POST /v1/projects/{projectId}/sites/{siteId}/enrollment-codes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesenrollmentcode.md) - 2 more operations name it in their responses ### `site-person-not-found` **Synopsis** `404 Not Found`, code `site-person-not-found` The site has no link to that person: they never signed in through it. Only the people a site signs in are let back in through it. Find their id with `kindgi people list --include-removed`. **Details** - `userId`: the person who was to be let back in **Example** ```json excerpt { "error": { "code": "site-person-not-found", "message": "…", "details": { "userId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/projects/{projectId}/sites/{siteId}/people/{userId}/restore`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesrestoreperson.md) ### `suggested-change-not-found` **Synopsis** `404 Not Found`, code `suggested-change-not-found` The suggested change doesn't exist in the tenant, or your key can't see its agent. **Details** - `suggestedChangeId`: the suggested change id that was looked up **Example** ```json excerpt { "error": { "code": "suggested-change-not-found", "message": "…", "details": { "suggestedChangeId": "…" }, "requestId": "…" } } ``` **See also** - [Suggest a change, and test it](https://docs.kindgi.com/v0.4.0/guides/improve/suggest-a-change.md) ### `system-key-not-found` **Synopsis** `404 Not Found`, code `system-key-not-found` No system key has that id. **Details** None. **Example** ```json excerpt { "error": { "code": "system-key-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysrevoke.md) ### `team-grant-not-found` **Synopsis** `404 Not Found`, code `team-grant-not-found` The team has no role on that project. **Details** None. **Example** ```json excerpt { "error": { "code": "team-grant-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`PATCH /v1/projects/{projectId}/team-grants/{teamId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsteamgrantsupdaterole.md) ### `team-membership-not-found` **Synopsis** `404 Not Found`, code `team-membership-not-found` The user isn't a member of the team. **Details** - `teamId`: the team - `userId`: the user who isn't a member **Example** ```json excerpt { "error": { "code": "team-membership-not-found", "message": "…", "details": { "teamId": "…", "userId": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/teams/{teamId}/memberships/{userId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/teamsmembershipsupdaterole.md) ### `team-not-found` **Synopsis** `404 Not Found`, code `team-not-found` No team with that id exists under the tenant. **Details** - `teamId`: the team id that wasn't found **Example** ```json excerpt { "error": { "code": "team-not-found", "message": "…", "details": { "teamId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/teams/{teamId}/memberships`](https://docs.kindgi.com/v0.4.0/reference/api/operations/teamsmembershipsadd.md) - [`POST /v1/projects/{projectId}/team-grants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsteamgrantsadd.md) ### `tenant-config-not-found` **Synopsis** `404 Not Found`, code `tenant-config-not-found` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "tenant-config-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) ### `tenant-not-found` **Synopsis** `404 Not Found`, code `tenant-not-found` The tenant your key belongs to doesn't exist. **Details** - `tenantId`: the tenant id that wasn't found **Example** ```json excerpt { "error": { "code": "tenant-not-found", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsget.md) - [`PATCH /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsupdate.md) - [`POST /v1/system/tenants/{tenantId}/close`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsclose.md) - [`PUT /v1/system/tenants/{tenantId}/suspended`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetsuspended.md) - [`PUT /v1/system/tenants/{tenantId}/image-prefix`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetimageprefix.md) - [`PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetprojectsuspended.md) - 14 more operations name it in their responses - [`GET /v1/tenant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantget.md) ### `test-case-not-found` **Synopsis** `404 Not Found`, code `test-case-not-found` The agent's test set has no case by that id. A correction's case has the correction's id, and a case added by hand an id that starts `case-`: list the cases to find it. **Details** None. **Example** ```json excerpt { "error": { "code": "test-case-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/test-set/cases/{caseId}/retire`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentstestsetretirecase.md) ### `test-run-not-found` **Synopsis** `404 Not Found`, code `test-run-not-found` No test run exists with that id in the tenant. **Details** - `runId`: the run id that was looked up **Example** ```json excerpt { "error": { "code": "test-run-not-found", "message": "…", "details": { "runId": "…" }, "requestId": "…" } } ``` **See also** - [Try a version on the test cases](https://docs.kindgi.com/v0.4.0/guides/improve/compare-an-agent-version.md) ### `test-set-not-found` **Synopsis** `404 Not Found`, code `test-set-not-found` No test set is registered with that id. **Details** - `testSetId`: the test set id that was looked up **Example** ```json excerpt { "error": { "code": "test-set-not-found", "message": "…", "details": { "testSetId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/suggested-changes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescreate.md) - [`GET /v1/test-sets/{testSetId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testsetsget.md) ### `tool-file-token-not-found` **Synopsis** `404 Not Found`, code `tool-file-token-not-found` No tool call's files match the bearer of a request to `/v1/tool-files`: there's no token, the token is unknown, its secret is wrong, or its call may not do what was asked (a tool that only stores reading a file, or one that only reads storing one). The pack service's runner sends the token a call carries; a handler never sees it. Also the answer of a runtime that stores no files. **Details** None. **Example** ```json excerpt { "error": { "code": "tool-file-token-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tool-files`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesstore.md) - [`GET /v1/tool-files/{artifactId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesread.md) ### `tool-not-found` **Synopsis** `404 Not Found`, code `tool-not-found` The tool, or the tool version, isn't registered in the project. Check the id and version. **Details** - `toolId`: the tool id - `version`: the version asked for, when one was named **Example** ```json excerpt { "error": { "code": "tool-not-found", "message": "…", "details": { "toolId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/tools/{toolId}/pinned`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedresolve.md) - [`POST /v1/tools/{toolId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedpin.md) - [`POST /v1/tools/{toolId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedunpin.md) - [`GET /v1/tools/{toolId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsget.md) - [`GET /v1/tools/{toolId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsgetversion.md) ### `trigger-not-found` **Synopsis** `404 Not Found`, code `trigger-not-found` No trigger (schedule, webhook trigger or event trigger) with that id exists for your tenant, or the id belongs to a trigger of another kind. **Details** - `triggerId`: the trigger id that was not found **Example** ```json excerpt { "error": { "code": "trigger-not-found", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/schedules/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesgetversion.md) - [`GET /v1/webhooks/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksgetversion.md) - [`GET /v1/mail-triggers/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mailtriggersgetversion.md) - [`POST /v1/schedules/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulestakeownership.md) ### `trigger-version-not-found` **Synopsis** `404 Not Found`, code `trigger-version-not-found` The trigger exists, but has no version with the number you asked for. Versions count from 1, one more for each change to the trigger. **Details** - `triggerId`: the trigger - `version`: the version number that was not found **Example** ```json excerpt { "error": { "code": "trigger-version-not-found", "message": "…", "details": { "triggerId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/schedules/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesgetversion.md) - [`GET /v1/webhooks/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksgetversion.md) - [`GET /v1/mail-triggers/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mailtriggersgetversion.md) - [`GET /v1/schedules/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesgetversion.md) - [`GET /v1/webhooks/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksgetversion.md) - [`GET /v1/mail-triggers/{triggerId}/versions/{version}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mailtriggersgetversion.md) ### `wait-token-not-found` **Synopsis** `404 Not Found`, code `wait-token-not-found` No open wait matches: the link's token is unknown (a wrong or mistyped link answers the same), or the run doesn't wait at the `waitpointId` you named. A run's open waits are in `waitingFor.tokens` on `GET /v1/runs/{runId}`. **Details** None. **Example** ```json excerpt { "error": { "code": "wait-token-not-found", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) - [`POST /v1/wait-tokens/{token}/complete`](https://docs.kindgi.com/v0.4.0/reference/api/operations/waittokenscomplete.md) ### `webhook-delivery-not-found` **Synopsis** `404 Not Found`, code `webhook-delivery-not-found` The endpoint has no delivery with that id. **Details** - `deliveryId`: the delivery id that was not found **Example** ```json excerpt { "error": { "code": "webhook-delivery-not-found", "message": "…", "details": { "deliveryId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/webhook-endpoints/{endpointId}/test`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookendpointssendtest.md) ### `webhook-endpoint-not-found` **Synopsis** `404 Not Found`, code `webhook-endpoint-not-found` No outbound webhook endpoint with that id exists in your tenant. **Details** - `endpointId`: the endpoint id that was not found **Example** ```json excerpt { "error": { "code": "webhook-endpoint-not-found", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/webhook-endpoints/{endpointId}/test`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookendpointssendtest.md) ## 409 Conflict ### `agent-already-registered` **Synopsis** `409 Conflict`, code `agent-already-registered` That agent id and version is already published, and versions never change. Publish under a new version; `details.nextFreeVersion` suggests the next free one. **Details** - `agentId`: the agent id - `version`: the version already taken - `nextFreeVersion`: the next unused version, when one can be worked out **Example** ```json excerpt { "error": { "code": "agent-already-registered", "message": "…", "details": { "agentId": "…", "version": "…", "nextFreeVersion": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspublish.md) ### `agent-project-mismatch` **Synopsis** `409 Conflict`, code `agent-project-mismatch` The agent belongs to a different project than the one you named; an agent stays in the project its first version went to. Publish its versions there. The answer doesn't name that project. **Details** - `agentId`: the agent id (publish, derive) - `primitive`: the kind of item (deployment only) - `id`: the item's id and version (deployment only) **Example** ```json excerpt { "error": { "code": "agent-project-mismatch", "message": "…", "details": { "agentId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspublish.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Organize work by org and project](https://docs.kindgi.com/v0.4.0/guides/projects/organize-by-org-and-project.md) ### `agent-version-mismatch` **Synopsis** `409 Conflict`, code `agent-version-mismatch` The conversation was opened with one agent version, but the turn or resume names another. Use the version the conversation started with. **Details** - `conversationId`: the conversation - `expectedVersion`: the version the conversation or run is bound to - `actualVersion`: the version the call used **Example** ```json excerpt { "error": { "code": "agent-version-mismatch", "message": "…", "details": { "conversationId": "…", "expectedVersion": "…", "actualVersion": "…" }, "requestId": "…" } } ``` **See also** - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Kindgi 0.2.0](https://docs.kindgi.com/v0.4.0/releases/0.2.0.md) ### `agent-version-pinned` **Synopsis** `409 Conflict`, code `agent-version-pinned` The version is pinned in one or more scopes, so it can't be unregistered. Unpin it, or pin another version there first. **Details** - `agentId`: the agent - `version`: the version - `scopes`: the scopes where it is pinned **Example** ```json excerpt { "error": { "code": "agent-version-pinned", "message": "…", "details": { "agentId": "…", "version": "…", "scopes": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentsunregister.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `already-terminal` **Synopsis** `409 Conflict`, code `already-terminal` The API doesn't send this code. Cancelling a test run that has finished is answered `test-run-already-terminal`. **Details** None. **Example** ```json excerpt { "error": { "code": "already-terminal", "message": "…", "requestId": "…" } } ``` **See also** - [`test-run-already-terminal`](https://docs.kindgi.com/v0.4.0/reference/errors.md#test-run-already-terminal) ### `approval-already-decided` **Synopsis** `409 Conflict`, code `approval-already-decided` The approval already has a decision recorded; a second decision is refused. **Details** - `approvalId`: the approval **Example** ```json excerpt { "error": { "code": "approval-already-decided", "message": "…", "details": { "approvalId": "…" }, "requestId": "…" } } ``` **See also** - [Decide an approval](https://docs.kindgi.com/v0.4.0/guides/approvals/decide-an-approval.md) ### `approval-not-decided` **Synopsis** `409 Conflict`, code `approval-not-decided` The approval is still pending, so a signed audit bundle can't be exported. Export it after a terminal decision. **Details** - `approvalId`: the approval - `status`: its current status **Example** ```json excerpt { "error": { "code": "approval-not-decided", "message": "…", "details": { "approvalId": "…", "status": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/approvals/{approvalId}/audit-bundle`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalsauditbundle.md) ### `approval-terminal` **Synopsis** `409 Conflict`, code `approval-terminal` The approval already ended (decided, expired or withdrawn), so it takes no more decisions. **Details** - `approvalId`: the approval - `status`: its final status **Example** ```json excerpt { "error": { "code": "approval-terminal", "message": "…", "details": { "approvalId": "…", "status": "…" }, "requestId": "…" } } ``` **See also** - [Decide an approval](https://docs.kindgi.com/v0.4.0/guides/approvals/decide-an-approval.md) ### `block-already-registered` **Synopsis** `409 Conflict`, code `block-already-registered` That block version is already published; versions never change, so publish a new version. On a deployment, the runtime holds a version of the pack's block with other content, or unregistered: give the block a new version in the pack, or reinstate the unregistered one (`kindgi blocks reinstate`). The message names each one. **Details** - `blockId`: the block id (single publish) - `version`: the version that exists (single publish) - `primitive`: on a deployment: the kind of item refused (`block`) - `id`: on a deployment: the refused block, as `id@version` **Example** ```json excerpt { "error": { "code": "block-already-registered", "message": "…", "details": { "blockId": "…", "version": "…", "primitive": "…", "id": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/blocks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blockspublish.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) ### `block-project-mismatch` **Synopsis** `409 Conflict`, code `block-project-mismatch` The block belongs to another project. Publish its versions, or deploy the pack that brings it, in the project that owns it. **Details** - `blockId`: the block id (single publish) - `primitive`: on a deployment: the kind of item refused (`block`) - `id`: on a deployment: the refused block, as `id@version` **Example** ```json excerpt { "error": { "code": "block-project-mismatch", "message": "…", "details": { "blockId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/blocks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blockspublish.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) ### `connection-account-mismatch` **Synopsis** `409 Conflict`, code `connection-account-mismatch` A reconnect signed in to an account other than the connection's. Sign in with the same account; to connect another account instead, disconnect, then connect again. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-account-mismatch", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) - [GitHub](https://docs.kindgi.com/v0.4.0/guides/connections/github.md) ### `connection-app-in-use` **Synopsis** `409 Conflict`, code `connection-app-in-use` Removing an app registration that still has live connections. Remove it with `withConnections=true` to remove those connections too, or disconnect them first. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-app-in-use", "message": "…", "requestId": "…" } } ``` **See also** - [`DELETE /v1/connection-apps/{appId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionappsremove.md) ### `connection-removing` **Synopsis** `409 Conflict`, code `connection-removing` A connect, or its finish, for a connection that's still being disconnected: an earlier disconnect didn't get to the end. Disconnect it again to finish, then connect. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-removing", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsconnect.md) - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) ### `connection-request-used` **Synopsis** `409 Conflict`, code `connection-request-used` The connect request was finished already: each one is used once. Start a new connect to connect again. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-request-used", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) - [`POST /v1/connections/requests/{requestId}/start`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsrequestsstart.md) ### `conversation-closed` **Synopsis** `409 Conflict`, code `conversation-closed` The conversation you're adding a turn to has been closed. Start a new conversation instead. **Details** - `conversationId`: the closed conversation - `runId`: the run the failure belongs to, when one was started **Example** ```json excerpt { "error": { "code": "conversation-closed", "message": "…", "details": { "conversationId": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [Hold a conversation](https://docs.kindgi.com/v0.4.0/guides/agents/conversations.md) - [Hold a conversation](https://docs.kindgi.com/v0.4.0/guides/agents/conversations.md) ### `conversation-project-mismatch` **Synopsis** `409 Conflict`, code `conversation-project-mismatch` The run names a project other than the conversation's. A conversation belongs to one project, and its turns run there. Name its project, or omit `projectId` to continue it in its own. **Details** - `conversationId`: the conversation the turn was posted into - `projectId`: the project the run named - `conversationProjectId`: the conversation's own project **Example** ```json excerpt { "error": { "code": "conversation-project-mismatch", "message": "…", "details": { "conversationId": "…", "projectId": "…", "conversationProjectId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [Hold a conversation](https://docs.kindgi.com/v0.4.0/guides/agents/conversations.md) ### `correction-status-change-not-allowed` **Synopsis** `409 Conflict`, code `correction-status-change-not-allowed` The change isn't allowed from the correction's status: re-sorting only from `open`, `being-fixed` or `with-owner`; `being-fixed` only from `open` or `with-owner`; `open` only from `being-fixed` or `wont-fix`; `wont-fix` from anything but `removed`. `fixed` is set only by a pin or a deploy. **Details** - `from`: the correction's status - `to`: the status the change would have set **Example** ```json excerpt { "error": { "code": "correction-status-change-not-allowed", "message": "…", "details": { "from": "…", "to": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/corrections/{correctionId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctionschange.md) ### `corrector-group-name-taken` **Synopsis** `409 Conflict`, code `corrector-group-name-taken` A corrector group with that name already exists in this scope. Pick another name. **Details** None. **Example** ```json excerpt { "error": { "code": "corrector-group-name-taken", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/corrector-groups`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctorgroupscreate.md) ### `deploy-would-put-back-older-blocks` **Synopsis** `409 Conflict`, code `deploy-would-put-back-older-blocks` A newer version of one of the pack's data blocks than its files' runs now in a project of one of the pack's agents: a project's own version, added there from a suggested change or pinned, or a segment pin inside one. The deploy would put the older one back without anyone choosing to, so nothing was deployed. Bring the newer version into the files (`kindgi blocks pull `, or merge the pull request opened for it) and deploy again, or deploy with `--replace= --reason=` to put the older one back on purpose: the deployment records it, and the audit log keeps one `deployment-replaced-block` event for each block. Every project counts, whoever deploys; one you can't read is named by the version only. `POST /v1/deployments/check` answers the same, writing nothing. A promotion with `pin` answers it too, against what runs in the target project only, with nothing moved: promote a build whose files have the newer versions, or name each block in its `replace` (`kindgi promote --pin --replace= --reason=`). **Details** - `blocks`: each block: its `blockId`, the files' version (`inFiles`), the newest that `runs` (its `version`, and in a project you read its `projectId`, `follows` `pin` or `latest`, the `segment` path, who made it run there `by` and when `at`), and the pull request opened for it (`pr.url`), when one was **Example** ```json excerpt { "error": { "code": "deploy-would-put-back-older-blocks", "message": "…", "details": { "blocks": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [`POST /v1/deployments/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentscheck.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [`POST /v1/deployments/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentscheck.