Error reference
Each check in the certificate names a reason code when needed. This reference explains what triggers each code and how to fix it.
The engine reports a status for each of the ten checks: valid, invalid, not checked, not present, unknown or recognized. Where the status needs an explanation, the certificate names a reason code. The codes are stable and the same in all versions of the engine; new codes are added only with a new version.
Not every code is an error. Some describe missing evidence that makes a result indeterminate, such as a missing status list. The following pages explain the codes per check.
Codes by check
- Format and schema
6 codes: format_unknown, format_recognized_not_supported, not_evidence_key_material, malformed, required_claim_missing, format_not_supported
- Cryptographic integrity
13 codes: signature_invalid, no_key, unsupported_alg, disclosure_digest_mismatch, disclosure_unreferenced, disclosure_duplicate, kb_jwt_invalid, chain_hash_mismatch, chain_link_broken, binding_mismatch, manifest_mismatch, no_crypto_material, tsa_signature_invalid
- Issuer
3 codes: issuer_key_not_trusted, kid_issuer_mismatch, no_signed_artifact
- Agent and principal
5 codes: agent_mismatch, principal_missing, agent_missing, no_credential, credential_is_not_a_mandate
- Mandate validity
3 codes: expired, not_yet_valid, mandate_not_included
- Scope of the action
7 codes: action_not_in_scope, amount_exceeds_limit, currency_mismatch, counterparty_not_allowed, mandate_without_scope, constraint_not_supported, no_action
- Delegation chain
4 codes: no_delegation, delegation_broken, delegation_scope_widened, delegation_key_missing
- Revocation
7 codes: revoked, suspended, status_value_unknown, status_list_not_provided, status_list_unverified, status_list_invalid, no_status_reference
- Execution receipt
4 codes: receipt_decision_mismatch, receipt_mandate_mismatch, no_receipt, no_decision_reference
- Timestamp
6 codes: tsa_malformed, tsa_imprint_mismatch, tsa_anchor_not_provided, tsa_not_trusted, tsa_target_unknown, no_timestamp
Dependencies between checks
prerequisite_failed
Not checked because an earlier check failed.
Cause: The check was not run because an earlier check it builds on failed. Without a readable format, for example, no signature can be verified.
Fix: First fix the code of the earlier check. The engine then runs the dependent checks again.