> For the complete documentation index, see [llms.txt](https://docs.algenta.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.algenta.ai/http-api/errors.md). # Error codes Every Algenta API error code in one place — generated from the codes the server emits — with what each means and the shape of the error response. Every error the Algenta API returns uses the same envelope, with a stable `code` you can branch on, a human-readable `message`, and a `docs_url`: ```json { "error": { "code": "device_identity_mismatch", "message": "Device is already bound to different identity metadata for this API key.", "docs_url": "https://docs.algenta.ai/errors/device_identity_mismatch", "details": {} } } ``` Branch on `code` (stable), show `message` to humans. The table below is the complete set of codes the API can return; the common ones include a fix. {% hint style="info" %} For symptom-first help, see [Troubleshooting](/help/troubleshooting.md). {% endhint %} | Code | Meaning | | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `access_scope_denied` | The key's scope does not include this resource. | | `account_suspended` | The account is suspended; contact your organization owner or support to restore access. | | `activation_invalid` | The deployment activation request is invalid; the message says why. | | `algenta_managed_capability_not_executable` | This capability runs on the Algenta-managed plane and can't be executed directly from a client-managed binding. | | `already_member` | The user is already a member of this organization. | | `already_resolved` | The device-login code was already approved or denied. | | `anonymous_not_allowed` | Anonymous Supabase sessions cannot use this endpoint; sign in with an account. | | `api_key_create_rate_limited` | Too many API keys were created in the last minute; wait a minute and retry. | | `api_key_identity_required` | This endpoint needs an API-key identity; the caller authenticated with a non-key credential (e.g. a Microsoft Entra token). | | `api_key_not_found` | The referenced API key does not exist. | | `api_key_owner_required` | Only a member's own credential can create API keys (a key needs a member behind it). | | `authentication_required` | No valid credential was supplied. Send `Authorization: Bearer `. | | `bad_signature_encoding` | The proof-of-possession `signature` is not valid base64. | | `billing_catalog_unavailable` | The Stripe plan catalogue could not be read right now (egress policy block, network failure, or a Stripe rate limit / outage), so plans could not be listed or priced; retry (`details.retryable` is true). | | `billing_not_configured` | Billing is not enabled on this engine yet. | | `billing_not_enabled` | Self-serve billing is not enabled for this product yet. | | `browse_failed` | Browsing the connector's contents failed; check the connection and permissions. | | `cannot_revoke_last_key` | You cannot revoke your last active key (it would lock you out). | | `captcha_required` | Sign-up requires a captcha (Turnstile) token. | | `challenge_required` | No valid renewal challenge is pending for this device; request a new nonce and retry. | | `client_managed_capability_requires_adapter` | This client-managed capability needs a registered adapter before it can run. | | `column_not_found` | A referenced column does not exist in the source schema. | | `concurrent_jobs_exceeded` | Too many in-flight async jobs for the plan. | | `connector_test_failed` | The connector connection test did not succeed. | | `constraint_violated` | The write violated a uniqueness or referential constraint. | | `dataset_execution_requires_governed_query_path` | This dataset must be queried through the governed query path, not a raw execution. | | `dataset_not_found` | The dataset id is unknown. | | `dataset_scope_required` | Resolve needs a `dataset_id` (unless `allow_org_scope` is true or only one dataset is visible). | | `dataset_scope_violation` | The resolved plan's source is outside the requested dataset scope. | | `decision_plan_invalid` | The decision plan lacks the `snapshot_id` that simulation needs. | | `decision_plan_lookup_persist_failed` | The decision-plan lookup record could not be saved to the object store; retry. | | `decision_plan_manifest_persist_failed` | The decision-plan manifest could not be saved to the object store; retry. | | `decision_tree_depth_exceeded` | The decision tree is deeper than the configured `max_depth`. | | `deployment_endpoint_lookup_failed` | The organization's dedicated deployment could not be looked up right now; the request was not sent to the shared pool instead. Retry. | | `deployment_exists` | A deployment already exists for this