Error codes

An error answers with its HTTP status and a body whose error.code is one of these codes. A code never changes its meaning; the message beside it is for people and may change.

Code	Meaning
`invalid_request`	The request is not valid. Check your input and try again.
`invalid_id`	This identifier is not valid. Check the link you followed.
`unauthenticated`	Your session ended. Sign in again.
`forbidden`	You do not have permission for this. Owners and admins of the organization can change your role.
`not_found`	The requested item does not exist or was deleted.
`internal_error`	Something went wrong on our side. Try again. If it keeps happening, contact support and include the request ID.
`stale_revision`	Someone changed this while you were reviewing it. Review it again and retry.
`operation_in_progress`	Another operation is still running. Wait for it to finish.
`prerequisite_missing`	Something this needs is not ready yet.
`rate_limited`	Too many attempts from this address. Wait a minute, then try again.
`organization_rate_limited`	Your organization sent too many requests of this kind. Wait a moment, then try again.
`organization_requests_busy`	Your organization has too many large requests in progress, such as uploads or imports. Wait until some are finished, then try again.
`request_body_slow`	The upload did not arrive in time. Check the connection, then try again.
`idempotency_key_reused`	This request was already sent with different content. Start the action again.
`idempotency_in_progress`	This request is still being processed. The page shows the current state; try again shortly.
`idempotency_outcome_committed`	This request was already carried out. The page shows the current state.
`audit_entry_not_found`	This audit entry no longer exists.
`org_not_found`	This organization does not exist.
`org_member_not_found`	This person is no longer a member of the organization.
`org_last_owner`	An organization needs at least one owner. Make another member an owner first.
`org_identity_provider_unavailable`	The organization could not be created because the sign-in service is not available. Try again later.
`org_management_offer_invalid`	This management offer is unavailable.
`org_management_link_not_found`	Management relationship not found.
`org_management_link_ended`	This management relationship has ended.
`org_management_permissions_invalid`	Select permissions within the customer approval.
`org_management_assignment_not_found`	Staff assignment not found.
`org_management_staff_unavailable`	Select a direct, active provider employee.
`org_management_unavailable`	Management is temporarily unavailable.
`org_management_assignment_exists`	This employee already has an assignment.
`org_organization_limit_reached`	Your account has created as many organizations as it may; the cap is the same for every account. An organization you delete stops counting once its deletion is complete. If the cap blocks real work, tell support@obhut.io: caps rise for every account, never for one.
`org_creation_busy`	Your account is creating another organization at this moment. Try again in a few seconds.
`org_creation_rate_limited`	Your account created as many organizations in the last 24 hours as it may. Try again later, or contact support.
`entitlements_limit_reached`	Your organization reached a platform cap, which is the same for every organization. Free room under that cap: finish or delete a domain that still waits for its delegation or verification; delete deployments or sites you no longer need for storage and retained deployments; finish or delete unfinished uploads; or remove a domain's rate limits. If the cap blocks real work, tell support@obhut.io: caps rise for every organization, never for one.
`entitlements_account_limit_reached`	The account that created this organization reached a platform cap that it shares across all its organizations, the same for every account. Free room in one of them first: delete deployments it no longer needs, or finish or delete its unfinished uploads. If the cap blocks real work, tell support@obhut.io: caps rise for every account, never for one.
`iam_api_token_not_found`	This API token does not exist or was already revoked.
`iam_api_token_expiry_invalid`	The expiry must lie in the future.
`iam_permission_unknown`	One of the selected permissions does not exist. Reload the page and choose again.
`iam_permission_exceeds_role`	A token cannot have permissions that you do not have yourself.
`iam_session_not_found`	This session has already ended.
`iam_session_is_current`	This is the session you are using now. Sign out to end it.
`iam_login_failed`	Sign-in could not be completed. Start it again.
`iam_identity_provider_unavailable`	The sign-in service is not available right now. Try again later.
`iam_cli_login_invalid`	This CLI sign-in link is incomplete. Run obhut login again.
`iam_cli_code_invalid`	This code is not valid or has expired. Run obhut login again.
`iam_cli_confirmation_invalid`	This CLI sign-in has expired or was already used. Run obhut login again.
`iam_invitation_not_found`	This invitation link does not work. Ask for a new invitation, or copy the whole link from the mail.
`iam_invitation_pending`	This email address has an open invitation already. Send that one again instead.
`iam_invitation_expired`	This invitation has expired. Ask the organization for a new one.
`iam_invitation_used`	This invitation has already been accepted.
