Error codes

The caller's email is not provisioned as a workspace user.

Fix: Have your workspace administrator invite the email address before signing in.

The workspace is configured for password-only sign-in; SSO is blocked.

Fix: Sign in with email and password, or ask an administrator to enable SSO on the workspace.

The identity provider has the account marked as disabled.

Fix: Have your IT administrator re-enable the account, then retry.

The workspace itself is suspended or cancelled.

Fix: Contact your account executive or the workspace owner.

The workspace requires a second factor and the caller hasn't enrolled one yet.

Fix: Open /account/security and enrol an authenticator app, hardware key, or passkey.

The action needs a fresh proof of MFA. The response carries a `purpose` field that names the ceremony.

Fix: Use the step-up modal in the product, or call the matching step-up endpoint and re-issue the request.

The step-up token has already been spent.

Fix: Request a fresh step-up token before retrying.

The workspace policy requires a phishing-resistant factor (passkey or hardware key) for this action.

Fix: Complete the step-up with a passkey or hardware authenticator instead of a TOTP app.

The SCIM filter expression couldn't be parsed.

Fix: Check the filter syntax against the SCIM 2.0 specification, then retry.

The SCIM user id doesn't exist.

Fix: Resync the source-of-truth before retrying.

A request tried to update a read-only attribute.

Fix: Drop the read-only field from the PATCH/PUT body.

The webhook endpoint has tripped the circuit breaker after consecutive failures.

Fix: Fix the receiver, then enable the endpoint to reset the circuit.

The HMAC signature on a delivery couldn't be verified by your receiver during a test send.

Fix: Recompute the signature using the documented HMAC scheme; check the secret has not been rotated.

The source IP is denied by the workspace network policy.

Fix: Add the IP to the workspace allowlist, or move the request to a permitted network range.

The authenticator's attestation doesn't match the workspace's allowlist.

Fix: Enroll a device whose attestation is permitted by the workspace policy, or ask an administrator to relax the allowlist.

The caller is not authenticated.

Fix: Sign in via the UI or attach a valid bearer token to the request.

The caller is authenticated but lacks permission for this resource.

Fix: Have an administrator grant the required role, then retry.

The requested resource doesn't exist or is invisible to the caller.

Fix: Check the URL or resource id. The response intentionally hides the difference between "doesn't exist" and "hidden by access control".

Request body or parameters failed schema validation.

Fix: Fix the offending field listed in the response body, then retry.

Too many requests in the current window.

Fix: Honour the Retry-After response header and back off.