organization. | | `deployment_not_active` | No active deployment matches this request; activate the deployment first. | | `deployment_proxy_unavailable` | The organization's dedicated deployment is temporarily unavailable; the request was not sent to the shared pool instead. Retry. | | `deployment_rebind_owner_only` | Only an owner can move an existing deployment to a different deployment key; re-activating with the same key just refreshes its license. | | `device_binding_required` | This API key is bound to a limited number of devices: send `X-Algenta-Device-Id` (or use the Algenta SDK). | | `device_binding_token_required` | The device is already bound to this API key: send its `X-Algenta-Device-Binding-Token` (or use the Algenta SDK). | | `device_fingerprint_required` | The device-capped key needs the fingerprint headers. | | `device_identity_mismatch` | A device-capped key saw a new device identity; send consistent headers or use the SDK. | | `device_inactive` | The device is registered but not active, so its license cannot be renewed. | | `device_key_mismatch` | The device's key does not match the one bound to this activation. | | `device_limit_reached` | The API key's device limit is reached (or this device's slot was given to another device while it was offline); revoke an active device, then retry. | | `device_not_bound` | The device has no bound device key; register it again to bind a key, then renew. | | `device_not_found` | No such device on your account. | | `device_not_registered` | No device with this id is registered under this API key; register the device first. | | `device_platform_required` | The device-capped key needs `X-Algenta-Platform`. | | `device_registration_rate_limited` | Too many new devices were registered under this API key in the last hour; re-registering an existing device is unaffected. Wait, then retry to add a new one. | | `device_revoked` | The device activation was revoked by an owner. | | `egress_policy_denied` | The deployment's egress policy blocked an outbound destination. | | `email_not_confirmed` | Supabase Auth has not confirmed this session's email address, so it cannot claim a membership by email or accept an invitation; confirm the address and retry. With `details.reason` `membership_email_unverified`, it is your membership row's address that was never verified: verify it, or ask an owner to invite you again. | | `email_required` | The account has no email address (e.g. a hidden-email sign-in); this endpoint needs one. | | `email_verification_required` | The account email must be verified first. | | `empty_events` | No events were supplied. | | `empty_source` | The source contained no data. | | `empty_table` | The referenced table is empty. | | `engine_error` | The compute engine failed to execute the request. | | `engine_spawn_failed` | The local compute engine could not be started. | | `entra_client_app_not_allowed` | The calling application is not allowed on this gateway (Microsoft Entra ID). | | `entra_invalid_token` | The Microsoft Entra ID access token could not be verified. | | `entra_jwks_invalid` | The Microsoft Entra ID signing keys (JWKS) document could not be parsed. | | `entra_jwks_unavailable` | The Microsoft Entra ID signing keys (JWKS) could not be fetched; retry. | | `entra_jwks_unreachable` | The Microsoft Entra ID signing keys (JWKS) are not reachable from this gateway (network or egress policy); retry, or allow the endpoint. | | `entra_malformed_token` | The Microsoft Entra ID bearer token is not a well-formed JWT (or its header has no key id). | | `entra_missing_oid` | The Microsoft Entra ID token carries no principal object id (`oid`). | | `entra_missing_tenant` | The Microsoft Entra ID token carries no tenant id (`tid`). | | `entra_missing_token` | No Microsoft Entra ID bearer token was supplied. | | `entra_not_api_access_token` | The Microsoft Entra ID token is not an access token for this API (e.g. an ID token); present an API access token. | | `entra_not_configured` | Microsoft Entra ID sign-in is not configured on this gateway. | | `entra_principal_not_mapped` | The Microsoft Entra ID principal is not provisioned on this gateway (or the organization it was mapped to no longer exists); an administrator must map it. | | `entra_provisioning_slug_conflict` | An organization not provisioned for this Microsoft Entra ID principal already uses its reserved individual-organization name; an operator must review it before the principal can be provisioned. | | `entra_tenant_not_allowed` | The Microsoft Entra ID token's tenant is not allowed on this gateway. | | `entra_token_expired` | The Microsoft Entra ID access token has expired; request a new