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) ### `deployment-superseded` **Synopsis** `409 Conflict`, code `deployment-superseded` A deployment is promoted only while it serves. With `details.environment` `source`: newer deployments in its environment serve every tool version it ships, so it no longer serves there; promote the newer one. With `target`: the target environment has this build already, superseded there; promote the newer build from the environment before it. Nothing is written. **Details** - `environment`: `source` (the deployment promoted) or `target` (the environment it goes to) - `newerDeploymentId`: the newest deployment there that serves every tool version this one ships; present when there is one **Example** ```json excerpt { "error": { "code": "deployment-superseded", "message": "…", "details": { "environment": "…", "newerDeploymentId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromotecheck.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) ### `duplicate-edge-id` **Synopsis** `409 Conflict`, code `duplicate-edge-id` The API doesn't send this code. A flow definition that uses an edge id twice is answered `validation-failed`, with the problem in `details.issues`. **Details** None. **Example** ```json excerpt { "error": { "code": "duplicate-edge-id", "message": "…", "requestId": "…" } } ``` **See also** - [`validation-failed`](https://docs.kindgi.com/v0.4.0/reference/errors.md#validation-failed) - [Write a flow](https://docs.kindgi.com/v0.4.0/guides/flows/write-a-flow.md) ### `duplicate-node-id` **Synopsis** `409 Conflict`, code `duplicate-node-id` The API doesn't send this code. A flow definition that uses a node id twice is answered `validation-failed`, with the problem in `details.issues`. **Details** None. **Example** ```json excerpt { "error": { "code": "duplicate-node-id", "message": "…", "requestId": "…" } } ``` **See also** - [`validation-failed`](https://docs.kindgi.com/v0.4.0/reference/errors.md#validation-failed) - [Write a flow](https://docs.kindgi.com/v0.4.0/guides/flows/write-a-flow.md) ### `endpoint-not-pending` **Synopsis** `409 Conflict`, code `endpoint-not-pending` A problem was sent for a deployment that isn't waiting for a pack service. A problem goes with a `pending` one, or a `cleared` one listed as needing a pack service again (`waiting`, once a suspension is lifted). **Details** - `status`: the deployment's endpoint status now: `ready`, or `cleared` and not `waiting` **Example** ```json excerpt { "error": { "code": "endpoint-not-pending", "message": "…", "details": { "status": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint/problem`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordproblem.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint/problem`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordproblem.md) ### `endpoint-not-ready` **Synopsis** `409 Conflict`, code `endpoint-not-ready` What a deployment's pack service runs was recorded for a service that isn't `ready`. A new service's revision goes with its endpoint (`packEnvRevision`); record one for a `ready` service only. **Details** - `status`: the deployment's endpoint status now: `pending` or `cleared` **Example** ```json excerpt { "error": { "code": "endpoint-not-ready", "message": "…", "details": { "status": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordpackenv.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordpackenv.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) ### `endpoint-retired` **Synopsis** `409 Conflict`, code `endpoint-retired` The env of a deployment whose pack service was retired was asked for: it isn't given out. A retired deployment's service is listed to go (`GET /v1/system/deployments?endpoint=retire`). **Details** - `retired`: why its pack service was retired, as the retire list gives it **Example** ```json excerpt { "error": { "code": "endpoint-retired", "message": "…", "details": { "retired": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) ### `env-not-served` **Synopsis** `409 Conflict`, code `env-not-served` This runtime keeps every value under the one env it serves (`KINDGI_REFUSE_OTHER_ENVS`), and the request would store a value under another, where it would never be read: a secret or env value written under another env, or a model provider, MCP endpoint or webhook endpoint naming its secret under another. Nothing is stored. Use the env the runtime serves; `GET /v1/identity/whoami` names it (`servedEnv`). Reads and deletes under any env still work. **Details** - `envName`: the env the request named - `servedEnv`: the env this runtime serves, to use instead **Example** ```json excerpt { "error": { "code": "env-not-served", "message": "…", "details": { "envName": "…", "servedEnv": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvsetcloudsecret.md) - [`POST /v1/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/providersregister.md) - [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsregister.md) - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envput.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - 5 more operations name it in their responses - [Models](https://docs.kindgi.com/v0.4.0/guides/models.md) - [Set values per environment](https://docs.kindgi.com/v0.4.0/guides/secrets/per-environment-values.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envput.md) - [`POST /v1/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/providersregister.md) ### `env-write-conflict` **Synopsis** `409 Conflict`, code `env-write-conflict` The env entry changed since the revision you based the write on. Read the entry again and retry with the current revision. **Details** - `currentRevision`: the revision stored now **Example** ```json excerpt { "error": { "code": "env-write-conflict", "message": "…", "details": { "currentRevision": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvsetcloudsecret.md) - [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envput.md) ### `environment-takes-promotions` **Synopsis** `409 Conflict`, code `environment-takes-promotions` The project you named (or the default project, when you named none) is a later environment of an environment order, and a later environment takes builds only by promotion from the one before it. Deploy into the order's first environment and promote the build from there. A publish through the API into a later environment is refused the same way, and so is an edited version of an agent that names one: new versions are made in the first environment. A tool's pin for a later environment is refused too: a tool's pin acts when an agent or flow version is made, which is in the first environment, so pin the tool there. Nothing is written. **Details** - `firstProjectId`: the order's first environment, where builds and new versions go; present when you can read that project - `position`: the project's place in the order, from 0 (the first) **Example** ```json excerpt { "error": { "code": "environment-takes-promotions", "message": "…", "details": { "firstProjectId": "…", "position": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspublish.md) - [`POST /v1/flows`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspublish.md) - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) - [`POST /v1/tools/{toolId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedpin.md) - [`POST /v1/guardrails`](https://docs.kindgi.com/v0.4.0/reference/api/operations/guardrailsregister.md) - [`POST /v1/suggested-changes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescreate.md) - 2 more operations name it in their responses ### `erasure-in-progress` **Synopsis** `409 Conflict`, code `erasure-in-progress` An erasure of this person's data is running, so no new turn starts and no new fact is stored for them until it completes. Retry after the erasure finishes. **Details** None. **Example** ```json excerpt { "error": { "code": "erasure-in-progress", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/memory/facts`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memorywritefact.md) - [Memory reference](https://docs.kindgi.com/v0.4.0/guides/agents/memory-reference.md) ### `expert-queue-item-not-open` **Synopsis** `409 Conflict`, code `expert-queue-item-not-open` The queue item isn't in the state this action needs: dismiss needs it open, and reopen needs it dismissed. **Details** None. **Example** ```json excerpt { "error": { "code": "expert-queue-item-not-open", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/projects/{projectId}/expert-queue/{runId}/dismiss`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsexpertqueuedismiss.md) - [`POST /v1/projects/{projectId}/expert-queue/{runId}/reopen`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsexpertqueuereopen.md) ### `fact-changed` **Synopsis** `409 Conflict`, code `fact-changed` The fact moved on since you read it: its current revision isn't the `expectVersion` you sent. Read it again, then retry with the new revision. **Details** - `factId`: the fact id - `currentVersion`: the fact's current revision **Example** ```json excerpt { "error": { "code": "fact-changed", "message": "…", "details": { "factId": "…", "currentVersion": "…" }, "requestId": "…" } } ``` **See also** - [`DELETE /v1/memory/facts/{factId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memorydeletefact.md) - [`POST /v1/memory/facts/{factId}/supersede`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memorysupersedefact.md) - [`POST /v1/memory/facts/{factId}/verify`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memoryverifyfact.md) - [Memory reference](https://docs.kindgi.com/v0.4.0/guides/agents/memory-reference.md) ### `flow-already-registered` **Synopsis** `409 Conflict`, code `flow-already-registered` The flow id and version you're publishing already exist. Publish the change under a new version. **Details** - `flowId`: the flow's id - `version`: the version that is already registered **Example** ```json excerpt { "error": { "code": "flow-already-registered", "message": "…", "details": { "flowId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/flows`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspublish.md) ### `flow-project-mismatch` **Synopsis** `409 Conflict`, code `flow-project-mismatch` The flow id belongs to another project, because its first version was published there, and its versions can't be published from a different project. **Details** - `flowId`: the flow's id (single publish) - `primitive`: on a deployment: the kind of item refused (`flow`) - `id`: on a deployment: the refused item, as `id@version` **Example** ```json excerpt { "error": { "code": "flow-project-mismatch", "message": "…", "details": { "flowId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/flows`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspublish.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) ### `flow-version-pinned` **Synopsis** `409 Conflict`, code `flow-version-pinned` The flow version is pinned in one or more scopes, so it can't be unregistered, and the flow can't be deleted while any of its versions is. Move the pin to another version, or unpin it, first. **Details** - `flowId`: the flow - `version`: the version - `scopes`: the scopes where it is pinned **Example** ```json excerpt { "error": { "code": "flow-version-pinned", "message": "…", "details": { "flowId": "…", "version": "…", "scopes": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/flows/{flowId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowsunregister.md) ### `guardrail-already-registered` **Synopsis** `409 Conflict`, code `guardrail-already-registered` A guardrail with this id is already registered. On a deployment, the existing one has a different definition, so unregister it first and deploy again. **Details** - `guardrailId`: the guardrail's id (direct registration) - `primitive`: on a deployment: the kind of item refused (`guardrail`) - `id`: on a deployment: the guardrail id **Example** ```json excerpt { "error": { "code": "guardrail-already-registered", "message": "…", "details": { "guardrailId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } } ``` **See also** - [Kindgi 0.3.0](https://docs.kindgi.com/v0.4.0/releases/0.3.0.md) - [Kindgi 0.3.1](https://docs.kindgi.com/v0.4.0/releases/0.3.1.md) - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`POST /v1/guardrails`](https://docs.kindgi.com/v0.4.0/reference/api/operations/guardrailsregister.md) ### `guardrail-project-mismatch` **Synopsis** `409 Conflict`, code `guardrail-project-mismatch` A guardrail id in your deployment is already in use in another project. A deployment never takes over a guardrail from another project. **Details** - `primitive`: the kind of item refused (`guardrail`) - `id`: the guardrail id **Example** ```json excerpt { "error": { "code": "guardrail-project-mismatch", "message": "…", "details": { "primitive": "…", "id": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) ### `hitl-required` **Synopsis** `409 Conflict`, code `hitl-required` The API doesn't send this code. A conversation that reaches its review threshold parks the turn for an approval instead. **Details** None. **Example** ```json excerpt { "error": { "code": "hitl-required", "message": "…", "requestId": "…" } } ``` **See also** - [Ask before a long conversation continues](https://docs.kindgi.com/v0.4.0/guides/approvals/ask-after-n-turns.md) ### `idempotency-key-body-mismatch` **Synopsis** `409 Conflict`, code `idempotency-key-body-mismatch` You reused an Idempotency-Key with a different request body. Send the original body to get its answer back, or use a fresh key. **Details** None. **Example** ```json excerpt { "error": { "code": "idempotency-key-body-mismatch", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) - [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmintpublic.md) - [`POST /v1/auth/refresh`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authrefresh.md) - [`POST /v1/projects/{projectId}/sites`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesregister.md) ### `idempotency-key-in-flight` **Synopsis** `409 Conflict`, code `idempotency-key-in-flight` A request with this Idempotency-Key is still running. Retry after the `Retry-After` header; you then get its answer. **Details** None. **Example** ```json excerpt { "error": { "code": "idempotency-key-in-flight", "message": "…", "requestId": "…" } } ``` **See also** - [Runs, the journal and durability](https://docs.kindgi.com/v0.4.0/concepts/runs.md) - [Retry a start safely](https://docs.kindgi.com/v0.4.0/guides/runs/retry-a-start-safely.md) ### `idempotency-key-replay-withheld` **Synopsis** `409 Conflict`, code `idempotency-key-replay-withheld` The request with this Idempotency-Key already succeeded, but its answer held a secret that isn't kept, so it can't be replayed. Read what it created, or make a new one with a fresh key. **Details** - `status`: the HTTP status the first request answered with - `at`: when it succeeded, as an ISO timestamp **Example** ```json excerpt { "error": { "code": "idempotency-key-replay-withheld", "message": "…", "details": { "status": "…", "at": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) - [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantscreate.md) - [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmintpublic.md) - [`POST /v1/auth/token-sign-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authtokensignin.md) - [`POST /v1/auth/refresh`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authrefresh.md) - 4 more operations name it in their responses - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Retry a start safely](https://docs.kindgi.com/v0.4.0/guides/runs/retry-a-start-safely.md) ### `identity-provider-already-registered` **Synopsis** `409 Conflict`, code `identity-provider-already-registered` An identity provider with that id is already registered for the tenant. Use a different id, or change the existing provider with a patch. **Details** - `providerId`: the id that is already taken **Example** ```json excerpt { "error": { "code": "identity-provider-already-registered", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/auth/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authprovidersregister.md) - [Set up SSO](https://docs.kindgi.com/v0.4.0/guides/sso.md) ### `identity-providers-need-secrets-store` **Synopsis** `409 Conflict`, code `identity-providers-need-secrets-store` The deployment has no secrets store (`KINDGI_SECRETS_BACKEND` is `none`), and an identity provider's client secret and keys are references into one, so no provider is added or changed until the operator sets one up. Removing a provider still works. Continue with Google, Microsoft or GitHub and the emailed link don't need a store. **Details** - `providerId`: the provider that was being added or changed **Example** ```json excerpt { "error": { "code": "identity-providers-need-secrets-store", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/auth/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authprovidersregister.md) - [`PATCH /v1/auth/providers/{providerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authprovidersupdate.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) ### `identity-user-email-taken` **Synopsis** `409 Conflict`, code `identity-user-email-taken` Another person in this tenant already has that email address. **Details** - `userId`: the existing person who has the email **Example** ```json excerpt { "error": { "code": "identity-user-email-taken", "message": "…", "details": { "userId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/identity/users`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityuserscreate.md) ### `identity-user-not-invited` **Synopsis** `409 Conflict`, code `identity-user-not-invited` The person has no invitation to send again: they have signed in already, were added before invitations, or have no email. Nothing changed. **Details** - `userId`: the person **Example** ```json excerpt { "error": { "code": "identity-user-not-invited", "message": "…", "details": { "userId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/identity/users/{userId}/invite`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersresendinvite.md) ### `identity-user-unregister-refused` **Synopsis** `409 Conflict`, code `identity-user-unregister-refused` You can't unregister yourself or the seed user. Ask another tenant admin. **Details** - `reason`: why it was refused: 'yourself' or 'seed-user' - `userId`: the person who was to be unregistered **Example** ```json excerpt { "error": { "code": "identity-user-unregister-refused", "message": "…", "details": { "reason": "…", "userId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/identity/users/{userId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersunregister.md) - [People, API keys and service accounts](https://docs.kindgi.com/v0.4.0/deploy/people-and-keys.md) ### `identity-user-unregistered` **Synopsis** `409 Conflict`, code `identity-user-unregistered` The person was removed from the tenant, so they can't be granted anything. **Details** None. **Example** ```json excerpt { "error": { "code": "identity-user-unregistered", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/identity/users/{userId}/grant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersgrant.md) ### `image-not-allowed` **Synopsis** `409 Conflict`, code `image-not-allowed` The deployment's image is outside the tenant's image repository: a tenant deploys only images at or under its image prefix. **Details** - `imagePrefix`: the tenant's image prefix; from `POST /v1/deployments` only **Example** ```json excerpt { "error": { "code": "image-not-allowed", "message": "…", "details": { "imagePrefix": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) ### `image-prefix-taken` **Synopsis** `409 Conflict`, code `image-prefix-taken` The image prefix equals, holds or sits inside another tenant's. Each tenant's repository is its own: choose a prefix that doesn't overlap another tenant's. **Details** None. **Example** ```json excerpt { "error": { "code": "image-prefix-taken", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantscreate.md) - [`PUT /v1/system/tenants/{tenantId}/image-prefix`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetimageprefix.md) ### `image-prefix-unset` **Synopsis** `409 Conflict`, code `image-prefix-unset` The tenant has no image repository set, so it can't register a deployment yet. Its operator sets one with `PUT /v1/system/tenants/{tenantId}/image-prefix`. **Details** None. **Example** ```json excerpt { "error": { "code": "image-prefix-unset", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) ### `improve-not-ready` **Synopsis** `409 Conflict`, code `improve-not-ready` Something the Improve run needs is missing, so it didn't start. `details.items` lists every missing item at once, as `POST /v1/improve-runs/check` does, each with where it's fixed and how. Fix them, check again, then start it. **Details** - `items`: the missing readiness items, each with its `key` (`wording`, `settings`, `test-cases`, `permission`, `one-at-a-time` or `project`) and its `fix`: `where` (`repo`, in the agent's code, then a deploy; `kindgi`, in Kindgi) and `text` **Example** ```json excerpt { "error": { "code": "improve-not-ready", "message": "…", "details": { "items": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/improve-runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunsstart.md) - [Improve an agent](https://docs.kindgi.com/v0.4.0/guides/improve/improve-an-agent.md) ### `improve-run-finished` **Synopsis** `409 Conflict`, code `improve-run-finished` The Improve run has already ended, so there is nothing to cancel. **Details** - `improveRunId`: the Improve run id - `status`: the status the Improve run ended with **Example** ```json excerpt { "error": { "code": "improve-run-finished", "message": "…", "details": { "improveRunId": "…", "status": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/improve-runs/{improveRunId}/cancel`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunscancel.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `improve-run-running` **Synopsis** `409 Conflict`, code `improve-run-running` The agent already has a running Improve run in this project: one runs at a time. Wait for it to end, or cancel it, then start again. **Details** - `improveRunId`: the running Improve run **Example** ```json excerpt { "error": { "code": "improve-run-running", "message": "…", "details": { "improveRunId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/improve-runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunsstart.md) - [`POST /v1/improve-runs/{improveRunId}/cancel`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunscancel.md) ### `invalid-transition` **Synopsis** `409 Conflict`, code `invalid-transition` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "invalid-transition", "message": "…", "requestId": "…" } } ``` **See also** - [Suggest a change, and test it](https://docs.kindgi.com/v0.4.0/guides/improve/suggest-a-change.md) ### `last-tenant-admin` **Synopsis** `409 Conflict`, code `last-tenant-admin` This person is the only tenant admin, so they can't be unregistered or lose the admin grant. Make someone else a tenant admin first. **Details** - `reason`: on unregister: 'last-tenant-admin' - `userId`: on unregister: the person **Example** ```json excerpt { "error": { "code": "last-tenant-admin", "message": "…", "details": { "reason": "…", "userId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/identity/users/{userId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersunregister.md) - [`POST /v1/identity/users/{userId}/ungrant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersungrant.md) - [People, API keys and service accounts](https://docs.kindgi.com/v0.4.0/deploy/people-and-keys.md) ### `legal-hold` **Synopsis** `409 Conflict`, code `legal-hold` The fact is under legal hold, so it can't be deleted or superseded; or a memory erasure would reach facts under hold, and nothing is erased. Lift the hold first. **Details** - `factId`: the fact under hold (delete or supersede) - `factIds`: the facts under hold (starting an erasure) **Example** ```json excerpt { "error": { "code": "legal-hold", "message": "…", "details": { "factId": "…", "factIds": "…" }, "requestId": "…" } } ``` **See also** - [`DELETE /v1/memory/facts/{factId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memorydeletefact.md) - [`POST /v1/memory/facts/{factId}/supersede`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memorysupersedefact.md) - [`POST /v1/memory/facts/{factId}/verify`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memoryverifyfact.md) - [`POST /v1/memory/erasures`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memorycreateerasure.md) - [Memory reference](https://docs.kindgi.com/v0.4.0/guides/agents/memory-reference.md) ### `mcp-endpoint-already-registered` **Synopsis** `409 Conflict`, code `mcp-endpoint-already-registered` An MCP endpoint with that id is already registered. Use another id or unregister the existing one. **Details** - `endpointId`: the endpoint id **Example** ```json excerpt { "error": { "code": "mcp-endpoint-already-registered", "message": "…", "details": { "endpointId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/mcp/endpoints`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsregister.md) ### `membership-exists` **Synopsis** `409 Conflict`, code `membership-exists` The user is already a member with another role. Their existing role is kept; change it with a role update instead. **Details** - `role`: the role they already hold **Example** ```json excerpt { "error": { "code": "membership-exists", "message": "…", "details": { "role": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/teams/{teamId}/memberships`](https://docs.kindgi.com/v0.4.0/reference/api/operations/teamsmembershipsadd.md) - [`POST /v1/projects/{projectId}/memberships`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsmembershipsadd.md) ### `not-pinned` **Synopsis** `409 Conflict`, code `not-pinned` The scope has no pin of its own (for an agent, no pinned version of its own), so there's nothing to unpin. Pin a version for the scope first. **Details** None. **Example** ```json excerpt { "error": { "code": "not-pinned", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedunpin.md) - [`POST /v1/flows/{flowId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspinnedunpin.md) - [`POST /v1/tools/{toolId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedunpin.md) ### `nothing-runs-in-scope` **Synopsis** `409 Conflict`, code `nothing-runs-in-scope` No version of the agent runs in the scope yet: no pin covers it, and the agent has no Latest there (a tenant or org scope takes Latest over every project), so there's nothing to measure the version against. Nothing is promoted. Deploy or publish a version into the project first; into a later environment of an order, which takes builds only by promotion, promote a build that ships a version of the agent. From a deployment promotion with `pin`, the move has already committed: the carried agents pinned before this one stay pinned (`details.pinned`), and this agent, the carried agents after it and the carried flows aren't pinned. The message names the agent. When the scope's project is suspended, the refusal is `project-suspended` instead. **Details** - `pinned`: from a deployment promotion with `pin`, when some were: the carried agents pinned before this one, in the answer's `pinned` shape **Example** ```json excerpt { "error": { "code": "nothing-runs-in-scope", "message": "…", "details": { "pinned": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/agents/{agentId}/pinned/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedcheck.md) - [`POST /v1/suggested-changes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescreate.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/agents/{agentId}/pinned/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedcheck.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [Pinned versions reference](https://docs.kindgi.com/v0.4.0/guides/improve/pinned-versions-reference.md) ### `orchestrator-round-held` **Synopsis** `409 Conflict`, code `orchestrator-round-held` Another orchestrator pass holds the round: its claim hasn't ended or lapsed. Only one pass runs at a time, so this pass has nothing to do. Exit, and let the next one claim the round. **Details** None. **Example** ```json excerpt { "error": { "code": "orchestrator-round-held", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/system/deployments/round`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsclaimround.md) - [`POST /v1/system/deployments/round`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsclaimround.md) ### `orchestrator-round-not-held` **Synopsis** `409 Conflict`, code `orchestrator-round-not-held` This pass's claim on the round lapsed before it ended it, and another pass holds the round now. Nothing changes. Give a pass a hold longer than it runs (`holdSeconds`, up to an hour). **Details** None. **Example** ```json excerpt { "error": { "code": "orchestrator-round-not-held", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/system/deployments/round/end`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsendround.md) - [`POST /v1/system/deployments/round/end`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsendround.md) ### `org-has-environment-order` **Synopsis** `409 Conflict`, code `org-has-environment-order` An org can't be deleted while it's the parent of an environment order, because deleting it would orphan the order. A tenant admin clears the order first (PUT /v1/environment-orders/orgs/{orgId} with \[]), then deletes the org. **Details** - `orderId`: the environment order the org is the parent of **Example** ```json excerpt { "error": { "code": "org-has-environment-order", "message": "…", "details": { "orderId": "…" }, "requestId": "…" } } ``` **See also** - [`DELETE /v1/orgs/{orgId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/orgsdelete.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) ### `pack-env-conflict` **Synopsis** `409 Conflict`, code `pack-env-conflict` What a pack service runs was recorded against a revision that's no longer the one recorded: another record came first. Read the deployment's pack env again, and record against what's there now. **Details** - `appliedRevision`: the revision the service is recorded as running now, when there is one **Example** ```json excerpt { "error": { "code": "pack-env-conflict", "message": "…", "details": { "appliedRevision": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordpackenv.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordpackenv.md) ### `pack-suspended` **Synopsis** `409 Conflict`, code `pack-suspended` The operator suspended this deployment's pack, so its pack service can't be set. Lift the suspension first. A promotion of its builds from or into an environment where it's suspended is refused too: `details.environment` says which. **Details** - `environment`: from a promotion: `source` (the deployment promoted) or `target` (the environment it goes to) **Example** ```json excerpt { "error": { "code": "pack-suspended", "message": "…", "details": { "environment": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/suspended`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetsuspended.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) ### `pin-scope-spans-environments` **Synopsis** `409 Conflict`, code `pin-scope-spans-environments` An agent, flow or tool with a project in an environment order is pinned one project at a time: a pin for the whole tenant or an organization would act in every environment of the order at once, so it's refused. Pin an agent or a flow in each environment's project (or a segment of it), and a tool in the order's first environment, where agent and flow versions are made. To take a build from one environment to the next and pin it there, promote it (`kindgi promote --pin`). Nothing is changed. **Details** None. **Example** ```json excerpt { "error": { "code": "pin-scope-spans-environments", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/flows/{flowId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspinnedpin.md) - [`POST /v1/tools/{toolId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedpin.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `pin-stops-latest` **Synopsis** `409 Conflict`, code `pin-stops-latest` The pin would take a project that follows the agent's Latest now off it: the project would run the pinned version from then on, and no longer take each new Latest. A project or segment pin there, or a tenant or org pin over it, counts, whether or not the version changes. Nothing is pinned. Ask again with `stopFollowingLatest: true` to pin anyway; for a suggested change, add it as the project's Latest instead. A deployment promotion with `pin` is the ask itself, so it's never refused this way. **Details** - `projects`: each project the pin would take off Latest, `{ projectId, version }`, with the version it runs now - `suggestedChangeId`: for a suggested change's pin: the suggested change id **Example** ```json excerpt { "error": { "code": "pin-stops-latest", "message": "…", "details": { "projects": "…", "suggestedChangeId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangespin.md) - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangespin.md) - [Pinned versions reference](https://docs.kindgi.com/v0.4.0/guides/improve/pinned-versions-reference.md) ### `pin-superseded` **Synopsis** `409 Conflict`, code `pin-superseded` The scope's pinned version changed while the release gate was being checked, so the check no longer applies. Check the pin again against the new pinned version. Under `kindgi dev`, a pin is also refused with it when the pack's files changed since the check or since the suggested change was made, or when a file was edited by hand at a version `kindgi dev` already keeps. The message names the file, or the agent or block that isn't in the pack anymore. **Details** - `pinned`: from a deployment promotion with `pin`, when some were: the carried agents pinned before this one, in the answer's `pinned` shape **Example** ```json excerpt { "error": { "code": "pin-superseded", "message": "…", "details": { "pinned": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `policy-already-registered` **Synopsis** `409 Conflict`, code `policy-already-registered` That policy id and version are already registered; policy versions never change, so publish a new version. **Details** - `policyId`: the policy id - `version`: the version that exists **Example** ```json excerpt { "error": { "code": "policy-already-registered", "message": "…", "details": { "policyId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/policies`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiespublish.md) ### `policy-scope-changed` **Synopsis** `409 Conflict`, code `policy-scope-changed` The policy version would move the policy to another scope, but a policy keeps one scope across versions. Publish it under a new id. **Details** - `policyId`: the policy id - `version`: the version - `policyKind`: the policy kind - `scope`: the scope the version covers - `previousScope`: the scope the policy already holds **Example** ```json excerpt { "error": { "code": "policy-scope-changed", "message": "…", "details": { "policyId": "…", "version": "…", "policyKind": "…", "scope": "…", "previousScope": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/policies`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiespublish.md) - [`POST /v1/policies/{policyId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiesreinstateversion.md) ### `policy-scope-taken` **Synopsis** `409 Conflict`, code `policy-scope-taken` Another policy already holds the scope this one would cover, for example the retention domain. Publish a new version of that policy, or unregister it first. **Details** - `policyId`: the policy being published or reinstated - `version`: its version - `policyKind`: the policy kind - `scope`: the scope requested - `heldBy`: the policy that holds the scope **Example** ```json excerpt { "error": { "code": "policy-scope-taken", "message": "…", "details": { "policyId": "…", "version": "…", "policyKind": "…", "scope": "…", "heldBy": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/policies`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiespublish.md) - [`POST /v1/policies/{policyId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiesreinstateversion.md) ### `project-default-already-exists` **Synopsis** `409 Conflict`, code `project-default-already-exists` The tenant already has a default project, so a second one can't be created. **Details** None. **Example** ```json excerpt { "error": { "code": "project-default-already-exists", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/projects`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectscreate.md) ### `project-in-another-order` **Synopsis** `409 Conflict`, code `project-in-another-order` A project in the request already belongs to another environment order. A project is in at most one order: set the other order without it, or clear that order, first. **Details** - `projectId`: the project already in another order **Example** ```json excerpt { "error": { "code": "project-in-another-order", "message": "…", "details": { "projectId": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/environment-orders/tenant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/environmentorderssettenant.md) - [`PUT /v1/environment-orders/orgs/{orgId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/environmentorderssetorg.md) ### `project-in-environment-order` **Synopsis** `409 Conflict`, code `project-in-environment-order` A project can't be deleted, or moved to another parent, while it's a member of an environment order. Clear it from the order first, then delete or move it. **Details** - `orderId`: the environment order the project belongs to **Example** ```json excerpt { "error": { "code": "project-in-environment-order", "message": "…", "details": { "orderId": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/projects/{projectId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsupdate.md) - [`DELETE /v1/projects/{projectId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsdelete.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) ### `project-suspended` **Synopsis** `409 Conflict`, code `project-suspended` The project is suspended, so nothing new starts in it until it's restored: a deploy into it (the named project, or the default for a tenant-wide deploy), a run or a turn started in it, an answer to one of its runs' waits (through the wait token's link or `POST /v1/runs/{runId}/resume`; a suspension cancels its runs, paused ones included), a test run started in it, an Improve run for one of its agents, or the operator setting the pack service of one of its deployments. What's already deployed stays. A test run or an Improve run already going stops at its next case: it ends `cancelled`, with `project-suspended` in its `cancelReason`. A delivery to one of its webhook triggers isn't refused: one that proves its sender is answered `202` with `skipped: project-suspended`, and nothing is recorded or kept for it. A schedule's fire on it starts no run or Improve run: it's recorded `skipped`, with `project-suspended` in its `detail`, and doesn't count toward the schedule's auto-pause, so the schedule stays on and fires again once the project is restored. A webhook delivery taken before the suspension whose run hadn't started is recorded `skipped` the same way, and its event is dropped. Ask the operator to restore the project. A promotion from it or into it is refused too: `details.environment` says which. So is making an agent version live in one of its scopes where nothing runs (its deployments are retired), with no `details`. **Details** - `environment`: from a promotion: `source` (the deployment promoted) or `target` (the environment it goes to) **Example** ```json excerpt { "error": { "code": "project-suspended", "message": "…", "details": { "environment": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/agents/{agentId}/pinned/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedcheck.md) - [`POST /v1/test-sets/{testSetId}/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testrunsstart.md) - 4 more operations name it in their responses - [Organize work by org and project](https://docs.kindgi.com/v0.4.0/guides/projects/organize-by-org-and-project.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [`POST /v1/test-sets/{testSetId}/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testrunsstart.md) - [`POST /v1/improve-runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunsstart.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) ### `promotion-not-next-environment` **Synopsis** `409 Conflict`, code `promotion-not-next-environment` A deployment is promoted only to the next environment of its environment order, one environment at a time. The project named isn't that one, or the deployment is in the order's last environment, or in no order. `kindgi environments list` shows the order. Nothing is written. **Details** - `position`: the next environment's place in the order, from 0 (the first); absent when there's none - `nextProjectId`: the next environment's project; present when you can read it **Example** ```json excerpt { "error": { "code": "promotion-not-next-environment", "message": "…", "details": { "position": "…", "nextProjectId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromotecheck.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) ### `promotion-values-not-ready` **Synopsis** `409 Conflict`, code `promotion-values-not-ready` Values the build needs in the target environment aren't ready there: a secret, env value or model key set nowhere a run there looks; one revoked where a run reads it; a pack env name set only as a secret, or both as a secret and as a plain value; or no model provider registered for an agent that runs on any provider. Each one is in `details.values`: set them in the target, then promote again. The promotion check lists the same, writing nothing. Nothing is written. **Details** - `values`: each value not ready: its `name`, `kind`, what needs it (`neededBy`), where a run finds it (`foundAt`, when it is set) and why it is not ready (`problem`); never a value **Example** ```json excerpt { "error": { "code": "promotion-values-not-ready", "message": "…", "details": { "values": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromotecheck.md) ### `provider-already-registered` **Synopsis** `409 Conflict`, code `provider-already-registered` A provider with that id is already registered in the tenant. **Details** - `providerId`: the provider id that is taken **Example** ```json excerpt { "error": { "code": "provider-already-registered", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/providersregister.md) ### `provider-key-in-use` **Synopsis** `409 Conflict`, code `provider-key-in-use` The `secret_ref` of the provider being registered names a secret already used by a tool, MCP endpoint, webhook endpoint or webhook trigger. Give each a key of its own. **Details** - `secret`: name of the secret - `usedBy`: list of the things using it, each with kind and id **Example** ```json excerpt { "error": { "code": "provider-key-in-use", "message": "…", "details": { "secret": "…", "usedBy": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/providersregister.md) - [Models](https://docs.kindgi.com/v0.4.0/guides/models.md) ### `purge-record-unset` **Synopsis** `409 Conflict`, code `purge-record-unset` A purge on a runtime with nowhere set to keep purge records (`KINDGI_TENANT_PURGE_RECORD`). Without a record, a restore from a backup older than the purge would bring the tenant back. Set it on the runtime's servers, then purge. Nothing was changed. **Details** - `tenantId`: the tenant **Example** ```json excerpt { "error": { "code": "purge-record-unset", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants/{tenantId}/purge`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantspurge.md) ### `purge-setting-missing` **Synopsis** `409 Conflict`, code `purge-setting-missing` A purge of a tenant holding something the runtime has no setting to reach: artifacts with no artifacts' store set (`KINDGI_ARTIFACTS`), or an authorization store with no OpenFGA set (`KINDGI_OPENFGA_API_URL`). The message says which. Nothing was changed. **Details** - `tenantId`: the tenant **Example** ```json excerpt { "error": { "code": "purge-setting-missing", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants/{tenantId}/purge`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantspurge.md) ### `registry-read-only` **Synopsis** `409 Conflict`, code `registry-read-only` This registry takes no writes, for example when a local dev server serves the project's own files: publishing, unregistering and reinstating are refused, and so is a deploy that would publish into it. Under `kindgi dev`, the agent registry still takes Improve runs and suggested changes, each made for the whole workspace, a check again, and a pin, which writes the version into the pack's files. It refuses an unpin, an add as Latest, and a pin or a check again for less than the whole workspace. The message says what to do instead. **Details** None. **Example** ```json excerpt { "error": { "code": "registry-read-only", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspublish.md) - [`PUT /v1/agents/{agentId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentssetowner.md) - [`POST /v1/agents/{agentId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentsunregister.md) - [`POST /v1/agents/{agentId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentsreinstateversion.md) - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/agents/{agentId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedunpin.md) - 21 more operations name it in their responses ### `release-gate-already-registered` **Synopsis** `409 Conflict`, code `release-gate-already-registered` The release gate already has a version with that number. Publish with a new version number. **Details** None. **Example** ```json excerpt { "error": { "code": "release-gate-already-registered", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/release-gates`](https://docs.kindgi.com/v0.4.0/reference/api/operations/releasegatespublish.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `release-gate-descendant-unpinned` **Synopsis** `409 Conflict`, code `release-gate-descendant-unpinned` The change would also move a narrower scope that a release gate applies to and that has no pinned version of its own, bypassing that gate. Pin that scope at its current version first. **Details** - `pinned`: from a deployment promotion with `pin`, when some were: the carried agents pinned before this one, in the answer's `pinned` shape **Example** ```json excerpt { "error": { "code": "release-gate-descendant-unpinned", "message": "…", "details": { "pinned": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/agents/{agentId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedunpin.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `release-gate-needs-pin` **Synopsis** `409 Conflict`, code `release-gate-needs-pin` The scope has a release gate, and a gated scope keeps its own pinned version, so it can't be unpinned. Unregister the release gate first, or pin an earlier version instead. **Details** None. **Example** ```json excerpt { "error": { "code": "release-gate-needs-pin", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/unpin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedunpin.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `release-gate-scope-changed` **Synopsis** `409 Conflict`, code `release-gate-scope-changed` A new version of a release gate can't change the agent or the scope it gates. Create a new release gate for the other agent or scope. **Details** None. **Example** ```json excerpt { "error": { "code": "release-gate-scope-changed", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/release-gates`](https://docs.kindgi.com/v0.4.0/reference/api/operations/releasegatespublish.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `release-gate-scope-taken` **Synopsis** `409 Conflict`, code `release-gate-scope-taken` Another release gate already gates this agent for the same scope. Publish a new version of that gate instead, or unregister it first. **Details** - `heldBy`: id of the release gate that holds the scope **Example** ```json excerpt { "error": { "code": "release-gate-scope-taken", "message": "…", "details": { "heldBy": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/release-gates`](https://docs.kindgi.com/v0.4.0/reference/api/operations/releasegatespublish.md) - [`POST /v1/release-gates/{releaseGateId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/releasegatesversionsreinstate.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `release-gate-scope-unpinned` **Synopsis** `409 Conflict`, code `release-gate-scope-unpinned` The scope has no pinned version of its own, so the release gate would not take effect. Pin a version for the scope first. **Details** None. **Example** ```json excerpt { "error": { "code": "release-gate-scope-unpinned", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/release-gates`](https://docs.kindgi.com/v0.4.0/reference/api/operations/releasegatespublish.md) - [`POST /v1/release-gates/{releaseGateId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/releasegatesversionsreinstate.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `reviewer-deactivated` **Synopsis** `409 Conflict`, code `reviewer-deactivated` The reviewer was deactivated, so it can't decide approvals. Ask an admin to reactivate or use another reviewer. **Details** - `reviewerId`: the reviewer id **Example** ```json excerpt { "error": { "code": "reviewer-deactivated", "message": "…", "details": { "reviewerId": "…" }, "requestId": "…" } } ``` **See also** - [Decide an approval](https://docs.kindgi.com/v0.4.0/guides/approvals/decide-an-approval.md) ### `run-already-terminal` **Synopsis** `409 Conflict`, code `run-already-terminal` The run has already finished (completed, failed or cancelled), so it can't be cancelled, resumed or given a decision. Start a new run if you need another. **Details** - `runId`: the run - `status`: the state it ended in **Example** ```json excerpt { "error": { "code": "run-already-terminal", "message": "…", "details": { "runId": "…", "status": "…" }, "requestId": "…" } } ``` **See also** - [Cancel a run](https://docs.kindgi.com/v0.4.0/guides/runs/cancel-a-run.md) ### `run-held-by-parent` **Synopsis** `409 Conflict`, code `run-held-by-parent` The run is a subflow's child run, left for its parent run's next resume, which resumes it too. Only the parent's resume resumes it, so a resume of the child itself is refused. **Details** - `runId`: the run - `parentRunId`: its parent run, whose resume resumes it **Example** ```json excerpt { "error": { "code": "run-held-by-parent", "message": "…", "details": { "runId": "…", "parentRunId": "…" }, "requestId": "…" } } ``` **See also** - [Kindgi 0.3.0](https://docs.kindgi.com/v0.4.0/releases/0.3.0.md) - [Runs, the journal and durability](https://docs.kindgi.com/v0.4.0/concepts/runs.md) ### `run-lease-lost` **Synopsis** `409 Conflict`, code `run-lease-lost` Another executor holds or has taken over the run, so this attempt can't go on. Retry later; the run continues in the executor that holds it. **Details** - `runId`: the run **Example** ```json excerpt { "error": { "code": "run-lease-lost", "message": "…", "details": { "runId": "…" }, "requestId": "…" } } ``` **See also** - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) ### `run-not-finished` **Synopsis** `409 Conflict`, code `run-not-finished` The run hasn't completed with an output, so there's nothing to correct. Wait until it completes. **Details** None. **Example** ```json excerpt { "error": { "code": "run-not-finished", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/test-set/cases`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentstestsetaddcase.md) - [`POST /v1/corrections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctionscreate.md) ### `schedule-exists` **Synopsis** `409 Conflict`, code `schedule-exists` The agent and project have an Improve schedule already: an agent has one Improve schedule per project. Change that one instead. **Details** - `scheduleId`: the Improve schedule the agent and project have - `triggerId`: the same schedule's trigger id **Example** ```json excerpt { "error": { "code": "schedule-exists", "message": "…", "details": { "scheduleId": "…", "triggerId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/schedules`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesregister.md) - [`PATCH /v1/schedules/{triggerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesupdate.md) - [Run on a schedule](https://docs.kindgi.com/v0.4.0/guides/runs/run-on-a-schedule.md) ### `second-factor-enroll-first` **Synopsis** `409 Conflict`, code `second-factor-enroll-first` Requiring a second factor from a session made without one would end that session at its next request. Set up your own second factor and sign in again with it, then require one. An API key may change the setting. **Details** None. **Example** ```json excerpt { "error": { "code": "second-factor-enroll-first", "message": "…", "requestId": "…" } } ``` **See also** - [`PATCH /v1/auth/settings`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authsettingsupdate.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ### `second-factor-not-set-up` **Synopsis** `409 Conflict`, code `second-factor-not-set-up` The person has no second factor set up: there are no recovery codes to replace, and nothing to take off. Set one up with `POST /v1/identity/me/second-factor`. **Details** None. **Example** ```json excerpt { "error": { "code": "second-factor-not-set-up", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/identity/me/second-factor/recovery-codes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymenewrecoverycodes.md) - [`POST /v1/identity/me/second-factor/remove`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeremovesecondfactor.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ### `second-factor-not-started` **Synopsis** `409 Conflict`, code `second-factor-not-started` There is no new key to confirm, or the one given is over an hour old. Start again with `POST /v1/identity/me/second-factor`, and confirm with a code from the new key. **Details** None. **Example** ```json excerpt { "error": { "code": "second-factor-not-started", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/identity/me/second-factor/confirm`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeconfirmsecondfactor.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ### `secret-write-conflict` **Synopsis** `409 Conflict`, code `secret-write-conflict` The secret write collides with what is stored: you used `create-new` for a name that already exists, or the version you based a write on is no longer current. **Details** - `currentVersion`: the version stored now (present when the secret already exists) **Example** ```json excerpt { "error": { "code": "secret-write-conflict", "message": "…", "details": { "currentVersion": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/webhooks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksregister.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Start runs from WooCommerce, Drupal or any signed webhook](https://docs.kindgi.com/v0.4.0/guides/webhooks/start-runs-from-webhooks.md) ### `seed-user-admin` **Synopsis** `409 Conflict`, code `seed-user-admin` The person is the seed user, whom the runtime makes tenant admin at every start, so the admin grant can't be removed while that setting stands. Unset the seed user and restart first. **Details** None. **Example** ```json excerpt { "error": { "code": "seed-user-admin", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/identity/users/{userId}/ungrant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersungrant.md) ### `service-account-name-taken` **Synopsis** `409 Conflict`, code `service-account-name-taken` An active service account in this tenant already has that name. Choose another name. With `runAsProject`, an active account someone made already has the project account's name, `project-`: a tenant admin can unregister it. **Details** None. **Example** ```json excerpt { "error": { "code": "service-account-name-taken", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/service-accounts`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountscreate.md) - [`POST /v1/schedules`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesregister.md) - [`POST /v1/schedules/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulestakeownership.md) - [`POST /v1/webhooks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksregister.md) - [`POST /v1/webhooks/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookstakeownership.md) - [`POST /v1/mail-triggers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mailtriggersregister.md) - 1 more operations name it in their responses ### `service-account-project-owned` **Synopsis** `409 Conflict`, code `service-account-project-owned` The service account is a project's own account, the account a trigger with `runAsProject` runs as. It has no keys, so none can be minted `for` it. Its grant is fixed, so it can't be granted or ungranted anything. A trigger can't name it in `runAsServiceAccountId`: name it with `runAsProject: true` instead. An app that needs keys needs a service account of its own. **Details** None. **Example** ```json excerpt { "error": { "code": "service-account-project-owned", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`POST /v1/service-accounts/{serviceAccountId}/grant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountsgrant.md) - [`POST /v1/service-accounts/{serviceAccountId}/ungrant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountsungrant.md) - [`POST /v1/schedules`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesregister.md) - [`POST /v1/schedules/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulestakeownership.md) - [`POST /v1/webhooks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksregister.md) - 3 more operations name it in their responses ### `service-account-unregistered` **Synopsis** `409 Conflict`, code `service-account-unregistered` The service account has been unregistered, so it can't be granted anything. **Details** None. **Example** ```json excerpt { "error": { "code": "service-account-unregistered", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/service-accounts/{serviceAccountId}/grant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/serviceaccountsgrant.md) - [`POST /v1/schedules`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesregister.md) - [`POST /v1/schedules/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulestakeownership.md) - [`POST /v1/webhooks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksregister.md) - [`POST /v1/webhooks/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookstakeownership.md) - [`POST /v1/mail-triggers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mailtriggersregister.md) - 1 more operations name it in their responses - [People, API keys and service accounts](https://docs.kindgi.com/v0.4.0/deploy/people-and-keys.md) - [Keep and purge deleted data](https://docs.kindgi.com/v0.4.0/deploy/retention.md) ### `session-revoked` **Synopsis** `409 Conflict`, code `session-revoked` The API doesn't send this code. A revoked session is answered `auth-revoked`, or `session-not-found` by `POST /v1/auth/refresh`. **Details** None. **Example** ```json excerpt { "error": { "code": "session-revoked", "message": "…", "requestId": "…" } } ``` **See also** - [`auth-revoked`](https://docs.kindgi.com/v0.4.0/reference/errors.md#auth-revoked) - [Sessions](https://docs.kindgi.com/v0.4.0/guides/sso/sessions.md) ### `signing-key-conflict` **Synopsis** `409 Conflict`, code `signing-key-conflict` The key id is already trusted with a different public key. Trust the new key under a new key id. **Details** None. **Example** ```json excerpt { "error": { "code": "signing-key-conflict", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/signing-keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeystrust.md) ### `signing-key-revoked` **Synopsis** `409 Conflict`, code `signing-key-revoked` The key id was revoked and revocation is final, so it can't be trusted again. Trust the key under a new key id. **Details** None. **Example** ```json excerpt { "error": { "code": "signing-key-revoked", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/signing-keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeystrust.md) ### `site-person-restore-refused` **Synopsis** `409 Conflict`, code `site-person-restore-refused` The site's person wasn't let back in, and nothing changed. `not-removed`: they're in the tenant and their site still knows them, so there's nothing to undo. `left`: their site said they left it. A site forgets a person who leaves, so if they come back, it signs them in as a new person. `linked-elsewhere`: they also sign in another way (through another site, or the tenant's own sign-in), and letting them back in would let them in there too: add them again instead, as a new person. **Details** - `reason`: why it was refused: 'not-removed', 'left' or 'linked-elsewhere' - `userId`: the person who was to be let back in **Example** ```json excerpt { "error": { "code": "site-person-restore-refused", "message": "…", "details": { "reason": "…", "userId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/projects/{projectId}/sites/{siteId}/people/{userId}/restore`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectssitesrestoreperson.md) ### `slug-conflict` **Synopsis** `409 Conflict`, code `slug-conflict` The slug is taken: another org, team or project in the tenant already has it, or a project in the same org. Choose another slug. **Details** - `resource`: kind of thing that conflicts: `org`, `team` or `project` - `slug`: the taken slug; on org delete, `slugs` lists them instead **Example** ```json excerpt { "error": { "code": "slug-conflict", "message": "…", "details": { "resource": "…", "slug": "…" }, "requestId": "…" } } ``` **See also** - [`DELETE /v1/orgs/{orgId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/orgsdelete.md) - [`PATCH /v1/projects/{projectId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsupdate.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) - [`POST /v1/orgs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/orgscreate.md) ### `suggested-change-invalid-state-transition` **Synopsis** `409 Conflict`, code `suggested-change-invalid-state-transition` The suggested change's status doesn't allow this action, or it changed while the request ran. Read the suggested change again and retry if it still applies. **Details** - `suggestedChangeId`: the suggested change id - `status`: the suggested change status that refused the action; absent when it changed mid-request **Example** ```json excerpt { "error": { "code": "suggested-change-invalid-state-transition", "message": "…", "details": { "suggestedChangeId": "…", "status": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/suggested-changes/{suggestedChangeId}/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescheck.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangespin.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/add-as-latest`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangesaddaslatest.md) ### `suggested-change-not-for-a-project` **Synopsis** `409 Conflict`, code `suggested-change-not-for-a-project` The suggested change was made for a tenant, an org or a segment, before suggested changes were for one project, so it can't be checked, pinned or added as Latest. Withdraw it, and suggest the change for a project. **Details** - `suggestedChangeId`: the suggested change id **Example** ```json excerpt { "error": { "code": "suggested-change-not-for-a-project", "message": "…", "details": { "suggestedChangeId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/suggested-changes/{suggestedChangeId}/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescheck.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangespin.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/add-as-latest`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangesaddaslatest.md) ### `suggested-change-nothing-to-check` **Synopsis** `409 Conflict`, code `suggested-change-nothing-to-check` The project's test set has no cases for the agent, so there's nothing to check a change on. Correct some of the agent's conversations in the project first. **Details** - `projectId`: the project **Example** ```json excerpt { "error": { "code": "suggested-change-nothing-to-check", "message": "…", "details": { "projectId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/suggested-changes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescreate.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescheck.md) - [`POST /v1/test-sets/{testSetId}/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testrunsstart.md) ### `suggested-change-out-of-date` **Synopsis** `409 Conflict`, code `suggested-change-out-of-date` The suggested change's project now runs another version of the agent than the one it's built on, so it isn't pinned or added as Latest. When `rebuilding` is true, it's being rebuilt on that version and checked again: try again once its check is ready. Otherwise that version doesn't use its block, or already has the change: withdraw it. **Details** - `suggestedChangeId`: the suggested change id - `builtOn`: the version it's built on - `runs`: the version its project runs now - `rebuilding`: whether it's being rebuilt on `runs` **Example** ```json excerpt { "error": { "code": "suggested-change-out-of-date", "message": "…", "details": { "suggestedChangeId": "…", "builtOn": "…", "runs": "…", "rebuilding": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/suggested-changes/{suggestedChangeId}/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescheck.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangespin.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/add-as-latest`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangesaddaslatest.md) ### `suggested-change-project-pinned` **Synopsis** `409 Conflict`, code `suggested-change-project-pinned` The suggested change's project runs a pin of the agent, not its Latest, so its version isn't added as Latest there. Pin it instead. **Details** - `suggestedChangeId`: the suggested change id **Example** ```json excerpt { "error": { "code": "suggested-change-project-pinned", "message": "…", "details": { "suggestedChangeId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/suggested-changes/{suggestedChangeId}/add-as-latest`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangesaddaslatest.md) ### `team-grant-exists` **Synopsis** `409 Conflict`, code `team-grant-exists` The team already holds another role on the project. Change the role instead of adding it again. **Details** - `role`: the role the team already holds **Example** ```json excerpt { "error": { "code": "team-grant-exists", "message": "…", "details": { "role": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/projects/{projectId}/team-grants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsteamgrantsadd.md) ### `tenant-closing` **Synopsis** `409 Conflict`, code `tenant-closing` The tenant is closing. Its own keys and sessions can read and export it until it's deleted, but not change it: deletes, revocations, erasures, signing in and out, and the signed exports still work. A delivery to one of its webhook triggers that proves its sender is refused the same way, and nothing is recorded for it. So is an answer to one of its runs' waits through the wait token's link, and nothing is taken. A schedule's or webhook trigger's fire whose run starts as the tenant starts closing is recorded `skipped`, with `tenant-closing` in its `detail`, and doesn't count toward a schedule's auto-pause. A test run or an Improve run going as it starts closing stops at its next case: it ends `cancelled`, with `tenant-closing` in its `cancelReason`. The system routes that change its settings, limits, image prefix, a suspension or a deployment's endpoint refuse a closing tenant; clearing its deployments' endpoints, which retires its pack services, still works. On the S3-compatible surface, the same refusal is S3's `403 AllAccessDisabled`. **Details** - `state`: `closing` - `tenantId`: the tenant; from a system route, or from renaming one **Example** ```json excerpt { "error": { "code": "tenant-closing", "message": "…", "details": { "state": "…", "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsupdate.md) - [`PUT /v1/system/tenants/{tenantId}/suspended`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetsuspended.md) - [`PUT /v1/system/tenants/{tenantId}/image-prefix`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetimageprefix.md) - [`PUT /v1/system/tenants/{tenantId}/projects/{projectId}/suspended`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetprojectsuspended.md) - [`PUT /v1/system/tenants/{tenantId}/production-allowed`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetproductionallowed.md) - [`PUT /v1/system/tenants/{tenantId}/limits`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetlimits.md) - 11 more operations name it in their responses - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) ### `tenant-config-revision-conflict` **Synopsis** `409 Conflict`, code `tenant-config-revision-conflict` The tenant config entry changed since the revision you sent in `ifRevision`, so the write is refused. Read the entry again and retry with its current revision. **Details** - `currentRevision`: the revision stored now **Example** ```json excerpt { "error": { "code": "tenant-config-revision-conflict", "message": "…", "details": { "currentRevision": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantconfigupsert.md) ### `tenant-export-window-open` **Synopsis** `409 Conflict`, code `tenant-export-window-open` A purge of a closing tenant whose 30-day export window hasn't passed: its own keys and sessions can still read and export it. Purge it once `windowEndsAt` has passed. Nothing was changed. **Details** - `tenantId`: the tenant - `windowEndsAt`: when its export window ends **Example** ```json excerpt { "error": { "code": "tenant-export-window-open", "message": "…", "details": { "tenantId": "…", "windowEndsAt": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants/{tenantId}/purge`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantspurge.md) ### `tenant-not-closing` **Synopsis** `409 Conflict`, code `tenant-not-closing` A purge of a tenant that is active or suspended. Only a closing tenant is purged, once its 30-day export window has passed: close it first (`POST /v1/system/tenants/{tenantId}/close`). Nothing was changed. **Details** - `tenantId`: the tenant - `state`: `active` or `suspended` **Example** ```json excerpt { "error": { "code": "tenant-not-closing", "message": "…", "details": { "tenantId": "…", "state": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants/{tenantId}/purge`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantspurge.md) ### `tenant-setup-pending` **Synopsis** `409 Conflict`, code `tenant-setup-pending` The tenant's setup hasn't finished, so it can't be renamed yet. Sending the request that created it again finishes it. **Details** - `tenantId`: the tenant **Example** ```json excerpt { "error": { "code": "tenant-setup-pending", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsupdate.md) - [`PATCH /v1/tenant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantupdate.md) ### `tenant-slug-in-config` **Synopsis** `409 Conflict`, code `tenant-slug-in-config` A tenant's slug can't change while the server's `KINDGI_AUTH_VERIFIED_DOMAINS` names a tenant by it. When it names this tenant by its current slug, the server would find no tenant by it when it next starts: the server's operator names the tenant there by its id instead and restarts the server, and then it can be renamed. When it names the new slug, the server's next start would give those domains to this tenant: choose another slug. **Details** - `slug`: the slug the setting names: the current one, or the new one - `domains`: the domains that name this tenant by its current slug; absent when the setting names the new one **Example** ```json excerpt { "error": { "code": "tenant-slug-in-config", "message": "…", "details": { "slug": "…", "domains": "…" }, "requestId": "…" } } ``` **See also** - [`PATCH /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsupdate.md) - [`PATCH /v1/tenant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantupdate.md) - [`PATCH /v1/tenant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantupdate.md) ### `tenant-slug-taken` **Synopsis** `409 Conflict`, code `tenant-slug-taken` Another tenant has that slug, creating a tenant or renaming one. A purged tenant keeps its slug. Choose another. **Details** - `slug`: the slug that is taken **Example** ```json excerpt { "error": { "code": "tenant-slug-taken", "message": "…", "details": { "slug": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantscreate.md) - [`PATCH /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsupdate.md) - [`PATCH /v1/tenant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantupdate.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) ### `tenant-suspended` **Synopsis** `409 Conflict`, code `tenant-suspended` The tenant is suspended. Its own keys and sessions can read and export it, but not change it until it's restored: deletes, revocations, erasures, signing in and out, and the signed exports still work. A delivery to one of its webhook triggers isn't refused: one that proves its sender is answered `202` with `skipped: tenant-suspended`, and nothing is recorded or kept for it. A sender that can redeliver by hand can resend it once the tenant is restored, and a restore is seen within 5 seconds. An answer to one of its runs' waits through the wait token's link is refused with this code, and nothing is taken: a suspension cancels the tenant's runs, paused ones included. Its schedules don't fire while it's suspended, and nothing is caught up: at the restore, a schedule's or webhook trigger's fire whose run or Improve run hadn't started is recorded `skipped`, with `tenant-suspended` in its `detail`, and a schedule that's on fires next at its first occurrence after the restore, whatever its `catchUp`. A test run or an Improve run going as it's suspended stops at its next case: it ends `cancelled`, with `tenant-suspended` in its `cancelReason`. A fire whose run was starting as the tenant was suspended is recorded `skipped` right away, with `tenant-suspended` in its `detail`. None of it counts toward a schedule's auto-pause. Setting a deployment's endpoint (`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`) refuses a suspended tenant too. On the S3-compatible surface, the same refusal is S3's `403 AllAccessDisabled`. **Details** - `state`: `suspended` - `tenantId`: the tenant; from a system route only **Example** ```json excerpt { "error": { "code": "tenant-suspended", "message": "…", "details": { "state": "…", "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/wait-tokens/{token}/complete`](https://docs.kindgi.com/v0.4.0/reference/api/operations/waittokenscomplete.md) - [`POST /v1/tool-files`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesstore.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) ### `test-case-retired` **Synopsis** `409 Conflict`, code `test-case-retired` The case is retired already. A retired case stays retired: there is no un-retire. **Details** - `retired`: the reason, who retired the case, and when **Example** ```json excerpt { "error": { "code": "test-case-retired", "message": "…", "details": { "retired": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/test-set/cases/{caseId}/retire`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentstestsetretirecase.md) ### `test-run-already-terminal` **Synopsis** `409 Conflict`, code `test-run-already-terminal` The test run has already finished, failed or been cancelled, so it can't be cancelled. **Details** - `runId`: the test run - `status`: its final status **Example** ```json excerpt { "error": { "code": "test-run-already-terminal", "message": "…", "details": { "runId": "…", "status": "…" }, "requestId": "…" } } ``` **See also** - [Try a version on the test cases](https://docs.kindgi.com/v0.4.0/guides/improve/compare-an-agent-version.md) ### `test-run-not-rescorable` **Synopsis** `409 Conflict`, code `test-run-not-rescorable` Only a completed run on the test cases can be rescored; this test run is of another kind or hasn't completed. **Details** - `runId`: the run id **Example** ```json excerpt { "error": { "code": "test-run-not-rescorable", "message": "…", "details": { "runId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/test-runs/{testRunId}/rescore`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testrunsrescore.md) ### `test-set-already-registered` **Synopsis** `409 Conflict`, code `test-set-already-registered` That test set id and version are already registered; versions never change, so publish a new version. **Details** - `testSetId`: the test set id - `version`: the version that exists **Example** ```json excerpt { "error": { "code": "test-set-already-registered", "message": "…", "details": { "testSetId": "…", "version": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/test-sets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testsetspublish.md) ### `test-set-project-mismatch` **Synopsis** `409 Conflict`, code `test-set-project-mismatch` The test set belongs to another project and test sets never move. Publish or build its versions in the project that owns it. **Details** - `testSetId`: the test set id **Example** ```json excerpt { "error": { "code": "test-set-project-mismatch", "message": "…", "details": { "testSetId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/test-sets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testsetspublish.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Organize work by org and project](https://docs.kindgi.com/v0.4.0/guides/projects/organize-by-org-and-project.md) ### `tool-already-registered` **Synopsis** `409 Conflict`, code `tool-already-registered` The tool id and version you're publishing already exist. Published versions are immutable, so publish under a new version number. On a deployment, the runtime holds a version of the pack's tool, active or unregistered, with another definition: give the tool a new version in the pack. The message names the fields that differ. **Details** - `toolId`: the tool's id (single publish) - `version`: the version that is already registered (single publish) - `primitive`: on a deployment: the kind of item refused (`tool`) - `id`: on a deployment: the refused tool, as `id@version` - `fields`: on a deployment: the fields of the tool's definition that differ: the manifest's top-level fields, and `modulePath` for where its code lives in the pack **Example** ```json excerpt { "error": { "code": "tool-already-registered", "message": "…", "details": { "toolId": "…", "version": "…", "primitive": "…", "id": "…", "fields": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) ### `tool-file-token-closed` **Synopsis** `409 Conflict`, code `tool-file-token-closed` The tool call's files are closed, so the call stores and reads no more: the call has answered, its time has passed, or its run has ended. **Details** None. **Example** ```json excerpt { "error": { "code": "tool-file-token-closed", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tool-files`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesstore.md) - [`GET /v1/tool-files/{artifactId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesread.md) ### `tool-kind-mismatch` **Synopsis** `409 Conflict`, code `tool-kind-mismatch` A tool's active versions are all one kind: an MCP endpoint's tool, which the runtime registers from the endpoint's listing, or tools published here. This version is the other kind, so nothing was written. Publish or deploy it under another id, or unregister the endpoint (or the other kind's versions) first. **Details** - `toolId`: the tool's id (single publish or reinstate) - `version`: the version refused (single publish or reinstate) - `endpointId`: when the id is an MCP endpoint's tool: that endpoint's id - `primitive`: on a deployment: the kind of item refused (`tool`) - `id`: on a deployment: the refused item, as `id@version` **Example** ```json excerpt { "error": { "code": "tool-kind-mismatch", "message": "…", "details": { "toolId": "…", "version": "…", "endpointId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) - [`POST /v1/tools/{toolId}/versions/{version}/reinstate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsreinstateversion.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [Use an MCP server's tools](https://docs.kindgi.com/v0.4.0/guides/tools/mcp-servers.md) ### `tool-project-mismatch` **Synopsis** `409 Conflict`, code `tool-project-mismatch` The tool id belongs to another project, because its first version was published there, and versions can't be published from a different project. **Details** - `toolId`: the tool's id (single publish) - `primitive`: on a deployment: the kind of item refused (`tool`) - `id`: on a deployment: the refused item, as `id@version` **Example** ```json excerpt { "error": { "code": "tool-project-mismatch", "message": "…", "details": { "toolId": "…", "primitive": "…", "id": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) - [`POST /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentsregister.md) - [Use an MCP server's tools](https://docs.kindgi.com/v0.4.0/guides/tools/mcp-servers.md) ### `tool-version-pinned` **Synopsis** `409 Conflict`, code `tool-version-pinned` The tool version is pinned in one or more scopes, so it can't be unregistered, and the tool can't be deleted while any of its versions is. Move the pin to another version, or unpin it, first. **Details** - `toolId`: the tool - `version`: the version - `scopes`: the scopes where it is pinned **Example** ```json excerpt { "error": { "code": "tool-version-pinned", "message": "…", "details": { "toolId": "…", "version": "…", "scopes": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools/{toolId}/versions/{version}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsunregister.md) ### `trigger-already-in-state` **Synopsis** `409 Conflict`, code `trigger-already-in-state` The trigger is already in the state you asked for, such as pausing a paused trigger or resuming one that is running. **Details** - `triggerId`: the trigger id **Example** ```json excerpt { "error": { "code": "trigger-already-in-state", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } } ``` **See also** - [Run on a schedule](https://docs.kindgi.com/v0.4.0/guides/runs/run-on-a-schedule.md) ### `trigger-owner-cannot-run-target` **Synopsis** `409 Conflict`, code `trigger-owner-cannot-run-target` A trigger's owner can't run what the trigger starts: `execute` on the agent or flow, or `publish` on the agent for an improvement schedule. Checked only with an authorization store, at two points. When a schedule, webhook or mail trigger names a service account to run as (`runAsServiceAccountId`), on create or take-over: give the account the editor role on the target's project, or name another account. When it's to run as the project's own account (`runAsProject`), which runs only what the project's editors can: run it as a service account that can, or own it yourself. And when a schedule's or mail trigger's target changes, since its owner stays: the owner, a service account or a person, must be able to run the new one (not checked when you're the owner, or when the owner was unregistered or removed). A tenant admin can give an account the role (not the project's own account, whose role is fixed), or a project admin can take the trigger over first. The message names the owner and the target. **Details** None. **Example** ```json excerpt { "error": { "code": "trigger-owner-cannot-run-target", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/schedules`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesregister.md) - [`PATCH /v1/schedules/{triggerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesupdate.md) - [`POST /v1/schedules/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulestakeownership.md) - [`POST /v1/webhooks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksregister.md) - [`POST /v1/webhooks/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhookstakeownership.md) - [`POST /v1/mail-triggers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mailtriggersregister.md) - 2 more operations name it in their responses ### `trigger-webhook-id-conflict` **Synopsis** `409 Conflict`, code `trigger-webhook-id-conflict` A webhook trigger with that `webhookId` is already registered for your tenant. Pick another id. **Details** None. **Example** ```json excerpt { "error": { "code": "trigger-webhook-id-conflict", "message": "…", "requestId": "…" } } ``` **See also** - [Start runs from WooCommerce, Drupal or any signed webhook](https://docs.kindgi.com/v0.4.0/guides/webhooks/start-runs-from-webhooks.md) ### `version-already-exists` **Synopsis** `409 Conflict`, code `version-already-exists` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "version-already-exists", "message": "…", "requestId": "…" } } ``` **See also** - [Suggest a change, and test it](https://docs.kindgi.com/v0.4.0/guides/improve/suggest-a-change.md) ### `wait-token-closed` **Synopsis** `409 Conflict`, code `wait-token-closed` The wait is over, so it takes no other answer: it already took a different answer, its time passed, its run was cancelled, or its tool call answered without waiting or was retried and waits on a new link. Sending the answer it took again is accepted, not refused. **Details** - `state`: why the wait is over: `answered` or `completed` (it took a different answer), `timed-out`, `cancelled` or `unused` **Example** ```json excerpt { "error": { "code": "wait-token-closed", "message": "…", "details": { "state": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) - [`POST /v1/wait-tokens/{token}/complete`](https://docs.kindgi.com/v0.4.0/reference/api/operations/waittokenscomplete.md) ### `waitpoint-error` **Synopsis** `409 Conflict`, code `waitpoint-error` The wait token the approval or cancel targets isn't pending any more: no pending token, or it was already resolved or cancelled. **Details** - `tokenId`: the wait token **Example** ```json excerpt { "error": { "code": "waitpoint-error", "message": "…", "details": { "tokenId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/approvals/{approvalId}/complete`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalscomplete.md) ## 410 Gone ### `agent-gone` **Synopsis** `410 Gone`, code `agent-gone` The agent has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one. **Details** - `agentId`: the agent id **Example** ```json excerpt { "error": { "code": "agent-gone", "message": "…", "details": { "agentId": "…" }, "requestId": "…" } } ``` **See also** - [Agent and tool versions](https://docs.kindgi.com/v0.4.0/guides/agents/agent-and-tool-versions.md) ### `connection-request-expired` **Synopsis** `410 Gone`, code `connection-request-expired` The connect request expired before it was used. Start a new connect. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-request-expired", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) - [`POST /v1/connections/requests/{requestId}/start`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsrequestsstart.md) ### `connection-state-expired` **Synopsis** `410 Gone`, code `connection-state-expired` The sign-in at the app took longer than its state lives. Start the connect again. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-state-expired", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) ### `flow-gone` **Synopsis** `410 Gone`, code `flow-gone` The flow has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one. **Details** - `flowId`: the flow id **Example** ```json excerpt { "error": { "code": "flow-gone", "message": "…", "details": { "flowId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/flows/{flowId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspinnedpin.md) - [`GET /v1/flows/{flowId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowsget.md) ### `policy-gone` **Synopsis** `410 Gone`, code `policy-gone` The policy has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one. **Details** - `policyId`: the policy id **Example** ```json excerpt { "error": { "code": "policy-gone", "message": "…", "details": { "policyId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/policies/{policyId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/policiesget.md) ### `run-erased` **Synopsis** `410 Gone`, code `run-erased` An erasure cleared the run's content (a person's words were removed), so there is nothing to correct or replay. **Details** None. **Example** ```json excerpt { "error": { "code": "run-erased", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/test-set/cases`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentstestsetaddcase.md) - [`POST /v1/corrections`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctionscreate.md) ### `test-set-gone` **Synopsis** `410 Gone`, code `test-set-gone` The test set has no active versions left; it exists but every version is unregistered. Reinstate a version or publish a new one. **Details** - `testSetId`: the test set id **Example** ```json excerpt { "error": { "code": "test-set-gone", "message": "…", "details": { "testSetId": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/test-sets/{testSetId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testsetsget.md) ### `tool-gone` **Synopsis** `410 Gone`, code `tool-gone` The tool existed but has no active version left, so it can't be read or run. Reinstate a retired version or publish a new one. **Details** - `toolId`: the tool's id **Example** ```json excerpt { "error": { "code": "tool-gone", "message": "…", "details": { "toolId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/tools/{toolId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolspinnedpin.md) - [`GET /v1/tools/{toolId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsget.md) ### `webhook-gone` **Synopsis** `410 Gone`, code `webhook-gone` The webhook trigger the request is addressed to was unregistered. Only a sender that signs correctly learns this. **Details** None. **Example** ```json excerpt { "error": { "code": "webhook-gone", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/hooksreceive.md) ## 413 Content Too Large ### `artifact-too-large` **Synopsis** `413 Content Too Large`, code `artifact-too-large` The uploaded artifact is larger than the upload cap. Upload a smaller file. **Details** - `maxBytes`: the largest accepted size, in bytes **Example** ```json excerpt { "error": { "code": "artifact-too-large", "message": "…", "details": { "maxBytes": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/artifacts`](https://docs.kindgi.com/v0.4.0/reference/api/operations/artifactsupload.md) ### `request-too-large` **Synopsis** `413 Content Too Large`, code `request-too-large` The request body is larger than the API's limit. Send a smaller body. An artifact upload and a webhook delivery have limits of their own (`artifact-too-large`, `webhook-body-too-large`). **Details** - `maxBytes`: the largest accepted body, in bytes **Example** ```json excerpt { "error": { "code": "request-too-large", "message": "…", "details": { "maxBytes": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) - [`POST /v1/signing-keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeystrust.md) - [`POST /v1/signing-keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeysrevoke.md) - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) - 130 more operations name it in their responses ### `site-request-too-large` **Synopsis** `413 Content Too Large`, code `site-request-too-large` A body sent to `POST /v1/auth/sites/enroll` or `POST /v1/auth/site-sign-in` is over 4096 bytes. Those routes take a few small fields: send only those. **Details** None. **Example** ```json excerpt { "error": { "code": "site-request-too-large", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/auth/sites/enroll`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authsitesenroll.md) - [`POST /v1/auth/site-sign-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authsitesignin.md) ### `webhook-body-too-large` **Synopsis** `413 Content Too Large`, code `webhook-body-too-large` The request body is larger than the receiver takes: the receiver's overall cap, or the trigger's own `bodyLimitBytes`. **Details** None. **Example** ```json excerpt { "error": { "code": "webhook-body-too-large", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/hooksreceive.md) ## 415 Unsupported Media Type ### `unsupported-media-type` **Synopsis** `415 Unsupported Media Type`, code `unsupported-media-type` The body isn't JSON where the route takes JSON alone: an answer to a wait (`POST /v1/wait-tokens/{token}/complete`) is sent with `Content-Type: application/json`, or with no body at all. **Details** None. **Example** ```json excerpt { "error": { "code": "unsupported-media-type", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/wait-tokens/{token}/complete`](https://docs.kindgi.com/v0.4.0/reference/api/operations/waittokenscomplete.md) ## 422 Unprocessable Content ### `agent-turn-aborted` **Synopsis** `422 Unprocessable Content`, code `agent-turn-aborted` The agent's turn was cancelled or timed out before it finished. **Details** - `reason`: `external` when cancelled by a caller, `timeout` when it ran out of time - `runId`: the run that was aborted **Example** ```json excerpt { "error": { "code": "agent-turn-aborted", "message": "…", "details": { "reason": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Set an agent's budget](https://docs.kindgi.com/v0.4.0/guides/agents/budgets.md) ### `block-unresolvable` **Synopsis** `422 