Credential states and errors

Operational reference for status, version states, setup failures, binding failures, and authorization recovery.

referenceFor operators, support engineers, API clientsOwner Constal platform teamVerified 2026-08-20

Use machine error codes when available and human messages for context. Do not retry a mutation merely because transport failed; follow the provider's recovery and the operation's returned state.

Credential status

StatusOperator meaning
PendingCreation, mint, or authorization has not completed
ActiveAt least one usable active version exists
InactiveNo version is currently injectable
FailedInitial acquisition failed and no active version exists

Version states are documented in Credential lifecycle.

Common setup failures

SymptomLikely causeAction
Provider package unavailableWrong tenant visibility or obsolete packageRefresh catalog or upload a current private package
Configuration rejectedField missing, wrong type, or unknown propertyFollow field help and package schema
Bootstrap Credential conflictReused generated identity or incompatible existing targetUse a new provider name or select the intended Credential
Provider has incomplete operationsPackage probe and declared authorization disagreeFix and rebuild the package

Binding failures

CodeMeaning
BindingRequiredNo Resource assignment exists for the exact owner
CredentialBindingRequiredNo Credential assignment exists for a required Resource slot
BindingUnavailableAssignment is missing, disabled, malformed, or registry resolution is incomplete
BindingUseDeniedPolicy denied binding:use
BindingOwnerMismatchAuthenticated owner and target tenant boundary disagree
BindingTargetUnavailableThe exact pinned target version cannot be loaded
BindingContractMismatchResource Driver or operation catalog differs from the authored contract

Credential use failures

Code or statusMeaning
CredentialUnavailableNo usable active version exists
CredentialRevokedRequested authority was permanently revoked
Policy denialThe authenticated run cannot use this Credential
Verification rejectedCandidate material was not activated

Authorization recovery

Restart authorization when state expired, consent was denied, refresh state expired, or an uncertain single-use exchange cannot prove its outcome. Never replay a callback code or refresh token. Existing active material remains usable only when provider policy and its expiry permit it.