`iam_invitation_revoked`	This invitation was revoked. Ask the organization for a new one.
`iam_invitation_email_mismatch`	This invitation is for another email address. Sign in with that address to accept it.
`iam_invitation_email_unverified`	Verify your email address first: sign out, and sign in again to receive the verification mail.
`iam_invitation_already_member`	This email address already belongs to a member.
`iam_invitation_role_forbidden`	Only an owner can invite an owner.
`iam_invitation_user_only`	Invitations are accepted by a person who is signed in.
`iam_invitation_limit_reached`	This organization or your account has sent as many invitations as it may for now. Try again later.
`iam_invitation_sender_unverified`	Invitations name their sender by a verified email address. Verify your email address, or for an API token its creator’s, then try again.
`iam_invitation_sender_not_member`	The API token’s creator is no longer a member of this organization. Create a new token.
`iam_credential_not_found`	This sign-in method no longer exists. The list shows the current ones.
`iam_credential_last_factor`	This is your only second factor. Add another before you remove it.
`iam_account_action_other_user`	You signed in as someone else, so nothing was changed here. Sign in with your own account.
`iam_account_suspended`	This account is suspended. Write to support@obhut.io if you think this is a mistake.
`iam_terms_not_accepted`	Accept the terms of use in the dashboard first.
`iam_terms_version_outdated`	New terms of use took effect. Please read and accept them.
`iam_management_source_required`	Select the provider assignment you want to use.
`iam_management_access_ended`	Your management access has ended. Select another organization or contact its owner.
`zones_invalid_name`	This is not a valid domain name.
`zones_public_suffix`	This name is a public suffix, which nobody can register.
`zones_platform_name`	This name belongs to obhut itself. Use a domain of your own.
`zones_zone_exists`	This domain has already been added to obhut.
`zones_zone_not_found`	This zone does not exist or was deleted.
`zones_no_pool_available`	obhut cannot accept new domains right now. Try again later.
`zones_hostname_exists`	This hostname already exists in the zone.
`zones_hostname_not_found`	This hostname does not exist or was deleted.
`zones_hostname_outside_zone`	This hostname is not inside the zone. Use the zone's domain or a name below it.
`zones_apex_not_supported`	The apex cannot be a hostname here: no CNAME fits it.
`zones_wildcard_partial`	A wildcard hostname needs full setup: its certificate is validated through obhut's DNS.
`zones_hostname_in_service`	This hostname still serves traffic. Disable proxying first.
`zones_delegated_to_obhut`	This domain already points at obhut's nameservers, but no zone of your organization holds it. Contact support to add it.
`zones_inside_other_zone`	This name lies inside a domain another organization runs on obhut. Ask them to set it up for you.
`zones_delegation_lookup_failed`	obhut could not look up where this domain points right now. Try again in a moment.
`dns_zone_not_served`	This zone's DNS records are managed at its current DNS provider, not in obhut.
`dns_invalid_record`	This record is not valid. Check its name and content.
`dns_name_outside_zone`	This name is not inside the zone.
`dns_cname_conflict`	A CNAME record cannot share its name with other records.
`dns_record_exists`	An identical record already exists.
`dns_record_not_found`	This record does not exist or was deleted.
`dns_primary_unavailable`	The DNS service is not reachable right now. Try again in a moment.
`dns_write_unconfirmed`	The nameserver gave no answer to the change. It is checked again automatically.
`dns_publication_mismatch`	The nameserver still differs after the change. Publishing continues automatically.
`dns_import_not_found`	This import does not exist or was deleted.
`dns_import_not_ready`	This import is still reading the records. Try again once it has finished.
`dns_import_in_progress`	obhut is already reading this domain's records. Wait until that import has finished.
`dns_import_limit_reached`	This organization started as many imports as one hour allows. Try again later.
`dns_import_candidate_unknown`	The import does not hold this record. Reload the import and choose again.
`dns_zonefile_invalid`	The zone file could not be read. Check the line named.
`certs_order_not_found`	This certificate order does not exist or has finished.
`certs_order_not_failed`	Only a failed order can be retried. This one is still in progress.
`certs_certd_unavailable`	The certificate service is not reachable right now. Try again in a moment.
`certs_issuer_unavailable`	The certificate authority holding this order does not answer. obhut tries again and, if it stays down, orders from the next certificate authority.
`certs_dns_not_propagated`	The DNS record for the certificate check has not reached every nameserver yet. obhut checks again automatically.
`certs_cname_not_pointing_at_us`	The name does not point to obhut yet; the order waits for its CNAME.
`certs_dns_not_published`	obhut is still publishing the challenge records.