one. | | `entra_unknown_kid` | No Microsoft Entra ID signing key matches the token's key id. | | `entra_wrong_audience` | The Microsoft Entra ID access token was not issued for this API's audience. | | `entra_wrong_issuer` | The Microsoft Entra ID access token's issuer is not one this gateway trusts. | | `entra_wrong_resource_token` | The Microsoft Entra ID token was issued for another Microsoft resource (e.g. Graph or ARM); request a token whose audience is this API. | | `forbidden` | The key is valid but not permitted for this action. | | `generated_patch_not_found` | The generated patch artifact was not found. | | `git_command_failed` | A git command against the repository failed; the message carries git's error (with credentials redacted). | | `github_app_unconfigured` | The GitHub App is not configured, so a GitHub-derived membership cannot be verified. | | `github_identity_required` | Connecting GitHub needs a GitHub identity linked to your sign-in: the installation is bound only when the GitHub account that installs the app is yours. | | `github_unreachable` | GitHub could not be asked to verify a GitHub-derived membership right now; retry. | | `group_column_not_found` | A group-by column was not found in the source schema. | | `hs256_not_configured` | The session token is HS256-signed but this engine has no HS256 secret configured. | | `http_error` | An upstream HTTP request failed. | | `idempotency_key_conflict` | An idempotency key was reused with a different payload. | | `identity_claims_unavailable` | Your identity (GitHub identity or confirmed email) could not be verified with the identity provider right now; retry shortly. Members acting through their own bound seat are unaffected. | | `identity_provider_misconfigured` | The engine's identity-provider configuration is wrong (`SUPABASE_ANON_KEY` unset or rejected by Supabase); the operator must fix it. Not a transient outage. | | `identity_required` | Onboarding needs a verified identity with an email address. | | `inline_preview_rate_limited` | Inline connector previews are rate limited; create a saved connector and reuse it. | | `install_initiator_inactive` | The person who started this GitHub install can no longer connect GitHub for the organization (removed, demoted, or their GitHub basis is gone); an owner or admin must start it again. | | `install_initiator_mismatch` | The GitHub install was completed by a different GitHub account than the one that started it; start the install from your own account page and complete it with that GitHub account. | | `installation_bound_to_account_org` | The GitHub installation belongs to the organization provisioned for its GitHub account; uninstall the app there first to move it. | | `insufficient_role` | Your role in this organization does not allow this action. | | `internal_error` | An unexpected server error; safe to retry. | | `invalid_agent_run_status` | The agent run is not in a state that allows this action. | | `invalid_aliases` | One or more field aliases are invalid. | | `invalid_api_key` | The API key is malformed or not recognized. | | `invalid_artifact_id` | An artifact id must be 1–128 letters, digits or `._:-`, and not `.` or `..`. | | `invalid_connection` | The connection details are invalid. | | `invalid_connection_config` | The connector configuration is missing required fields or has invalid values. | | `invalid_connection_provider` | The connection provider is not recognized. | | `invalid_connection_type` | The connector type is not one of the supported types. | | `invalid_connector_status` | The saved connector has an invalid verification status; repair the persisted record before retrying. | | `invalid_credentials` | The supplied credentials were rejected by the data source. | | `invalid_decision_tree_override` | A decision-tree variable override must be a number or `{distribution, params}`. | | `invalid_device_binding` | The device identity headers are malformed (for example the device id is too short); the message says which. | | `invalid_device_binding_token` | The device's binding token is not the one issued for this API key. | | `invalid_device_limit` | The requested device limit is out of the allowed range. | | `invalid_filter_condition` | A query filter condition is malformed. | | `invalid_org_id` | `X-Org-Id` is not an organization id (a UUID). | | `invalid_patch_diff` | The generated patch declares no changed files. | | `invalid_plan` | The plan name is not a valid, purchasable plan. | | `invalid_product` | The requested product name is not a recognized Algenta product; the message lists the valid names. | | `invalid_provider` | The provider is not recognized. | | `invalid_query_batch` | The