Error codes
Generated from the error constructors in
client/internal/cli/, client/internal/agent/ and core/sync/wire.go, and the status codes in server/internal/syncapi/. Do not edit.Lasbolt has four sets of error codes. They are in different places: the JSON output of the CLI, the agent protocol, the answers of the server, and the result of a push.
CLI codes
With --json, a failed lasbolt command prints {"error": {"code", "message"}}. The MCP server uses the same codes. The exit code follows the code. The message below is the message from the source. Parts that change are shown as ….
| Code | Exit | Message in the source |
|---|---|---|
agent | 1 | … |
agent_path | 2 | … |
agent_unavailable | 1 | the agent is not available: … |
already_exists | 6 | … already exists (ID …): use lasbolt edit, or –if-missing |
already_logged_in | 1 | this device is logged in as … on …: run lasbolt logout first |
ambiguous_ref | 1 | field … matches … fields: use the field ID |
approval_denied | 7 | the sign-in was denied in the browser |
approval_expired | 7 | nobody approved the sign-in in time: call login again |
approval_required | 7 | the user must approve this read in the Lasbolt web app (approval ID …). Ask the user to approve it, then call run again with the same arguments |
approval_timeout | 7 | nobody approved the read in time (approval ID …) |
bad_grant | 1 | the keys from the browser do not open: … |
bad_key | 3 | the key string does not open the key: … |
bad_passphrase | 1 | wrong passphrase for the local key store |
bad_password | 1, 3 | that password does not unlock your keys |
bad_server | 1 | the server sent a bad sign key |
bad_server_answer | 1 | the server gave a bad user ID |
bad_state | 1 | cannot make …: … |
bad_totp | 1 | the one-time password secret of … is not valid |
canceled | 1 | nothing changed |
cancelled | 1 | the call was cancelled |
conflict | 6 | the folder changed while it was purged (…): try again |
error | 1 | the server sent a bad value |
exec_failed | 1 | cannot run …: … |
field_required | 2 | … names an item, not a field: add /<field> |
invalid | 1 | the server refused the rotation: … |
kdf | 1 | … |
key_changed | 1 | the key of this device changed: run lasbolt peer list and compare the fingerprint again |
key_mismatch | 1 | the sign key of your account on the server changed since the last login: stop and tell the server admin |
keys_mismatch | 1 | the server gave two different user IDs. Stop and tell the server admin |
keys_rotated | 9 | your keys were rotated on another device: run lasbolt unlock |
keystore | 1 | … |
kit_file | 1 | cannot make …: … |
kit_file_exists | 1 | … exists: choose a new file name. lasbolt does not replace a file |
kit_unreadable | 1 | the recovery kit does not open: …. Tell the server admin |
locked | 9 | the key of the item does not open: … |
login_required | 3 | the approval was for another account or device: run lasbolt logout, then lasbolt login … |
needs_passphrase | 1 | the local key store needs a passphrase: … |
nm_host | 1 | … |
no_home | 1 | cannot find the home directory: … |
no_key | 1 | the device … has no peer key yet |
no_keys | 1 | the server gives no key bundle to this login |
no_peer_list | 1 | there is no peer list yet: run lasbolt sync first |
no_pin | 1 | the config has no user key: run lasbolt login again |
not_found | 5 | not found |
not_supported | 1 | the agent is not available on this platform: lasbolt runs in direct mode |
outside_scope | 4 | this login has read access only |
partial | 1 | (built at run time) |
rate_limited | 8 | the server limits requests: …. Try again later |
recovery_refused | 3 | the username or recovery code is not correct |
refused | 1 | the rotation stops: end-to-end folder … does not open: … |
relogin_required | 9 | a sign-in session unlocks with the master password only. Else run lasbolt login … and approve with “Also unlock encrypted folders” |
reports | (built at run time) | |
server_error | 1 | … |
server_unavailable | 8 | the server has a problem: … |
store_busy | 1 | another lasbolt process uses the local store: try again |
unsynced_changes | 6 | … change(s) are not pushed to the server: sync first, or use –force to drop them |
usage | 2 | the value of … is too long (at most … bytes) |
weak_kdf | 1 | the server gave KDF parameters that are not safe: … |
wrong_password | 2 | … |
The exit codes are on the exit codes page.