`certs_edge_not_ready`	obhut is bringing the certificate authority's HTTP check response to every edge node; validation waits until each one reports it.
`certs_order_budget_spent`	The certificate orders of the last 24 hours are used up; the order continues by itself when the next one is free.
`origins_invalid_target`	This origin address is not valid. Check the host and port.
`origins_address_not_public`	This is not a public address. obhut reaches origins on public addresses only.
`origins_target_is_edge`	This address belongs to obhut itself. Enter the address of your own server behind obhut.
`origins_origin_name_taken`	An origin with this name already exists in the zone.
`origins_origin_not_found`	This origin does not exist or was deleted.
`origins_origin_in_use`	Hostnames still route to this origin. Route them to another origin first.
`origins_route_not_found`	This hostname has no origin assigned.
`origins_route_in_service`	This hostname still uses this route. Disable proxying first.
`origins_gateway_pool_not_sized`	The AI gateway is not available for this zone yet: obhut has not sized the zone's edge pool for it. This is on obhut's side; contact support.
`origins_every_organization`	This origin serves every organization. Contact support to stop that before it is removed or changed to another kind.
`origins_preview_domain_unqualified`	Shared previews require a verified full-DNS domain on the private Public Suffix List, routed through its apex wildcard. Contact support to qualify the content domain.
`origins_protection_unsupported`	Access cannot protect this kind of origin. Use a tunnel or an address origin.
`origins_route_protected`	This hostname is protected by Access. Its route can only move to another protected origin.
`origins_origin_protected`	Access protects this origin. Until it is released in Access, it cannot be deleted and keeps its kind. A tunnel origin also keeps its service while its connector is not revoked.
`origins_protection_backend_shared`	Access protects a tunnel service through one origin only, and the origins in the details also use this service. Route the hostnames to one origin of the service. Then delete the other origins or give them another service.
`hosting_origin_not_static`	Only a static origin serves deployments.
`hosting_invalid_path`	A file path must start with "/" and hold no empty, "." or ".." segment, trailing "/", backslash or control character.
`hosting_duplicate_path`	The deployment lists a file path twice.
`hosting_file_too_large`	A file of the deployment is larger than 25 MiB.
`hosting_too_many_files`	A deployment holds at most 5,000 files.
`hosting_deployment_too_large`	A deployment holds at most 250 MiB in total.
`hosting_deployment_not_found`	This deployment does not exist.
`hosting_deployment_mismatch`	This deployment identity belongs to a different folder, serving mode or site, or to a deleted deployment. Resume with the original folder, or discard the saved upload intent before starting another deployment.
`hosting_deployment_selected`	Select another deployment before deleting this one.
`hosting_capacity_exhausted`	Hosting capacity is full. Delete unwanted history or contact support. Your retained sites remain available.
`hosting_upload_expired`	This unfinished deployment expired after seven days. Create a new deployment.
`hosting_file_not_in_manifest`	The deployment lists no file with this hash.
`hosting_file_mismatch`	The uploaded bytes do not match the hash and size in the manifest.
`hosting_files_missing`	Some files of this deployment are not uploaded yet.
`hosting_rules_invalid`	The site’s _redirects or _headers holds a rule obhut cannot apply.
`hosting_deployment_preparing`	This deployment is still being prepared. Try again in a few seconds.
`hosting_path_reserved`	Paths under /__obhut/ belong to obhut. Rename the file or folder.
`hosting_preview_link_not_found`	This preview link does not exist or was revoked.
`hosting_preview_links_limit`	A site has at most 20 preview links. Revoke one first.
`hosting_preview_password_busy`	obhut is setting too many preview passwords at the moment. Try again in a few seconds.
`tunnels_connector_not_found`	This connector does not exist or was revoked.
`tunnels_connector_name_taken`	A connector with this name already exists.
`tunnels_enrollment_token_invalid`	This enrollment token is not valid or was already used.
`tunnels_enrollment_token_not_found`	This enrollment token does not exist.
`tunnels_invalid_name`	This name is not valid. Use lowercase letters, digits and dashes, 1 to 64 characters.
`tunnels_invalid_public_key`	This SSH public key is not valid.
`tunnels_invalid_service`	This service name is not valid. Use lowercase letters, digits and dashes, 1 to 64 characters.
`tunnels_not_configured`	Tunnels are not available in this environment.
`proxy_idempotency_conflict`	This request was already sent with different content. Start the action again.
`proxy_transition_not_allowed`	This action is not available in the current phase.
`ai_key_not_found`	This gateway key does not exist or was revoked.