query batch is invalid (for example a duplicate batch key). | | `invalid_query_request` | The query request is inconsistent (for example `dataset_id` together with inline sources); the message says which. | | `invalid_region` | The deployment region is not supported. | | `invalid_repository_config` | The repository connector config is not a JSON object or lacks a required field (`details.field`). | | `invalid_repository_ref` | The repository ref contains unsupported characters. | | `invalid_repository_url` | The repository URL must be an http(s) clone URL. | | `invalid_role` | The team role is not one of the allowed roles. | | `invalid_selection` | The selection is invalid for this operation. | | `invalid_token` | The token is malformed or expired. | | `invalid_type` | The value's type does not match what the field expects. | | `invalid_user_code` | The device-login code is unknown or expired; start the login again. | | `invalid_verify_request` | Verify needs `source_name`, `metric_column` and `aggregation`, or a `resolved_plan`. | | `invalid_visibility` | The visibility value is not allowed. | | `invalid_workspace_id` | The workspace id is unknown or malformed. | | `invite_email_mismatch` | Sign in with the email address the invitation was sent to; the invitation stays pending. | | `invite_expired` | The team invitation has expired; request a new one. | | `invite_identity_conflict` | The invited address is already bound to a different account in this organization. | | `invite_invalid` | The team invitation token is invalid. | | `invite_inviter_inactive` | The member who sent the invitation can no longer grant it (removed, demoted, or no longer verifiable); ask an owner for a new invitation. | | `invite_predates_removal` | The invitation was sent before the member was removed; only an invitation sent after the removal can reactivate them. | | `job_access_denied` | The async job belongs to another organization. | | `job_already_terminal` | The job has already finished and can't be changed. | | `job_cannot_be_cancelled` | The job is in a state that cannot be cancelled. | | `job_not_found` | The async job id is unknown. | | `join_path_invalid` | The requested join path between sources is not valid. | | `join_path_requires_group_column` | This join path requires a group-by column. | | `join_source_error` | A joined source could not be read. | | `jwks_invalid` | The Supabase signing keys (JWKS) could not be parsed. | | `jwks_unavailable` | The Supabase signing keys (JWKS) could not be fetched; retry. | | `jwks_unreachable` | The Supabase signing keys (JWKS) are not reachable from here; retry. | | `key_owner_missing` | The API key belonged to a member who no longer exists; ask an owner for a new key. | | `last_owner` | You cannot remove or demote the last org owner. | | `license_principal_not_permitted` | A device license authenticates a device, not a member; role-gated endpoints need a member's API key. | | `license_status_unavailable` | This deployment could not check the device license's standing (its database did not answer); the request was refused, retry it (`details.retryable`). | | `licensed_device_limit_reached` | Every device your subscription covers is active; add devices to the subscription or revoke one. | | `load_error` | The data could not be loaded. | | `local_runtime_not_included` | The plan does not include the local runtime, so devices cannot be registered; upgrade to a plan that includes it. | | `login_rate_limited` | Too many login attempts in the last minute; try again shortly. | | `malformed_token` | The session token is not a well-formed JWT. | | `managed_llm_spend_cap_exceeded` | The managed-LLM spend cap for the org was reached. | | `mcp_egress_denied` | The external MCP server's host is not permitted by the deployment's egress policy. Add it to `ALGENTA_EGRESS_ALLOWLIST`. | | `mcp_server_url_missing` | The MCP capability binding has no `config.server_url` to connect to. | | `mcp_tool_execution_failed` | Calling the tool on the external MCP server failed (unreachable, transport error, or a protocol error). | | `mcp_tool_name_missing` | The MCP capability is missing the remote tool name to invoke. | | `mcp_tool_reported_error` | The external MCP tool ran but returned an error result. | | `member_not_found` | The member id is not on this organization's team. | | `membership_inactive` | Your membership in this organization is suspended or not yet active; ask an owner to re-invite you. | | `membership_suspended` | You were removed from this organization (`details.org_id`): neither your sign-in nor your GitHub identity grants access to it, and no new organization is created for you instead. Ask an