Agent codes
The CLI and the apps talk to the local agent over a socket. A failed op answers with one of these codes. The CLI turns most of them into the CLI codes above, so the exit codes do not change.
| Code | Meaning |
|---|---|
api_error | The server answered with an error. The status is in the answer. |
approval_pending | A per-use approval waits for the user. |
bad_passphrase | The passphrase of the key store is wrong. |
bad_request | The op request is not valid. |
bad_url | The page URL cannot be filled: it is not https or has no host. |
internal | The agent failed in a way that it does not show. |
login_required | Nobody is logged in. |
needs_unlock | The local store is locked. Unlock it with the passphrase. |
no_field | The item has no field of the requested kind. |
protocol | The protocol version of the client and the agent differ. |
rollback | An end-to-end folder does not agree with a signed checkpoint. |
unauthorized | The server refused the token of this device. |
unknown_op | The agent does not know the op. The client may be newer than the agent. |
unreachable | The server cannot be reached. |
url_mismatch | The item has no URL that fits the page. |
Push codes
A push sends groups of ops. The answer has one result for each group. A failed group has one of these codes. The client acts as the table in the settlement rules of the design describes.
| Code | Meaning |
|---|---|
clock_skew | The clock of the op is too far ahead. The client gives new times and signs again. |
conflict | The same op ID with other content. This is a bug. The client keeps the data and reports it. |
cycle | The move would make a cycle. The client drops only that move op. |
forbidden | The role or the membership was lost. The client keeps the data locally as read only. |
invalid | The shape or the signature rule failed. This is a bug. The client keeps the data and reports it. |
not_found | In purge results only. There is no such entity in the space. |
parent_missing | The parent of a new entity is gone or purged. The client puts the entity in a folder “Recovered”, or keeps it locally. |
purged | The entity was purged. The client drops the group and tells the user. |
waiting | In client reports only, not on the wire. The group waits for another device that must push the entity first. |
Codes in API error bodies
A failed call of the sync API answers with {"error": "text"}. Some calls add a machine-readable code: in code (membership calls) or in error (read and approval calls, device-code login). A membership call may also answer with the reason of a rule of the membership log, such as last-owner or bad-signature: these reasons come from core/e2e.
| Code | Meaning |
|---|---|
access_denied | The user denied the device-code login. |
approval_decided | The approval was decided before, or it ended. |
approval_denied | The user denied the approval. |
approval_expired | The approval ended before the read. |
approval_not_needed | The item needs no approval. A device token of the user is never asked. |
approval_rate_limited | Too many approvals were asked in a short time. |
approval_required | The item needs a per-use approval. The answer has the approval ID. Wait, then call again. |
authorization_pending | The device-code login waits for the user to approve it in the browser. |
device_only | Only a device token decides approvals. |
e2e_item | The item is end-to-end. Read it with the end-to-end path. |
expired_token | The device code ended. Start the login again. |
invalid_grant | The refresh token or the code is not valid. The session ended. |
keys_pending | The keys of the member in the log are not yet the keys on the server. Wait for the member to publish them. |
needs_grants | An end-to-end approval that only the web app can approve, because it must seal a key. |
no_box_key | The principal has no key to receive an end-to-end value. |
not_head | The membership entry does not build on the newest entry. Read the log again, then sign again. |
outside_scope | The session or key may not read this item. |
slow_down | The client polls too fast. Wait longer between calls. |
stale_pin | The key that the client pinned for a user is out of date. Check the safety number again. |
HTTP status codes
The sync API answers errors with these HTTP statuses.
| Status | Meaning |
|---|---|
400 | The request is not valid. |
401 | There is no valid login, or the credentials are wrong. |
403 | The login is valid, but it may not do this. The role, the scope or the access is too low. |
404 | There is no such resource, or the caller may not see it. |
409 | The state changed. Read again, then try again. |
413 | The request body is too large. |
422 | The request has the right shape, but a rule refused it. |
429 | A rate limit applies. Try again later. |
500 | The server failed. The log has the reason. The answer has no internal text. |
501 | The server does not support this call. |