Unprocessable Content`, code `block-unresolvable` A data block the agent uses (its prompt, settings or model settings) can't be loaded: no published version matches its version range, the pinned version is gone, it's the other kind of block, or the runtime serves no blocks. Under `kindgi dev`, blocks come only from the pack's files: add the block under the pack's blocks folder, at a version the range takes. **Details** - `blockId`: the block - `requestedRange`: the version range or pin the agent asked for - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "block-unresolvable", "message": "…", "details": { "blockId": "…", "requestedRange": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Kindgi 0.2.0](https://docs.kindgi.com/v0.4.0/releases/0.2.0.md) - [Change a prompt or a setting without a deploy](https://docs.kindgi.com/v0.4.0/guides/improve/change-a-prompt-or-setting.md) ### `budget-exceeded` **Synopsis** `422 Unprocessable Content`, code `budget-exceeded` The agent's turn went over its budget: the cost cap, or the step cap while the model still wanted another tool call. Raise the budget or simplify the task. **Details** - `kind`: which budget: `steps` or `cost` (the type also allows `wall-time`) - `limit`: the cap reached: the agent's own, or, for steps, 32 when its `maxSteps` is higher, since a turn makes at most 32 model calls - `observed`: the value reached - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "budget-exceeded", "message": "…", "details": { "kind": "…", "limit": "…", "observed": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [See why runs failed](https://docs.kindgi.com/v0.4.0/guides/runs/see-why-runs-failed.md) - [Start a run](https://docs.kindgi.com/v0.4.0/guides/runs/start-a-run.md) ### `capability-routing-failed` **Synopsis** `422 Unprocessable Content`, code `capability-routing-failed` No model provider could take the agent's call: the agent declares no capabilities, or no provider meets them under your policy, or the pinned route is no longer allowed, or a provider registered for the tenant can't be set up on this runtime (the message says why; `GET /v1/providers/{providerId}/check` gives the adapter's words). **Details** - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "capability-routing-failed", "message": "…", "details": { "runId": "…" }, "requestId": "…" } } ``` **See also** - [See why runs failed](https://docs.kindgi.com/v0.4.0/guides/runs/see-why-runs-failed.md) ### `capability-unsatisfiable` **Synopsis** `422 Unprocessable Content`, code `capability-unsatisfiable` No registered model provider meets what the agent's capabilities ask for, after your organization's model policy is applied. It appears as the cause of capability-routing-failed. **Details** - `reasons`: per provider, why it was rejected (inside `cause`) - `tenantId`: the tenant whose policy applied, when one did (inside `cause`) **Example** ```json excerpt { "error": { "code": "capability-unsatisfiable", "message": "…", "details": { "reasons": "…", "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`capability-routing-failed`](https://docs.kindgi.com/v0.4.0/reference/errors.md#capability-routing-failed) - [Choose the model an agent uses](https://docs.kindgi.com/v0.4.0/guides/agents/choose-a-model.md) ### `dispatcher-not-registered` **Synopsis** `422 Unprocessable Content`, code `dispatcher-not-registered` The runtime has no test-run dispatcher for the test set's kind, so it can't start a run of that test set. **Details** - `evalKind`: the test set kind with no dispatcher **Example** ```json excerpt { "error": { "code": "dispatcher-not-registered", "message": "…", "details": { "evalKind": "…" }, "requestId": "…" } } ``` **See also** - [Try a version on the test cases](https://docs.kindgi.com/v0.4.0/guides/improve/compare-an-agent-version.md) ### `endpoint-host-not-allowed` **Synopsis** `422 Unprocessable Content`, code `endpoint-host-not-allowed` The pack service's host isn't on the operator's allowlist of pack hosts (`KINDGI_PACK_ENDPOINT_HOSTS`). Use a host the allowlist covers. The refusal is recorded as the deployment's `endpoint.problem`. **Details** None. **Example** ```json excerpt { "error": { "code": "endpoint-host-not-allowed", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) ### `endpoint-info-mismatch` **Synopsis** `422 Unprocessable Content`, code `endpoint-info-mismatch` The pack service answered `GET /v1/info` as another pack or version, so it doesn't serve this deployment's image. The refusal is recorded as the deployment's `endpoint.problem`. **Details** - `differs`: the names of the `/v1/info` fields that differed from the deployment's, never their values **Example** ```json excerpt { "error": { "code": "endpoint-info-mismatch", "message": "…", "details": { "differs": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) ### `endpoint-name-mismatch` **Synopsis** `422 Unprocessable Content`, code `endpoint-name-mismatch` The pack service's host doesn't name this deployment's own service. Each deployment's pack service runs under its own name, `packServiceName` in `@kindgi/api`. The refusal is recorded as the deployment's `endpoint.problem`. **Details** - `expected`: the deployment's pack service name, which the host must carry **Example** ```json excerpt { "error": { "code": "endpoint-name-mismatch", "message": "…", "details": { "expected": "…" }, "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) ### `endpoint-unreachable` **Synopsis** `422 Unprocessable Content`, code `endpoint-unreachable` The pack service didn't answer `GET /v1/info` as this deployment's service. Check that it runs and that the runtime can reach it, then set it again. The refusal is recorded as the deployment's `endpoint.problem`. **Details** None. **Example** ```json excerpt { "error": { "code": "endpoint-unreachable", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/endpoint`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentssetendpoint.md) ### `flow-resume-not-supported` **Synopsis** `422 Unprocessable Content`, code `flow-resume-not-supported` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "flow-resume-not-supported", "message": "…", "requestId": "…" } } ``` **See also** - [Wait for an approval](https://docs.kindgi.com/v0.4.0/guides/flows/wait-for-an-approval.md) ### `flow-runs-not-supported` **Synopsis** `422 Unprocessable Content`, code `flow-runs-not-supported` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "flow-runs-not-supported", "message": "…", "requestId": "…" } } ``` **See also** - [Write a flow](https://docs.kindgi.com/v0.4.0/guides/flows/write-a-flow.md) ### `flow-unbound` **Synopsis** `422 Unprocessable Content`, code `flow-unbound` The flow can't start or resume because a node has nothing to run it: a step names a tool the tenant doesn't have, an agent step can't bind, or a node kind isn't runnable. **Details** - `nodeIds`: the flow nodes that can't be bound **Example** ```json excerpt { "error": { "code": "flow-unbound", "message": "…", "details": { "nodeIds": "…" }, "requestId": "…" } } ``` **See also** - [Write a flow](https://docs.kindgi.com/v0.4.0/guides/flows/write-a-flow.md) - [Dry-run a flow](https://docs.kindgi.com/v0.4.0/guides/flows/dry-run-a-flow.md) ### `gate-failed` **Synopsis** `422 Unprocessable Content`, code `gate-failed` A release gate refused pinning the version because one or more of its checks failed. The refusal is recorded; read the failing checks and fix what they name. **Details** - `changeId`: the recorded refused pin request - `releaseGate`: the release gate that applied (id and version), or null - `checks`: every check the release gate ran, with whether each passed - `passing`: how many of the test run's cases pass, when the release gate has `cases.minPassing` - `needs`: how many cases the release gate needs to pass (`cases.minPassing`) - `newlyFailing`: the cases that passed before and fail now, by id, when the release gate has `cases.noNewFailures` - `suggestedChangeId`: the suggested change, when the request came through a suggested change **Example** ```json excerpt { "error": { "code": "gate-failed", "message": "…", "details": { "changeId": "…", "releaseGate": "…", "checks": "…", "passing": "…", "needs": "…", "newlyFailing": "…", "suggestedChangeId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangespin.md) - [Release an agent version](https://docs.kindgi.com/v0.4.0/guides/improve/release-an-agent-version.md) - [Kindgi 0.3.0](https://docs.kindgi.com/v0.4.0/releases/0.3.0.md) ### `guardrail-config-invalid` **Synopsis** `422 Unprocessable Content`, code `guardrail-config-invalid` The guardrail's `config` doesn't satisfy the config schema of the check it names, so the check would refuse it on every call. Fix the config and register again. **Details** - `issues`: one entry per problem found in the config **Example** ```json excerpt { "error": { "code": "guardrail-config-invalid", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/guardrails`](https://docs.kindgi.com/v0.4.0/reference/api/operations/guardrailsregister.md) ### `guardrail-violation` **Synopsis** `422 Unprocessable Content`, code `guardrail-violation` A blocking guardrail stopped the agent's turn, a halting guardrail's check couldn't run, or a `retry` guardrail's attempts ran out: at the final answer it sends each answer it fails back to the model for a new one, and in the agent loop it refuses a call, withholds a result or sends a reply back, until it has failed `retry.maxAttempts` answers or replies. The run fails; the violations say which guardrails fired, and `point` says where in the turn. **Details** - `violations`: the blocking guardrail results - `evaluationErrors`: guardrails whose check couldn't run (missing check, bad config) - `attempts`: the attempts the turn had when a `retry` guardrail's ran out, the first one included: its answers at the final answer, or in the agent loop its replies the guardrail sent back or refused or withheld a call of; absent when a `halt` guardrail stopped it - `point`: where in the turn the guardrails stopped it: `before-tool`, `after-tool` or `model-step`; absent at the final answer - `callId`: at `before-tool` and `after-tool`: the model's id for the call - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "guardrail-violation", "message": "…", "details": { "violations": "…", "evaluationErrors": "…", "attempts": "…", "point": "…", "callId": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Keep and purge deleted data](https://docs.kindgi.com/v0.4.0/deploy/retention.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Stop a turn or record a violation](https://docs.kindgi.com/v0.4.0/guides/guardrails/halt-or-record.md) ### `identity-provider-invalid` **Synopsis** `422 Unprocessable Content`, code `identity-provider-invalid` The deployment couldn't use the provider's configuration (for example, its issuer discovery failed or its SAML metadata didn't parse), or `kind` is `oauth2`, which sign-in doesn't use. **Details** - `providerId`: id of the provider being registered or changed; may be absent for an `oauth2` body without one **Example** ```json excerpt { "error": { "code": "identity-provider-invalid", "message": "…", "details": { "providerId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/auth/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authprovidersregister.md) - [`PATCH /v1/auth/providers/{providerId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/authprovidersupdate.md) ### `model-invocation-failed` **Synopsis** `422 Unprocessable Content`, code `model-invocation-failed` The model provider call failed, for example it refused the key or was rate limited, or the model's reply can't be used (for example, two of its tool calls share an id). When the call failed, the message carries the provider's own words. **Details** - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "model-invocation-failed", "message": "…", "details": { "runId": "…" }, "requestId": "…" } } ``` **See also** - [Security](https://docs.kindgi.com/v0.4.0/concepts/security.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Kindgi 0.1.8](https://docs.kindgi.com/v0.4.0/releases/0.1.8.md) ### `output-schema-violation` **Synopsis** `422 Unprocessable Content`, code `output-schema-violation` The agent declares an output schema and its final answer still didn't match after the allowed repair attempts. **Details** - `errors`: the schema problems from the last attempt - `attempts`: how many answers were checked - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "output-schema-violation", "message": "…", "details": { "errors": "…", "attempts": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Give an agent a typed answer](https://docs.kindgi.com/v0.4.0/guides/agents/typed-answer.md) - [Kindgi 0.2.0](https://docs.kindgi.com/v0.4.0/releases/0.2.0.md) - [Start runs from your app](https://docs.kindgi.com/v0.4.0/start/call-from-your-app.md) ### `provider-config-invalid` **Synopsis** `422 Unprocessable Content`, code `provider-config-invalid` The provider registration is refused: `send_traceparent` isn't a boolean, or the provider's adapter rejects its `adapter_config`, metadata or `secret_ref`. **Details** - `issues`: list of problems, each with a JSON-pointer path and a message **Example** ```json excerpt { "error": { "code": "provider-config-invalid", "message": "…", "details": { "issues": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/providers`](https://docs.kindgi.com/v0.4.0/reference/api/operations/providersregister.md) - [Models](https://docs.kindgi.com/v0.4.0/guides/models.md) ### `run-resume-not-supported` **Synopsis** `422 Unprocessable Content`, code `run-resume-not-supported` Resuming a run at this waitpoint through `POST /v1/runs/{runId}/resume` isn't available. Only a run paused until another system answers (a `pause:` waitpoint) resumes there, on a server that pauses runs. A run waiting for an approval continues when a reviewer decides it. **Details** None. **Example** ```json excerpt { "error": { "code": "run-resume-not-supported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) ### `runtime-not-configured` **Synopsis** `422 Unprocessable Content`, code `runtime-not-configured` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "runtime-not-configured", "message": "…", "requestId": "…" } } ``` **See also** - [Models](https://docs.kindgi.com/v0.4.0/guides/models.md) ### `semantic-unavailable` **Synopsis** `422 Unprocessable Content`, code `semantic-unavailable` A search by meaning (`semantic`, or the agent's semantic retrieval) can't run because the deployment has no embeddings or the embedding provider isn't answering. Use keyword or `both` mode, or ask an admin. **Details** - `intent`: for an agent turn: the position of the retrieval intent that failed **Example** ```json excerpt { "error": { "code": "semantic-unavailable", "message": "…", "details": { "intent": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/memory/retrieve`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memoryretrieve.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) - [Memory reference](https://docs.kindgi.com/v0.4.0/guides/agents/memory-reference.md) ### `tool-invocation-failed` **Synopsis** `422 Unprocessable Content`, code `tool-invocation-failed` A tool the agent called failed, and the agent's tool-error policy didn't let the model recover. The message carries the tool's own error. **Details** - `toolId`: the tool that failed - `validationIssues`: when the model's arguments broke the tool's input schema: the validator's issues - `receivedInput`: with validationIssues: the arguments the model sent, truncated - `toolRetries`: failed calls already sent back to the model, when retries ran out - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "tool-invocation-failed", "message": "…", "details": { "toolId": "…", "validationIssues": "…", "receivedInput": "…", "toolRetries": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Limits](https://docs.kindgi.com/v0.4.0/hosted/limits.md) - [Write a tool](https://docs.kindgi.com/v0.4.0/guides/tools/write-a-tool.md) - [See why runs failed](https://docs.kindgi.com/v0.4.0/guides/runs/see-why-runs-failed.md) ### `tool-version-unresolvable` **Synopsis** `422 Unprocessable Content`, code `tool-version-unresolvable` No registered version of a tool the agent uses matches its version range, or the pinned version is no longer registered. Publish a matching version or fix the range. **Details** - `toolId`: the tool - `requestedRange`: the version range or pin the agent asked for - `availableVersions`: versions that are registered, when known - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "tool-version-unresolvable", "message": "…", "details": { "toolId": "…", "requestedRange": "…", "availableVersions": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Kindgi 0.2.0](https://docs.kindgi.com/v0.4.0/releases/0.2.0.md) - [Agent and tool versions](https://docs.kindgi.com/v0.4.0/guides/agents/agent-and-tool-versions.md) ## 429 Too Many Requests ### `approvals-pending-limit` **Synopsis** `429 Too Many Requests`, code `approvals-pending-limit` A gate asked for an approval while the tenant's approvals waiting for a decision were at its limit (set by whoever runs the server). Nothing waits for an approval nobody can see: the step fails, naming the limit. `POST /v1/runs` answers `429` when the call waits for its run; with `options.wait: false` it answers `202`, and the run fails with this code. A request to pin a version whose release gate wants an approval is refused with it. Once some of the approvals waiting are decided, try again. **Details** - `approvalsPending`: the tenant's limit on approvals waiting for a decision; absent when the server doesn't name it - `pinned`: from a deployment promotion with `pin`, when some were: the carried agents pinned before this one, in the answer's `pinned` shape **Example** ```json excerpt { "error": { "code": "approvals-pending-limit", "message": "…", "details": { "approvalsPending": "…", "pinned": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [Limits](https://docs.kindgi.com/v0.4.0/hosted/limits.md) ### `invite-capped` **Synopsis** `429 Too Many Requests`, code `invite-capped` Too many invitations sent: to this person, from the tenant, or from the whole deployment. The limits are the server's. Nothing changed and nothing was sent. Try again after the `Retry-After` header, or, if their invitation hasn't expired, tell them to sign in. **Details** - `userId`: the person whose invitation was to be sent again **Example** ```json excerpt { "error": { "code": "invite-capped", "message": "…", "details": { "userId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/identity/users/{userId}/invite`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersresendinvite.md) ### `rate-limit-exceeded` **Synopsis** `429 Too Many Requests`, code `rate-limit-exceeded` You sent too many requests, or a tenant reached one of its limits: a webhook trigger got more deliveries than its per-minute limit, a client sent too many refused webhook requests, too many sign-in lookups came from one source, a client sent wait tokens' links more than 600 requests in a minute, or the tenant reached its limit on API requests or webhook deliveries a minute, or on runs waiting to start. A tenant's API requests to `/v1` and `/s3` count together; on `/s3`, its limit answers as S3 does, with `503 SlowDown` and `Retry-After`, not with this code. On a server with budgets kept per tenant (Kindgi Cloud), it's also the answer when the tenant's schemas took their budget compiling, or its instructions templates rendering, in the last 60 seconds; an agent's turn refused this way fails its run with this code. A deploy is refused with it too when the tenant's image reads unpacked as much as they may in an hour. Retry after the `Retry-After` header; a refusal by the limit on runs waiting to start has none: retry once some have started. **Details** - `limit`: the tenant's limit that was reached: `api-requests`, `webhook-receives`, `runs-pending`, a budget, `schema-compile-time` or `template-render-time`, or `tenant-unpack-hour`, its image reads in the last hour. Absent when the limit isn't the tenant's - `runsPending`: the tenant's limit on runs waiting to start, on a `runs-pending` refusal; absent when the server doesn't name it - `budgetMs`: for a budget, the milliseconds the tenant's work of that kind may take in 60 seconds - `runId`: when a budget refused an agent's turn, the run the turn belongs to **Example** ```json excerpt { "error": { "code": "rate-limit-exceeded", "message": "…", "details": { "limit": "…", "runsPending": "…", "budgetMs": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/agents`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspublish.md) - [`POST /v1/flows`](https://docs.kindgi.com/v0.4.0/reference/api/operations/flowspublish.md) - [`POST /v1/tools`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolsregister.md) - [`POST /v1/guardrails`](https://docs.kindgi.com/v0.4.0/reference/api/operations/guardrailsregister.md) - [`POST /v1/suggested-changes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescreate.md) - 9 more operations name it in their responses - [Kindgi 0.1.8](https://docs.kindgi.com/v0.4.0/releases/0.1.8.md) ### `second-factor-locked` **Synopsis** `429 Too Many Requests`, code `second-factor-locked` Too many wrong codes lately for this person: no code is checked until the `Retry-After` header says. Nothing changed. **Details** None. **Example** ```json excerpt { "error": { "code": "second-factor-locked", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/identity/me/second-factor`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymestartsecondfactor.md) - [`POST /v1/identity/me/second-factor/confirm`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeconfirmsecondfactor.md) - [`POST /v1/identity/me/second-factor/recovery-codes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymenewrecoverycodes.md) - [`POST /v1/identity/me/second-factor/remove`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymeremovesecondfactor.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ### `secret-provider-rate-limited` **Synopsis** `429 Too Many Requests`, code `secret-provider-rate-limited` The external secret provider is rate limiting the runtime. Wait and retry. **Details** - `retryAfterMs`: how long the provider asked to wait, in milliseconds, when it said (in binding results) **Example** ```json excerpt { "error": { "code": "secret-provider-rate-limited", "message": "…", "details": { "retryAfterMs": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantconfigupsert.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrotate.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) ### `turn-memory-limit-reached` **Synopsis** `429 Too Many Requests`, code `turn-memory-limit-reached` The runtime's agent turns hold more memory than its limit leaves this turn: the tenant's share (`KINDGI_TURN_MEMORY_PER_TENANT_MIB`) or the runtime's whole (`KINDGI_TURN_MEMORY_MIB`). The turn's run fails, and every tool call it finished is in the conversation, so a new turn there doesn't call it again. Retry later, or use a smaller conversation. **Details** - `limit`: `tenant` or `server`: which limit refused the turn - `heldBytes`: what that limit's turns held, in bytes - `limitBytes`: the limit, in bytes - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "turn-memory-limit-reached", "message": "…", "details": { "limit": "…", "heldBytes": "…", "limitBytes": "…", "runId": "…" }, "requestId": "…" } } ``` **See also** - [Limits](https://docs.kindgi.com/v0.4.0/hosted/limits.md) - [`GET /v1/runs/{runId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsget.md) - [Environment variables](https://docs.kindgi.com/v0.4.0/reference/env-vars.md) ## 500 Internal Server Error ### `blob-storage-error` **Synopsis** `500 Internal Server Error`, code `blob-storage-error` The runtime's artifact storage failed while reading or writing the bytes. Retry; contact the operator if it persists. **Details** None. **Example** ```json excerpt { "error": { "code": "blob-storage-error", "message": "…", "requestId": "…" } } ``` **See also** - [Keep files with a run](https://docs.kindgi.com/v0.4.0/guides/runs/keep-files-with-a-run.md) ### `compliance-export-failed` **Synopsis** `500 Internal Server Error`, code `compliance-export-failed` Signing the compliance evidence export failed on the server. Retry; if it persists, contact the operator. **Details** None. **Example** ```json excerpt { "error": { "code": "compliance-export-failed", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/compliance/evidence/export`](https://docs.kindgi.com/v0.4.0/reference/api/operations/complianceevidenceexport.md) ### `env-store-error` **Synopsis** `500 Internal Server Error`, code `env-store-error` The env store failed, for example a database error, so the entry wasn't read or written. **Details** None. **Example** ```json excerpt { "error": { "code": "env-store-error", "message": "…", "requestId": "…" } } ``` **See also** - [Set values per environment](https://docs.kindgi.com/v0.4.0/guides/secrets/per-environment-values.md) ### `export-key-error` **Synopsis** `500 Internal Server Error`, code `export-key-error` Signing the export with the deployment's export key failed. The reason is in the runtime's log, not the message. **Details** None. **Example** ```json excerpt { "error": { "code": "export-key-error", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/approvals/{approvalId}/audit-bundle`](https://docs.kindgi.com/v0.4.0/reference/api/operations/approvalsauditbundle.md) - [`POST /v1/provenance/{runId}/export`](https://docs.kindgi.com/v0.4.0/reference/api/operations/provenanceexport.md) ### `identity-revoke-failed` **Synopsis** `500 Internal Server Error`, code `identity-revoke-failed` Revoking all of a user's sessions failed on the server. Retry; if it persists, contact the operator. **Details** - `userId`: the user whose sessions were being revoked **Example** ```json excerpt { "error": { "code": "identity-revoke-failed", "message": "…", "details": { "userId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/identity/users/{userId}/revoke-sessions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersrevokesessions.md) ### `internal-server-error` **Synopsis** `500 Internal Server Error`, code `internal-server-error` The server hit an unexpected error while handling the request. Retry; if it persists, contact support with the `requestId`. **Details** None. **Example** ```json excerpt { "error": { "code": "internal-server-error", "message": "…", "requestId": "…" } } ``` **See also** - [Kindgi 0.1.10](https://docs.kindgi.com/v0.4.0/releases/0.1.10.md) - [`GET /v1/deployments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentslist.md) ### `journal-error` **Synopsis** `500 Internal Server Error`, code `journal-error` The run's record couldn't be written or read back: the run was started but its row isn't readable, or it couldn't be started or reloaded after cancelling. **Details** None. **Example** ```json excerpt { "error": { "code": "journal-error", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/runs/{runId}/cancel`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runscancel.md) ### `persistence-error` **Synopsis** `500 Internal Server Error`, code `persistence-error` The runtime couldn't read or write its storage. Retry; if it persists, contact support. **Details** None. **Example** ```json excerpt { "error": { "code": "persistence-error", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/corrections/export`](https://docs.kindgi.com/v0.4.0/reference/api/operations/correctionsexport.md) - [Stop a turn or record a violation](https://docs.kindgi.com/v0.4.0/guides/guardrails/halt-or-record.md) - [`GET /v1/audit/authz`](https://docs.kindgi.com/v0.4.0/reference/api/operations/auditauthzlist.md) ### `secret-decryption-failed` **Synopsis** `500 Internal Server Error`, code `secret-decryption-failed` The runtime couldn't decrypt a stored secret value (the key service failed to unwrap its key). **Details** None. **Example** ```json excerpt { "error": { "code": "secret-decryption-failed", "message": "…", "requestId": "…" } } ``` **See also** - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) ### `secret-encryption-failed` **Synopsis** `500 Internal Server Error`, code `secret-encryption-failed` The runtime couldn't encrypt the secret value (the key service refused to produce a data key), so nothing was stored. **Details** None. **Example** ```json excerpt { "error": { "code": "secret-encryption-failed", "message": "…", "requestId": "…" } } ``` **See also** - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) ### `secret-store-error` **Synopsis** `500 Internal Server Error`, code `secret-store-error` The secrets store failed in a way the other secret codes don't cover, such as a database error, an invalid name for the store, or a provider feature it doesn't support. With your own secret manager, it's also the answer for a secret stored under a name outside the rule for new names: store its value again under a name that fits. **Details** None. **Example** ```json excerpt { "error": { "code": "secret-store-error", "message": "…", "requestId": "…" } } ``` **See also** - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) - [Kindgi 0.1.10](https://docs.kindgi.com/v0.4.0/releases/0.1.10.md) - [Store a secret](https://docs.kindgi.com/v0.4.0/guides/secrets/store-a-secret.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) ### `signing-key-store-error` **Synopsis** `500 Internal Server Error`, code `signing-key-store-error` The API doesn't send this code. **Details** None. **Example** ```json excerpt { "error": { "code": "signing-key-store-error", "message": "…", "requestId": "…" } } ``` **See also** - [Export signed evidence](https://docs.kindgi.com/v0.4.0/guides/observability/export-signed-evidence.md) ### `stuck` **Synopsis** `500 Internal Server Error`, code `stuck` A flow run reached a point where no step is ready and no branch is left to decide, so the run fails. Check the flow's edges and their conditions. **Details** - `runId`: the run that failed **Example** ```json excerpt { "error": { "code": "stuck", "message": "…", "details": { "runId": "…" }, "requestId": "…" } } ``` **See also** - [Branch a flow](https://docs.kindgi.com/v0.4.0/guides/flows/branch-a-flow.md) - [Dry-run a flow](https://docs.kindgi.com/v0.4.0/guides/flows/dry-run-a-flow.md) ### `token-mint-failed` **Synopsis** `500 Internal Server Error`, code `token-mint-failed` The runtime couldn't sign a public run token, for example because it has no usable signing key. Report it to an admin of the deployment. **Details** None. **Example** ```json excerpt { "error": { "code": "token-mint-failed", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tokens/public`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmintpublic.md) ### `trigger-lifecycle-failed` **Synopsis** `500 Internal Server Error`, code `trigger-lifecycle-failed` The runtime couldn't pause, resume or fire the trigger because of a storage error. **Details** - `triggerId`: the trigger id **Example** ```json excerpt { "error": { "code": "trigger-lifecycle-failed", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } } ``` **See also** - [Run on a schedule](https://docs.kindgi.com/v0.4.0/guides/runs/run-on-a-schedule.md) ### `trigger-register-failed` **Synopsis** `500 Internal Server Error`, code `trigger-register-failed` The runtime couldn't save the new trigger because of a storage error. **Details** None. **Example** ```json excerpt { "error": { "code": "trigger-register-failed", "message": "…", "requestId": "…" } } ``` **See also** - [Run on a schedule](https://docs.kindgi.com/v0.4.0/guides/runs/run-on-a-schedule.md) ### `trigger-update-failed` **Synopsis** `500 Internal Server Error`, code `trigger-update-failed` The runtime couldn't update the trigger because of a storage error. **Details** - `triggerId`: the trigger id **Example** ```json excerpt { "error": { "code": "trigger-update-failed", "message": "…", "details": { "triggerId": "…" }, "requestId": "…" } } ``` **See also** - [Run on a schedule](https://docs.kindgi.com/v0.4.0/guides/runs/run-on-a-schedule.md) ## 501 Not Implemented ### `agent-owner-unsupported` **Synopsis** `501 Not Implemented`, code `agent-owner-unsupported` The runtime's agent store doesn't keep an owner, so an agent's owner can't be set. Nothing changed. **Details** None. **Example** ```json excerpt { "error": { "code": "agent-owner-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/agents/{agentId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentssetowner.md) ### `authz-membership-unsupported` **Synopsis** `501 Not Implemented`, code `authz-membership-unsupported` Authorization is enforced, and the runtime can't change a team or membership together with its permissions, so it refuses and changes nothing. **Details** - `method`: the missing operation in the runtime's tenant-hierarchy binding **Example** ```json excerpt { "error": { "code": "authz-membership-unsupported", "message": "…", "details": { "method": "…" }, "requestId": "…" } } ``` **See also** - [`DELETE /v1/teams/{teamId}/memberships/{userId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/teamsmembershipsremove.md) - [`PATCH /v1/teams/{teamId}/memberships/{userId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/teamsmembershipsupdaterole.md) - [`POST /v1/projects/{projectId}/team-grants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsteamgrantsadd.md) - [`PATCH /v1/projects/{projectId}/team-grants/{teamId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsteamgrantsupdaterole.md) - [`DELETE /v1/projects/{projectId}/team-grants/{teamId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsteamgrantsremove.md) - [`DELETE /v1/projects/{projectId}/memberships/{userId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsmembershipsremove.md) - 1 more operations name it in their responses ### `cloud-secrets-unsupported` **Synopsis** `501 Not Implemented`, code `cloud-secrets-unsupported` This runtime keeps no cloud secrets, so no env name is set to one: `KINDGI_ENV_CLOUD_SECRETS` is off, its default, as on Kindgi Cloud. The operator turns it on, with `KINDGI_PACK_ROUTING=per-deployment`, where the pack services' account can read the secrets it names. Answered on the system routes that set, list and remove them, on a tenant's list of them, and on a tenant's `PUT /v1/env/{name}` with a `cloudSecret`: there it comes before `cloud-secret-system-only`. **Details** None. **Example** ```json excerpt { "error": { "code": "cloud-secrets-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvsetcloudsecret.md) - [`DELETE /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvdeletecloudsecret.md) - [`GET /v1/system/tenants/{tenantId}/env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvlistcloudsecrets.md) - [`GET /v1/env/cloud-secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envlistcloudsecrets.md) - [`PUT /v1/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/envput.md) - [`PUT /v1/system/tenants/{tenantId}/env/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemenvsetcloudsecret.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) ### `conversation-unregister-unsupported` **Synopsis** `501 Not Implemented`, code `conversation-unregister-unsupported` This runtime can't unregister conversations. **Details** None. **Example** ```json excerpt { "error": { "code": "conversation-unregister-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/conversations/{conversationId}/unregister`](https://docs.kindgi.com/v0.4.0/reference/api/operations/conversationsunregister.md) ### `environments-unsupported` **Synopsis** `501 Not Implemented`, code `environments-unsupported` The runtime's env store or secrets store can't list the env names it holds, so the tenant's environments can't be listed whole. The message names the store. **Details** None. **Example** ```json excerpt { "error": { "code": "environments-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/environments`](https://docs.kindgi.com/v0.4.0/reference/api/operations/environmentslist.md) ### `guardrail-outcomes-not-supported` **Synopsis** `501 Not Implemented`, code `guardrail-outcomes-not-supported` This deployment doesn't record guardrail outcomes. **Details** None. **Example** ```json excerpt { "error": { "code": "guardrail-outcomes-not-supported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/guardrails/{guardrailId}/outcomes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/guardrailsoutcomes.md) ### `improve-unsupported` **Synopsis** `501 Not Implemented`, code `improve-unsupported` This runtime doesn't run Improve. **Details** None. **Example** ```json excerpt { "error": { "code": "improve-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/improve-runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunsstart.md) - [`GET /v1/improve-runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunslist.md) - [`POST /v1/improve-runs/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunscheck.md) - [`GET /v1/improve-runs/{improveRunId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunsget.md) - [`POST /v1/improve-runs/{improveRunId}/cancel`](https://docs.kindgi.com/v0.4.0/reference/api/operations/improverunscancel.md) ### `memory-operation-unsupported` **Synopsis** `501 Not Implemented`, code `memory-operation-unsupported` This runtime's memory doesn't support the operation: listing fact history, deleting facts or verifying facts. **Details** None. **Example** ```json excerpt { "error": { "code": "memory-operation-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`DELETE /v1/memory/facts/{factId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memorydeletefact.md) - [`GET /v1/memory/facts/{factId}/revisions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memorylistfactrevisions.md) - [`POST /v1/memory/facts/{factId}/verify`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memoryverifyfact.md) - [`POST /v1/memory/retrieve`](https://docs.kindgi.com/v0.4.0/reference/api/operations/memoryretrieve.md) - [Memory reference](https://docs.kindgi.com/v0.4.0/guides/agents/memory-reference.md) ### `orchestrator-round-unsupported` **Synopsis** `501 Not Implemented`, code `orchestrator-round-unsupported` This server keeps no orchestrator round, so it can't hold one pass at a time. Run one orchestrator pass at a time by other means, or upgrade the server. **Details** None. **Example** ```json excerpt { "error": { "code": "orchestrator-round-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/system/deployments/round`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsclaimround.md) - [`POST /v1/system/deployments/round/end`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsendround.md) - [`POST /v1/system/deployments/round`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsclaimround.md) - [`POST /v1/system/deployments/round/end`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsendround.md) ### `pack-env-not-served` **Synopsis** `501 Not Implemented`, code `pack-env-not-served` This server doesn't give a deployment's pack service the env its pack declares, so it lists none of its names: its pack services take theirs from how they're run. `kindgi env plan` lists the names a pack reads. **Details** None. **Example** ```json excerpt { "error": { "code": "pack-env-not-served", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspackenv.md) - [`GET /v1/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspackenv.md) ### `pack-env-secrets-unaudited` **Synopsis** `501 Not Implemented`, code `pack-env-secrets-unaudited` A deployment's secret values were asked for (`secrets=values`) on a server with nowhere to audit them, so none is read or given. The server's operator sets up its audit store. A request without `secrets=values` isn't refused for this. A pack service held for this shows it as its deployment's problem: the platform's to fix, with nothing for the pack's owner to do. **Details** None. **Example** ```json excerpt { "error": { "code": "pack-env-secrets-unaudited", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) - [Declare the environment your code reads](https://docs.kindgi.com/v0.4.0/guides/secrets/pack-env.md) - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) ### `pack-env-unsupported` **Synopsis** `501 Not Implemented`, code `pack-env-unsupported` This server doesn't give a pack service its declared env: its pack services take theirs from how they're run. The system pack env routes answer this on a server that doesn't run a pack service per deployment. **Details** None. **Example** ```json excerpt { "error": { "code": "pack-env-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/system/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentslistpackenvchanged.md) - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordpackenv.md) - [`GET /v1/system/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentslistpackenvchanged.md) - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) - [`PUT /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsrecordpackenv.md) ### `permissions-unsupported` **Synopsis** `501 Not Implemented`, code `permissions-unsupported` The runtime runs without an authorization store, so it can't say what the caller may do. Read whoami's `tenantAdmin` and `reviewerRole` instead. **Details** None. **Example** ```json excerpt { "error": { "code": "permissions-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/identity/me/permissions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymepermissions.md) ### `person-grants-unsupported` **Synopsis** `501 Not Implemented`, code `person-grants-unsupported` The runtime runs without an authorization store, so it can't read or change a person's grants. **Details** None. **Example** ```json excerpt { "error": { "code": "person-grants-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/identity/users/{userId}/grants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersgrants.md) - [`POST /v1/identity/users/{userId}/grant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersgrant.md) - [`POST /v1/identity/users/{userId}/ungrant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identityusersungrant.md) ### `pin-gate-unsupported` **Synopsis** `501 Not Implemented`, code `pin-gate-unsupported` A release gate applies to this pin, and the deployment can't record a gated pin, so the pin is refused. From a deployment promotion with `pin`, the build has already moved and nothing is pinned in the target. **Details** None. **Example** ```json excerpt { "error": { "code": "pin-gate-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/agents/{agentId}/pinned/pin`](https://docs.kindgi.com/v0.4.0/reference/api/operations/agentspinnedpin.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [Kindgi 0.4.0](https://docs.kindgi.com/v0.4.0/releases/0.4.0.md) ### `pinned-versions-not-supported` **Synopsis** `501 Not Implemented`, code `pinned-versions-not-supported` This deployment can't list a project's pinned versions. **Details** None. **Example** ```json excerpt { "error": { "code": "pinned-versions-not-supported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/projects/{projectId}/pinned-versions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectspinnedversionslist.md) ### `production-unsupported` **Synopsis** `501 Not Implemented`, code `production-unsupported` This server's projects can't be put in production: its project store has no production setting. Every run there is a staging run. **Details** None. **Example** ```json excerpt { "error": { "code": "production-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/projects/{projectId}/production`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsproductionset.md) ### `project-access-unsupported` **Synopsis** `501 Not Implemented`, code `project-access-unsupported` The runtime has no authorization store, so it can't say who has access to the project. **Details** None. **Example** ```json excerpt { "error": { "code": "project-access-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/projects/{projectId}/access`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsaccesslist.md) ### `promotions-unsupported` **Synopsis** `501 Not Implemented`, code `promotions-unsupported` This runtime can't promote deployments: it has nowhere to write a promotion. The promotion check still answers. Nothing is written. From a deployment promotion with `pin` on a runtime that can't pin versions, the build has already moved and nothing is pinned in the target: promote without `pin` there. **Details** None. **Example** ```json excerpt { "error": { "code": "promotions-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) - [`POST /v1/deployments/{deploymentId}/promotions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentspromote.md) ### `repo-connection-unsupported` **Synopsis** `501 Not Implemented`, code `repo-connection-unsupported` This server can't connect a project to a repo: its project store keeps no repo connection, or, to set one, it has no connections. `kindgi blocks pull` still writes the versions that run into the pack's block files. **Details** None. **Example** ```json excerpt { "error": { "code": "repo-connection-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`PUT /v1/projects/{projectId}/repo-connection`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsrepoconnectionset.md) - [`DELETE /v1/projects/{projectId}/repo-connection`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsrepoconnectionclear.md) - [`PUT /v1/projects/{projectId}/repo-connection`](https://docs.kindgi.com/v0.4.0/reference/api/operations/projectsrepoconnectionset.md) ### `run-failures-not-supported` **Synopsis** `501 Not Implemented`, code `run-failures-not-supported` This deployment can't group failed runs by cause. **Details** None. **Example** ```json excerpt { "error": { "code": "run-failures-not-supported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/runs/failures`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsfailures.md) ### `runs-in-unsupported` **Synopsis** `501 Not Implemented`, code `runs-in-unsupported` This runtime doesn't read the agents' pins and Latest, so it can't say where a block's versions run (`GET /v1/blocks/{blockId}/runs-in`). **Details** None. **Example** ```json excerpt { "error": { "code": "runs-in-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/blocks/{blockId}/runs-in`](https://docs.kindgi.com/v0.4.0/reference/api/operations/blocksrunsin.md) - [`POST /v1/deployments/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentscheck.md) ### `secret-operation-unsupported` **Synopsis** `501 Not Implemented`, code `secret-operation-unsupported` The secrets store doesn't support this operation. Under `kindgi dev` secrets live in env files and have no versions or revocation, so edit or remove the name there. **Details** None. **Example** ```json excerpt { "error": { "code": "secret-operation-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`DELETE /v1/secrets/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrevoke.md) - [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrotate.md) ### `suggested-change-check-unsupported` **Synopsis** `501 Not Implemented`, code `suggested-change-check-unsupported` This runtime doesn't freeze a project's test set, so it can't make or check a suggested change. **Details** None. **Example** ```json excerpt { "error": { "code": "suggested-change-check-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/suggested-changes`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescreate.md) - [`POST /v1/suggested-changes/{suggestedChangeId}/check`](https://docs.kindgi.com/v0.4.0/reference/api/operations/suggestedchangescheck.md) - [`POST /v1/test-sets/{testSetId}/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/testrunsstart.md) ### `tenant-purge-unsupported` **Synopsis** `501 Not Implemented`, code `tenant-purge-unsupported` This runtime doesn't purge tenants through the API. **Details** None. **Example** ```json excerpt { "error": { "code": "tenant-purge-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants/{tenantId}/purge`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantspurge.md) ### `trigger-operation-unsupported` **Synopsis** `501 Not Implemented`, code `trigger-operation-unsupported` This deployment doesn't support the operation on triggers, such as listing a schedule's fire history or running it now. **Details** None. **Example** ```json excerpt { "error": { "code": "trigger-operation-unsupported", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/schedules`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesregister.md) - [`GET /v1/schedules/{triggerId}/fires`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesfires.md) - [`POST /v1/schedules/{triggerId}/run-now`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulesrunnow.md) - [`POST /v1/schedules/{triggerId}/owner`](https://docs.kindgi.com/v0.4.0/reference/api/operations/schedulestakeownership.md) - [`POST /v1/webhooks`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksregister.md) - [`GET /v1/webhooks/{triggerId}/fires`](https://docs.kindgi.com/v0.4.0/reference/api/operations/webhooksfires.md) - 4 more operations name it in their responses ## 502 Bad Gateway ### `authz-store-delete-failed` **Synopsis** `502 Bad Gateway`, code `authz-store-delete-failed` A purge's delete of the tenant's authorization store failed; the message gives OpenFGA's answer, if it gave one, and what that left. A tenant's rows go only after its store, so a failure before then leaves every row, though its artifacts' bytes may be deleted. Run the purge again once OpenFGA answers. **Details** - `tenantId`: the tenant **Example** ```json excerpt { "error": { "code": "authz-store-delete-failed", "message": "…", "details": { "tenantId": "…" }, "requestId": "…" } } ``` **See also** - [`POST /v1/system/tenants/{tenantId}/purge`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantspurge.md) ### `connection-app-refused` **Synopsis** `502 Bad Gateway`, code `connection-app-refused` The app refused or failed a call the connect needed, or didn't give what a connection needs (a refresh token, or which account signed in). Often the registration's client id, client secret or redirect URL doesn't match the app's settings. On GitHub, an install still waiting for an owner's approval is refused too, until an owner approves it. Start the connect again. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-app-refused", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) - [GitHub](https://docs.kindgi.com/v0.4.0/guides/connections/github.md) ### `mcp-prompt-get-failed` **Synopsis** `502 Bad Gateway`, code `mcp-prompt-get-failed` The runtime reached the MCP endpoint but listing its prompts or fetching the named prompt failed, for example because the remote server answered with a protocol error. **Details** - `endpointId`: id of the MCP endpoint - `promptName`: the prompt being fetched; present when fetching one prompt, not when listing **Example** ```json excerpt { "error": { "code": "mcp-prompt-get-failed", "message": "…", "details": { "endpointId": "…", "promptName": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/mcp/endpoints/{endpointId}/prompts`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointspromptslist.md) - [`POST /v1/mcp/endpoints/{endpointId}/prompts/{name}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointspromptsget.md) ### `mcp-resource-read-failed` **Synopsis** `502 Bad Gateway`, code `mcp-resource-read-failed` The runtime reached the MCP endpoint but listing or reading its resources failed, for example because the remote server answered with a protocol error. Retry later or check the endpoint. **Details** - `endpointId`: id of the MCP endpoint - `uri`: the resource URI being read; present when reading one resource, not when listing **Example** ```json excerpt { "error": { "code": "mcp-resource-read-failed", "message": "…", "details": { "endpointId": "…", "uri": "…" }, "requestId": "…" } } ``` **See also** - [`GET /v1/mcp/endpoints/{endpointId}/resources`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsresourceslist.md) - [`GET /v1/mcp/endpoints/{endpointId}/resources/{uri}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/mcpendpointsresourcesread.md) ### `secret-provider-unauthorized` **Synopsis** `502 Bad Gateway`, code `secret-provider-unauthorized` The external secret provider rejected the runtime's credentials, so the secret can't be read or written. Ask an admin to fix the provider access. **Details** None. **Example** ```json excerpt { "error": { "code": "secret-provider-unauthorized", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantconfigupsert.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrotate.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) ## 503 Service Unavailable ### `access-record-unavailable` **Synopsis** `503 Service Unavailable`, code `access-record-unavailable` The record of the operator's requests couldn't be written, so a system key's request did nothing. Retry after the `Retry-After` header. **Details** None. **Example** ```json excerpt { "error": { "code": "access-record-unavailable", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/system/keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysmint.md) - [`POST /v1/system/keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemkeysrevoke.md) - [`POST /v1/system/tenants`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantscreate.md) - [`PATCH /v1/system/tenants/{tenantId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsupdate.md) - [`POST /v1/system/tenants/{tenantId}/close`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantsclose.md) - [`PUT /v1/system/tenants/{tenantId}/suspended`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemtenantssetsuspended.md) - 10 more operations name it in their responses - [Serve many tenants](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/serve-many-tenants.md) ### `authz-backend-unavailable` **Synopsis** `503 Service Unavailable`, code `authz-backend-unavailable` The store that holds permissions couldn't be read, so the runtime can't tell what the caller may do. Try the request again shortly. **Details** None. **Example** ```json excerpt { "error": { "code": "authz-backend-unavailable", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/identity/me/permissions`](https://docs.kindgi.com/v0.4.0/reference/api/operations/identitymepermissions.md) ### `connection-notice-unavailable` **Synopsis** `503 Service Unavailable`, code `connection-notice-unavailable` The server couldn't handle an app's notice just now. The app sends it again. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-notice-unavailable", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connection-notices/{tenantId}/{appId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionnoticesreceive.md) ### `connection-store-failed` **Synopsis** `503 Service Unavailable`, code `connection-store-failed` The server couldn't read or write its connections (registrations, connect requests, connections or their tokens) just now. Try again; if it keeps failing, an operator checks the database and the secrets store. **Details** None. **Example** ```json excerpt { "error": { "code": "connection-store-failed", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/connections/finish`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsfinish.md) - [`DELETE /v1/connections/{connectionId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/connectionsdisconnect.md) ### `database-busy` **Synopsis** `503 Service Unavailable`, code `database-busy` The database was too busy to answer the read in time: a lock held by other work or a query past the database's time limit ended it, or no database connection came free within the server's wait. Only a `GET` or `HEAD` answers it. Retry after the `Retry-After` header. A request with any other method that the database was too busy for answers a 500 (`internal-server-error`, or the code of what failed, such as `persistence-error`), since it may have saved part of its work: check what it changed before you send it again. **Details** None. **Example** ```json excerpt { "error": { "code": "database-busy", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runslist.md) - [`GET /v1/runs/failures`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsfailures.md) - [`GET /v1/runs/{runId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsget.md) - [`GET /v1/runs/{runId}/journal`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsjournal.md) - [`GET /v1/runs/{runId}/stream`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstream.md) - [`GET /v1/runs/{runId}/progress`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsprogress.md) - 201 more operations name it in their responses - [Deploy on Google Cloud Run](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/cloud-run.md) - [Kindgi 0.1.10](https://docs.kindgi.com/v0.4.0/releases/0.1.10.md) - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) - [`GET /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runslist.md) - [Environment variables](https://docs.kindgi.com/v0.4.0/reference/env-vars.md) ### `idempotency-store-unavailable` **Synopsis** `503 Service Unavailable`, code `idempotency-store-unavailable` A write sent with an Idempotency-Key couldn't be checked against its key, because the store that keeps the keys couldn't be read, so the write didn't run and changed nothing. Retry with the same key after the `Retry-After` header. **Details** None. **Example** ```json excerpt { "error": { "code": "idempotency-store-unavailable", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/runs`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsstart.md) - [`POST /v1/runs/{runId}/cancel`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runscancel.md) - [`POST /v1/runs/{runId}/resume`](https://docs.kindgi.com/v0.4.0/reference/api/operations/runsresume.md) - [`POST /v1/signing-keys`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeystrust.md) - [`POST /v1/signing-keys/{keyId}/revoke`](https://docs.kindgi.com/v0.4.0/reference/api/operations/signingkeysrevoke.md) - [`POST /v1/tokens`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tokensmint.md) - 179 more operations name it in their responses - [Retry a start safely](https://docs.kindgi.com/v0.4.0/guides/runs/retry-a-start-safely.md) ### `pack-env-unavailable` **Synopsis** `503 Service Unavailable`, code `pack-env-unavailable` A deployment's pack env can't be given just now: its secret store failed or is rate-limited, a secret changed while it was read (twice), or the audit rows for its secrets weren't written. No value is given, and the message says which. Ask again; there's nothing for the pack's owner to do. **Details** None. **Example** ```json excerpt { "error": { "code": "pack-env-unavailable", "message": "…", "requestId": "…" } } ``` **See also** - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) - [`GET /v1/system/tenants/{tenantId}/deployments/{deploymentId}/pack-env`](https://docs.kindgi.com/v0.4.0/reference/api/operations/systemdeploymentsgetpackenv.md) ### `secret-provider-unavailable` **Synopsis** `503 Service Unavailable`, code `secret-provider-unavailable` The external secret provider can't be reached, or the active secrets store can't do provider-driven rotation, so send the new value yourself. **Details** None. **Example** ```json excerpt { "error": { "code": "secret-provider-unavailable", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/deployments/{deploymentId}/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/deploymentssyncsecrets.md) - [`PATCH /v1/tenant/config`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantconfigupsert.md) - [`POST /v1/secrets`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsset.md) - [`POST /v1/secrets/{name}/rotate`](https://docs.kindgi.com/v0.4.0/reference/api/operations/secretsrotate.md) - [Keep secrets in your own secret manager](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/secret-manager.md) ### `tenant-policy-unavailable` **Synopsis** `503 Service Unavailable`, code `tenant-policy-unavailable` A tenant policy that an agent turn must apply couldn't be loaded or evaluated, so the turn fails instead of running without it. **Details** - `policyKind`: the kind of policy that failed: `hitl`, `model-routing` or `tool-errors` **Example** ```json excerpt { "error": { "code": "tenant-policy-unavailable", "message": "…", "details": { "policyKind": "…" }, "requestId": "…" } } ``` **See also** - [Kindgi 0.1.9](https://docs.kindgi.com/v0.4.0/releases/0.1.9.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/operate.md) ### `tenant-state-unavailable` **Synopsis** `503 Service Unavailable`, code `tenant-state-unavailable` The tenant's state couldn't be read, so the request changed nothing. Retry after the `Retry-After` header. On the S3-compatible surface, the same answer is S3's `503 ServiceUnavailable`. **Details** None. **Example** ```json excerpt { "error": { "code": "tenant-state-unavailable", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/hooks/{tenantId}/{webhookId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/hooksreceive.md) - [`POST /v1/wait-tokens/{token}/complete`](https://docs.kindgi.com/v0.4.0/reference/api/operations/waittokenscomplete.md) - [`POST /v1/tool-files`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesstore.md) - [`GET /v1/tenant`](https://docs.kindgi.com/v0.4.0/reference/api/operations/tenantget.md) ### `tool-files-busy` **Synopsis** `503 Service Unavailable`, code `tool-files-busy` The runtime's memory for files had no room for the file's bytes in time, so nothing was stored or read. Send the request again after the `Retry-After` header. The pack service's runner fails the tool's call with it, as it fails any 5xx. **Details** None. **Example** ```json excerpt { "error": { "code": "tool-files-busy", "message": "…", "requestId": "…" } } ``` **See also** - [`POST /v1/tool-files`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesstore.md) - [`GET /v1/tool-files/{artifactId}`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesread.md) - [`POST /v1/tool-files`](https://docs.kindgi.com/v0.4.0/reference/api/operations/toolfilesstore.md) ## Codes with their own status These come from parts of a deployment that answer outside the API's routes: the build service, the console under `kindgi dev`, and sign-in. Each has the status shown, and the envelope without `requestId`. ### `tarball-hash-missing` **Synopsis** `400 Bad Request`, code `tarball-hash-missing` A request to the build service (the `build` endpoint `kindgi build` and `kindgi deploy` send packs to) has no `X-Content-SHA256` header. `kindgi build` sends it for you. **Details** None. **Example** ```json excerpt { "error": { "code": "tarball-hash-missing", "message": "…" } } ``` **See also** - [`kindgi build`](https://docs.kindgi.com/v0.4.0/reference/cli/build.md) ### `tarball-hash-invalid` **Synopsis** `400 Bad Request`, code `tarball-hash-invalid` The build request's `X-Content-SHA256` header isn't `sha256:` followed by 64 hex digits, or 64 hex digits alone. **Details** None. **Example** ```json excerpt { "error": { "code": "tarball-hash-invalid", "message": "…" } } ``` **See also** - [`kindgi build`](https://docs.kindgi.com/v0.4.0/reference/cli/build.md) ### `tarball-too-large` **Synopsis** `413 Content Too Large`, code `tarball-too-large` The pack sent to the build service is larger than 512 MiB. Leave build output and dependencies out of the pack. **Details** None. **Example** ```json excerpt { "error": { "code": "tarball-too-large", "message": "…" } } ``` **See also** - [`kindgi build`](https://docs.kindgi.com/v0.4.0/reference/cli/build.md) ### `tarball-hash-mismatch` **Synopsis** `400 Bad Request`, code `tarball-hash-mismatch` The pack the build service received doesn't hash to the `X-Content-SHA256` the request named, so it was changed or cut short on the way. Send it again. **Details** None. **Example** ```json excerpt { "error": { "code": "tarball-hash-mismatch", "message": "…" } } ``` **See also** - [`kindgi build`](https://docs.kindgi.com/v0.4.0/reference/cli/build.md) ### `build-job-not-found` **Synopsis** `404 Not Found`, code `build-job-not-found` The build service has no build job with that id. **Details** None. **Example** ```json excerpt { "error": { "code": "build-job-not-found", "message": "…" } } ``` **See also** - [`kindgi build`](https://docs.kindgi.com/v0.4.0/reference/cli/build.md) ### `build-job-gone` **Synopsis** `410 Gone`, code `build-job-gone` The build job ended longer ago than the build service keeps jobs, so its status and output are gone. Build again. **Details** None. **Example** ```json excerpt { "error": { "code": "build-job-gone", "message": "…" } } ``` **See also** - [`kindgi build`](https://docs.kindgi.com/v0.4.0/reference/cli/build.md) ### `forbidden` **Synopsis** `403 Forbidden`, code `forbidden` Under `kindgi dev`, the runtime gives the console its sign-in token only on the same machine (localhost, `127.0.0.1` or `[::1]`). Open the console from that machine. **Details** None. **Example** ```json excerpt { "error": { "code": "forbidden", "message": "…" } } ``` **See also** - [`kindgi dev`](https://docs.kindgi.com/v0.4.0/reference/cli/dev.md) - [`kindgi console`](https://docs.kindgi.com/v0.4.0/reference/cli/console.md) ### `sign-in-unavailable` **Synopsis** `500 Internal Server Error`, code `sign-in-unavailable` Signing in failed on the server: its database didn't answer, say, or an identity provider's settings can't start a sign-in, or a SAML response the provider's page posted was refused. Nothing about the cause is sent to the browser; a sign-in page shows the code instead of JSON. The runtime's log says why, as an `sso` warning: `sign-in request failed: `, `sign-in with provider didn't start: `, or `a SAML response for provider was refused: : `. Try again; when it keeps failing, the warning says what to fix. **Details** None. **Example** ```json excerpt { "error": { "code": "sign-in-unavailable", "message": "…" } } ``` **See also** - [Turn on sign-in](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/sign-in.md) ## access.kindgi.com `kindgi license renew` renews a deployment's license key at access.kindgi.com (`POST https://access.kindgi.com/v1/renew`). A refusal comes in that service's own shape, with no `code` wrapper and no `requestId`; the `message` says what to do, and the CLI prints it. ```json excerpt { "error": "unavailable", "message": "…" } ``` ### `bad-request` **Synopsis** `400 Bad Request`, error `bad-request` The body isn't a renewal request. A body over the size limit is answered the same way, with status `413`. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "bad-request", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `unauthorized` **Synopsis** `401 Unauthorized`, error `unauthorized` No renewer has this deployment's key, or the request's signature doesn't verify. Enroll the deployment with `kindgi license enroll`, then add it at access.kindgi.com. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "unauthorized", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) - [`kindgi license`](https://docs.kindgi.com/v0.4.0/reference/cli/license.md) ### `stale-request` **Synopsis** `401 Unauthorized`, error `stale-request` The request's time is more than 5 minutes off. Check the clock of the machine that sent it. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "stale-request", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `replayed` **Synopsis** `401 Unauthorized`, error `replayed` This exact request was used before. Send a new one. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "replayed", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `rate-limited` **Synopsis** `429 Too Many Requests`, error `rate-limited` Too many renewals for this key. The next one can go an hour later. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "rate-limited", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `renewer-stopped` **Synopsis** `403 Forbidden`, error `renewer-stopped` This deployment's renewal was stopped. Enroll it again with `kindgi license enroll`, or sign in at access.kindgi.com for a key. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "renewer-stopped", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) - [`kindgi license`](https://docs.kindgi.com/v0.4.0/reference/cli/license.md) ### `denied` **Synopsis** `403 Forbidden`, error `denied` Dev access isn't available for this account. Write to . **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "denied", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `key-revoked` **Synopsis** `403 Forbidden`, error `key-revoked` The account's license key was revoked. Write to . **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "key-revoked", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `not-entitled` **Synopsis** `403 Forbidden`, error `not-entitled` The license has no contract term on record, so access.kindgi.com doesn't renew it. Write to . **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "not-entitled", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `term-ended` **Synopsis** `403 Forbidden`, error `term-ended` The license's contract term has ended, so it isn't renewed. The key you have runs until its own date. Write to to extend the term. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "term-ended", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `held-for-review` **Synopsis** `403 Forbidden`, error `held-for-review` This renewal's counts (`kindgi license renew --runtime`) are above what a non-production key covers, so it got no new key: write to about a production license. Kindgi can release the deployment after a review, and its renewals then aren't held until a date. The key you have runs until its own date. A renewal before the key is due gets the same key back. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "held-for-review", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md) ### `unavailable` **Synopsis** `503 Service Unavailable`, error `unavailable` No key could be issued: the service failed to store or sign it. Try again later. **Details** None: the body has `error` and `message` only. **Example** ```json excerpt { "error": "unavailable", "message": "…" } ``` **See also** - [Renew the license key](https://docs.kindgi.com/v0.4.0/deploy/self-hosted/renew-the-license-key.md)