owner to re-invite you. | | `missing_bearer` | The request needs `Authorization: Bearer `. | | `missing_connection_string` | A connection string is required for this connector. | | `missing_dataset_name` | A dataset name is required. | | `missing_org_context` | The request could not be associated with an organization. | | `missing_source` | A source is required for this operation. | | `missing_token` | No session token was supplied. | | `mojo_instrumentation_unavailable` | Mojo column profiling is unavailable and this deployment disables runtime fallbacks. | | `multiple_orgs` | The identity belongs to several organizations; send `X-Org-Id` with one of the listed ids. | | `no_billing_account` | No billing account is configured for the org. | | `no_data` | The query matched no rows. | | `no_deployment_entitlement` | The organization's plan does not grant server (deployment) licensing; upgrade to a Server plan or contact sales. | | `no_org` | No organization is linked to this account yet. | | `no_runtime_entitlement` | The organization's plan does not grant this product's runtime. | | `no_subject` | The session token carries no subject. | | `node_not_found` | The runtime node id is unknown. | | `not_a_member` | You are not a member of this organization (no membership row and no trusted GitHub basis). | | `not_configured` | Supabase identity is not configured on this engine (`SUPABASE_URL` unset). | | `not_connected` | The data source is not connected. | | `not_found` | The requested resource does not exist. | | `not_implemented` | This operation is not available in the current deployment. | | `not_refreshable` | This dataset cannot be refreshed. | | `not_your_api_key` | Only owners and admins can revoke another member's API key. | | `not_your_device` | Only owners and admins can revoke another member's device. | | `oidc_client_app_not_allowed` | The calling application is not allowed on this gateway (OIDC). | | `oidc_invalid_token` | The OIDC access token could not be verified. | | `oidc_jwks_invalid` | The OIDC signing keys (JWKS) document could not be parsed. | | `oidc_jwks_unavailable` | The OIDC signing keys (JWKS) could not be fetched; retry. | | `oidc_jwks_unreachable` | The OIDC signing keys (JWKS) are not reachable from this gateway (network or egress policy); retry, or allow the endpoint. | | `oidc_malformed_token` | The OIDC bearer token is not a well-formed JWT (or its header has no key id). | | `oidc_missing_subject` | The OIDC token carries no subject (`sub`). | | `oidc_missing_token` | No OIDC bearer token was supplied. | | `oidc_not_api_access_token` | The OIDC token is not an access token for this API (e.g. an ID token); present an API access token. | | `oidc_not_configured` | OIDC sign-in is not configured on this gateway. | | `oidc_principal_not_mapped` | The OIDC principal is not provisioned on this gateway (or the organization it was mapped to no longer exists); an administrator must map it. | | `oidc_provisioning_slug_conflict` | An organization not provisioned for this OIDC principal already uses its reserved individual-organization name; an operator must review it before the principal can be provisioned. | | `oidc_token_expired` | The OIDC access token has expired; request a new one. | | `oidc_unknown_kid` | No OIDC signing key matches the token's key id. | | `oidc_wrong_audience` | The OIDC access token was not issued for this API's audience. | | `oidc_wrong_issuer` | The OIDC access token's issuer is not one this gateway trusts. | | `onboard_failed` | Onboarding the account or dataset failed. | | `org_admin_not_verified` | GitHub no longer reports you as an admin of the organization's installed GitHub org, so this change is refused. | | `org_membership_required` | Your account holds no active membership in the organization it resolves to; ask an owner to invite you. | | `org_not_eligible` | `X-Org-Id` names an organization this identity cannot act in; pick one from `/v1/account/orgs`. | | `org_not_found` | The organization id is unknown. | | `organization_suspended` | The organization is suspended. | | `origin_guard_required` | Call the API at its public hostname; the origin host is not directly usable. | | `owner_change_forbidden` | Only an owner can change the role of, or remove, a member whose role is owner. | | `owner_grant_forbidden` | You cannot grant the owner role. | | `owner_only` | Only the organization's owner can manage billing (checkout, the billing portal). In an organization created by a GitHub App install that has no active owner, a verified admin of the installed GitHub organization may too. | | `patch_diff_persist_failed` | The generated patch could not be saved to the object