`ai_key_name_taken`	A gateway key with this name already exists.
`ai_budget_not_found`	This budget does not exist.
`ai_budget_exists`	This budget already exists: one per organization, one per key, and each name once.
`ai_budget_in_use`	Gateway keys spend from this budget. Revoke them first.
`ai_budget_not_named`	This needs a named budget, not the budget of a key or of the organization.
`ai_outside_eu_not_enabled`	Providers outside the EU are not enabled for this organization. An owner can enable them.
`ai_alias_not_found`	This alias does not exist.
`ai_alias_exists`	An alias with this name already exists.
`ai_model_not_found`	This model is not in the catalog.
`ai_target_not_routable`	This model cannot be used yet: it has no contract, or its provider does not enforce the output limit.
`ai_credential_not_found`	This provider credential does not exist.
`ai_credential_name_taken`	A provider credential with this name already exists.
`ai_credential_in_use`	Aliases use this credential. Change or remove them first.
`ai_credential_provider_mismatch`	This credential is for another provider than the model.
`ai_credential_required`	obhut does not offer this provider. Choose one of your own credentials for it.
`ai_provider_not_found`	This provider is not in the catalog.
`ai_invalid_base_url`	The base URL must use https, carry no user, query or fragment, and not name a private address.
`ai_platform_organization`	This organization runs the AI gateway for every organization of an edge pool. Contact support before deleting it.
`rules_ruleset_not_found`	This ruleset could not be found.
`rules_invalid`	The ruleset is invalid. Review the issues at the indicated locations.
`rules_validator_unavailable`	Rules cannot be checked right now. Try again later.
`rules_resource_limit`	An organization can have at most 200 rulesets.
`rules_save_rate_limited`	At most 30 rulesets or rate-limit changes of domains can be saved per minute. Try again shortly.
`rules_ruleset_in_use`	The ruleset is still used, or organization deletion prevents this change.
`rules_phase_mismatch`	A domain uses a ruleset of the rate-limit phase only.
`rules_bound_versions_limit`	The domains of an organization can use at most 20 ruleset versions. Use one version on more domains.
`rules_rate_limits_not_found`	This domain has no rate limits.
`waf_rule_unknown`	An exception names a rule that the WAF does not have. Choose a rule from the list.
`waf_condition_invalid`	A condition is invalid. Review the issues at the indicated locations.
`waf_exception_not_found`	An exception was changed or removed meanwhile. Load the settings again, then save.
`waf_exception_limit`	A domain can have at most 100 WAF exceptions, its hostnames included.
`access_provider_not_found`	This Access identity provider could not be found.
`access_provider_limit`	An organization can have at most ten Access identity providers.
`access_configuration_fenced`	Organization deletion prevents changes to Access configuration.
`access_provider_in_use`	Applications require this identity provider. Change or delete them first.
`access_application_not_found`	This Access application could not be found.
`access_application_limit`	An organization can have at most 100 Access applications.
`access_hostname_application_limit`	A hostname can be selected by at most 16 Access applications.
`access_ruleset_versions_limit`	The Access applications of an organization can bind at most 20 ruleset versions. Use a version that another application binds, or move applications to one version first.
`access_hostname_unsupported`	An Access application selects concrete hostnames, not a wildcard.
`access_hostname_unrouted`	This hostname has no origin. Route it to a tunnel or an address origin first.
`access_origin_unsupported`	Access protects only origins behind a tunnel or an address.
`access_ruleset_unsupported`	An Access application needs a ruleset of the access phase.
`access_hostname_in_use`	An Access application selects this hostname. Remove it from the application first.
`access_zone_in_use`	Access applications select hostnames of this domain, or Access protects its origins. Delete those applications and release the origins in Access first.
`access_origin_in_use`	Access applications select hostnames of this origin. Remove them from the applications first.
`access_origin_not_protected`	This origin is not protected by Access.
`access_hostname_unselected`	Public paths apply only to a hostname that an Access application selects.
`access_public_paths_exposed`	This change would let paths through without sign-in, because public paths of the hostname cover them and no application would. Change the public paths first.
`access_sign_in_label_invalid`	Use 3 to 32 lower-case letters, digits and single hyphens, starting with a letter.
`access_sign_in_label_reserved`	This sign-in label is reserved. Choose another one.
`access_sign_in_label_taken`	Another organization uses this sign-in label. Choose another one.
`access_sign_in_label_immutable`	The sign-in label is set and cannot be changed.
`access_not_allowed`	Access is open only to the operators’ organizations and named pilots for now. Contact support.