store; retry. | | `patch_impact_manifest_persist_failed` | The patch-impact manifest could not be saved to the object store; retry. | | `patch_targets_unknown_file` | The generated patch changes a file that is not in the snapshot. | | `persistence_backend_unavailable` | The persistence backend is temporarily unavailable; retry. | | `pipeline_not_enabled` | The one-call repository pipeline is turned off on this deployment (`ALGENTA_REPOSITORIES_PIPELINE_ENABLED`). | | `planning_not_allowed_on_query` | Query does not plan: call `POST /v1/resolve` first and pass its plan to `POST /v1/query`. | | `playground_error` | The playground request could not be processed. | | `playground_invalid_input` | A playground `inputs` value cannot be modelled (expected a number, a `[min, max]` range, or `{value}`); the message names the variable. | | `playground_rate_limit` | The keyless playground rate limit was hit; slow down or use an API key. | | `playground_unavailable` | The algenta SDK that powers the keyless playground is not importable in this deployment; the rest of the API is up. Use an API key with `/v1/simulate`. | | `pool_exceeded` | The requested Compute Units plus those already allocated exceed the purchased pool. | | `pool_exhausted` | Every Compute Unit the organization bought is allocated to other deployments; none remain for this one. | | `pop_malformed` | The proof-of-possession `nonce` or `signature` is not valid base64. | | `pop_nonce_invalid` | No valid challenge is pending for this node; request one from `/v1/deployment/node/challenge` first. | | `pop_required` | Deployment-node proof of possession needs `nonce`, `public_key_pem` and `signature`. | | `pop_signature_invalid` | The node's deployment-key signature over the challenge did not verify. | | `pop_thumbprint_mismatch` | The presented `public_key_pem` does not match the node's `node_thumbprint`. | | `preview_capability_not_executable` | This capability can be previewed but not executed in preview mode. | | `principal_not_permitted` | The credential is not bound to a member of the organization. | | `product_not_served` | This API host serves one product's plans only and will not price a different product. Ask that product's own API host. | | `proof_of_possession_failed` | The device's signature over the renewal challenge did not verify with its bound key. | | `provider_key_not_found` | No BYOK provider key is configured for this backend. | | `provisioning_slug_conflict` | An organization not provisioned for this account already uses its reserved name and holds members, keys, links or installations; an operator must review it before provisioning can continue (an empty legacy holder of a GitHub account's own name is adopted instead). | | `quota_exceeded` | A custom or non-Algenta governance quota is exhausted; Algenta editions have no monthly execution quota. | | `quota_exhausted` | The plan's monthly execution credits are used up (`monthly_limit`); upgrade the plan or wait for the next billing period. | | `rate_limit_backend_unavailable` | The rate-limit backend (Redis) is unreachable. | | `rate_limit_exceeded` | The plan's per-minute request limit was exceeded; slow down and retry. | | `registry_distribution_disabled` | Package-registry credential distribution is turned off on this engine. | | `remote_pr_unsupported_for_connector` | This connector type cannot open remote pull requests. | | `remote_pull_request_egress_denied` | Opening the remote pull request was blocked by the deployment's egress policy. | | `remote_pull_request_failed` | The Git provider refused to create the pull request (`details.response`). | | `remote_pull_request_missing_url` | The Git provider created the pull request but returned no browser URL. | | `repository_agent_core_unavailable` | `verified_agentic` planning needs the agent runtime service (`ALGENTA_AGENT_CORE_URL`), which this deployment does not configure. | | `repository_agent_invalid_result` | The `verified_agentic` agent run returned a malformed result. | | `repository_agent_no_change` | The `verified_agentic` agent run produced no file changes. | | `repository_agent_runtime_not_live` | The `verified_agentic` result came from a stub or offline agent run, not a live agent runtime, so it is not used as a decision plan. | | `repository_analysis_required` | The decision plan has no repository analysis or patch-impact data, which simulation needs. | | `repository_apply_gate_failed` | Apply is blocked: the simulation did not meet the policy thresholds. | | `repository_apply_requested_snapshot_mismatch` | The apply request's `snapshot_id` does not match the decision plan and simulation snapshot. | | `repository_apply_snapshot_mismatch` | The decision plan and the simulation refer to different snapshots. | | `repository_apply_snapshot_missing` | Apply needs a `snapshot_id` on both the decision plan and the simulation. | | `repository_cache_write_failed` | A repository cache file could not be written on this deployment. | | `repository_connector_required` | The connector's type cannot be used as a repository resource. | | `repository_decision_plan_snapshot_mismatch` | The decision plan's workspace evidence bundle does not match the requested `snapshot_id`. | | `repository_graph_query_file_not_found` | The graph query's file is not in the snapshot. | | `repository_graph_query_invalid_symbol` | The graph query's `symbol_name` is empty. | | `repository_graph_query_requires_seed` | A repository graph query needs `file_path`, `symbol_name` or `workspace_evidence_bundle_ref`. | | `repository_graph_query_requires_snapshot` | A repository graph query needs `snapshot_id` or `workspace_evidence_bundle_ref`. | | `repository_graph_query_snapshot_mismatch` | The workspace evidence bundle does not belong to the requested snapshot. | | `repository_graph_query_symbol_not_found` | The graph query's symbol is not in the snapshot. | | `repository_local_planner_unsupported` | The bounded local planner cannot plan this request; the message says why. | | `repository_model_invalid_output` | The repository planner model returned invalid JSON. | | `repository_model_missing_patch` | The repository planner model returned no `patch_diff`. | | `repository_model_unavailable` | Repository decision planning needs a configured provider-backed chat model or the bounded local planner model. | | `repository_patch_validation_failed` | The generated patch failed validation against the snapshot's baseline. | | `repository_ref_requires_git` | Selecting a ref on a local repository needs a git working tree. | | `repository_remote_metadata_unsupported` | The connector's repository URL does not name a repository a pull request can be opened on for this connector type. | | `repository_runtime_unwritable` | The repository runtime directory is not writable (and falling back to ephemeral storage is disabled); set `ALGENTA_RUNTIME_DIR` to a writable, durable path. | | `repository_shared_runtime_unwritable` | The configured shared repository runtime directory is not writable. | | `repository_simulation_snapshot_mismatch` | The simulation's `snapshot_id` does not match the decision plan's snapshot. | | `repository_source_not_found` | The repository source path does not exist on this deployment. | | `repository_worktree_not_clean` | The repository worktree has uncommitted changes, so apply is blocked. | | `repository_write_credentials_required` | Opening a remote pull request needs an `access_token` in the connector config. | | `repository_write_permission_required` | Repository write modes need `write_permission: true`. | | `resolve_budget_exceeded` | Resolve exceeded its bounded planning time budget; narrow the request or retry. | | `resource_write_conflict` | A concurrent write conflicted; retry. | | `runtime_library_metadata_missing` | The runtime library is missing required metadata. | | `schema_revision_mismatch` | The resolved plan was made against an older schema revision; resolve again. | | `seat_limit_reached` | The team has no available seats; add seats before inviting more members. | | `seats_not_available` | No seats are available on the current plan. | | `security_analysis_no_findings` | A security analysis needs at least one finding. | | `selection_required` | A selection is required for this operation. | | `self_role_change_forbidden` | You cannot change your own role. | | `semantic_training_unavailable` | Semantic training is not available for this dataset. | | `server_deployment_requires_server_license` | The machine reports a server-class environment (a container or virtual machine), which the plan does not license; run servers on a Server plan. | | `service_key_owner_only` | Only an owner can revoke a service key (e.g. the GitHub App's key). | | `session_invalid` | The identity provider no longer accepts this session (signed out, session or user deleted); sign in again. Retrying with the same token cannot succeed. | | `signing_unavailable` | Deployment license signing is not configured on this control plane; the operator must configure the signing key. | | `signup_limit_exceeded` | Too many sign-ups from this source. | | `signup_rate_limited` | Too many signups from this network in the last minute; try again shortly. | | `simulation_manifest_persist_failed` | The simulation manifest could not be saved to the object store; retry. | | `slow_down` | Device login: the client asked for codes, approvals or tokens faster than allowed; wait the advertised interval, then retry. | | `snapshot_hydration_corrupt` | A recovered snapshot artifact failed its content-hash integrity check. | | `snapshot_hydration_unavailable` | A snapshot artifact is not on this node and the object store could not provide it right now; retry. | | `snapshot_manifest_persist_failed` | The snapshot manifest could not be saved to the object store; retry. | | `snapshot_parquet_persist_failed` | A snapshot data artifact could not be saved to the object store; retry. | | `snapshot_source_archive_persist_failed` | The snapshot's source archive could not be saved to the object store; retry. | | `snapshot_source_unavailable` | The snapshot's source archive is not on this node and could not be recovered from the object store. | | `source_cache_error` | The source cache could not be read or written. | | `source_not_found` | The source id is unknown. | | `source_not_ready` | The dataset is not ready to be resolved yet; retry once it has loaded. | | `source_registration_failed` | Registering the source failed. | | `sql_report_comments_not_allowed` | SQL report statements cannot contain SQL comments. | | `sql_report_duplicate_source_alias` | Two SQL report sources use the same alias. | | `sql_report_invalid_source` | Each SQL report source needs a `dataset_id` or an alias. | | `sql_report_invalid_source_alias` | A SQL report source alias is not a valid identifier. | | `sql_report_invalid_sql` | The SQL report statement is empty or failed to run; the message gives the reason. | | `sql_report_multiple_statements_not_allowed` | A SQL report must contain exactly one statement. | | `sql_report_read_only_required` | SQL reports are read-only: the statement must start with SELECT or WITH and contain no write keyword. | | `sql_report_source_not_found` | A SQL report dataset has no queryable storage. | | `sql_report_timeout` | The SQL report ran longer than its time budget. | | `sso_email_binding_refused` | A SAML single-sign-on session cannot claim a membership by email; ask an owner to invite this account. | | `storage_cap_exceeded` | The org's storage quota is full. | | `stripe_error` | The billing provider (Stripe) returned an error. | | `supabase_not_configured` | Website identity (Supabase) is not configured on this engine. | | `team_actor_not_permitted` | Only a member's own API key (or website session) can manage the team; device licenses, service keys and identity-provider principals cannot. | | `team_update_conflict` | Another change to the same team happened at the same time; retry the request (`details.retryable` is true). | | `template_not_found` | The template name is unknown. | | `template_run_error` | Running the template failed. | | `token_expired` | The session token has expired; sign in again. | | `triage_manifest_persist_failed` | The triage manifest could not be saved to the object store; retry. | | `unknown_kid` | No Supabase signing key matches the session token's key id; sign in again. | | `unknown_product` | The product is not recognized or not open for self-serve onboarding. | | `unknown_repository_ref` | The requested ref could not be resolved in the repository (or on its remote). | | `unknown_source_id` | The source id is unknown. | | `unsafe_archive_member` | The archive contains a symbolic or hard link, which is not supported. | | `unsafe_archive_path` | The archive contains a path that would land outside the extraction directory. | | `unsupported_alg` | The session token uses a signing algorithm the engine does not accept. | | `unsupported_archive_format` | Repository archives must be .zip, .tar, .tgz or .tar.gz. | | `unsupported_backend` | The engine's own key cannot be managed through bring-your-own-key; choose a provider backend. | | `use_connection` | Provide a saved connection id instead of inline connection details for this operation. | | `user_not_found` | The user id is unknown. | | `validation_error` | The request body failed schema validation; see `details`. | | `webhook_processing_failed` | Processing the inbound webhook failed; the sender may retry. | | `webhook_signature_invalid` | The inbound webhook signature did not verify. | | `workspace_evidence_bundle_invalid` | The workspace evidence bundle has no `snapshot_id`, so it cannot seed this step. | | `workspace_scope_not_permitted` | The key is not permitted to act in this workspace scope. | ## Related {% content-ref url="/pages/RaQHf2GXLycvWnyQW0hI" %} [Troubleshooting](/help/troubleshooting.md) {% endcontent-ref %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.algenta.ai/http-api/errors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.