API error reference

Invalid email or password.

The address and password did not match an account. The response is identical whether or not the address exists, so it cannot be used to discover who has an account.

What to do: Check both values and try again. Repeated failures slow the endpoint down before they lock it.

Your session has expired. Sign in again.

The session is past its absolute lifetime, or an organization policy set a shorter maximum age than the default.

What to do: Sign in again. If this recurs quickly, an administrator may have set a session maximum age under Settings, Security.

Second factor required.

The password was accepted but the session has not completed its second factor. Every ShiftGraph account carries one; there is no account type that skips it.

What to do: Complete the factor prompt. If the device is unavailable, a recovery code signs you in and burns itself.

That code didn't match. Try again.

The one-time code or recovery code was wrong, or was already used.

What to do: Re-read the code from your authenticator. If the clock on that device has drifted, correct it, since codes are time-based.

This action needs a fresh verification.

A sensitive action was attempted with a second factor verified more than five minutes ago. Creating credentials, changing security settings, and deleting a workspace all require a fresh one.

What to do: The application raises the verification prompt and retries the action for you. If you cancelled it, repeat the action.

Too many attempts. Wait before trying again.

The sign-in path has been tried too many times for this account or address. The lock lengthens with each episode.

What to do: Wait the stated interval. A password reset clears the lock immediately.

That link is no longer valid.

A single-use link, for verification, reset, or an invitation, has expired, been revoked, or already been spent.

What to do: Request a new one. Links are deliberately short-lived and never reusable.

Your account is suspended.

The account has been suspended, which stops every session immediately rather than at the next expiry.

What to do: Contact your administrator, or write to support if you believe this is a mistake.

That verification code has expired. Request a new one.

The emailed code has passed its validity window.

What to do: Request another. The resend control becomes available after a short countdown.

This sign-in method is already linked.

The provider identity is already connected, either to this account or to another one. ShiftGraph never links an external identity to an existing account automatically by matching addresses.

What to do: Sign in with the method already connected, then manage connections under Account, Security.

Removing this would leave no way to sign in.

Removing the last password or the last connected identity would lock the account out permanently.

What to do: Add another sign-in method first, then remove the one you intended to.

Cross-site request blocked.

A state-changing request arrived without a matching origin or the double-submit token. Both layers exist because a browser session is ambient authority.

What to do: Retry from the application. If you are calling the API directly, use a Bearer token, which is exempt by construction because it carries no ambient cookie.

This session was signed out.

The session was revoked, or a security event newer than the token invalidated every session on the account.

What to do: Sign in again. If you did not expect this, review Account, Security for recent activity.

Password does not meet the requirements.

The password is too weak, or appears in a public breach corpus. That check runs without sending the password anywhere: only a short hash prefix leaves the browser.

What to do: Choose a longer passphrase that you have not used elsewhere.

ShiftGraph is currently invite-only.

Sign-up requires an invitation. This is the current posture, not an error in your request.

What to do: Request access from the sign-up page, or ask a workspace owner to invite you.

Invalid or revoked API token.

The Bearer token does not exist, has been revoked, or has been rotated.

What to do: Issue a new token under Settings, Tokens, or Account, Tokens. Tokens are shown once and stored only as a hash.

This token lacks the required scope.

The token is valid but was not granted the scope this endpoint needs.

What to do: Issue a token with the scope named in the endpoint's documentation. Scopes are chosen explicitly at creation; none is preselected.

Not found.

The workspace or record does not exist, or you are not a member of it. Non-membership deliberately reads as absence, so this response never confirms that a workspace exists.

What to do: Check the workspace in the address bar. If a colleague expected you to have access, ask them to invite you.

This needs a higher role.

You are a member, but the action requires more than your role. Viewers read; members operate; admins configure; owners hold billing and deletion.

What to do: Ask an administrator or owner to perform it, or to raise your role.

That invitation is no longer valid.

The invitation expired, was revoked, was already accepted, or was issued to a different address. An invitation is bound to the address it was sent to.

What to do: Ask for a fresh invitation to the address you are signing in with.

That slug is taken.

Another workspace already uses this identifier, or it is reserved. Reserved is not the same as invalid.

What to do: Choose another. The creation form checks availability as you type.

An organization keeps at least one owner.

The change would leave the workspace with no owner, which would make billing and deletion unreachable.

What to do: Promote another member to owner first, or transfer ownership, then repeat the change.

Already a member of this organization.

The invited account is already in the workspace.

What to do: None. Adjust the existing member's role instead, under Settings, Members.

Blocked by your organization's IP allowlist.

An administrator restricted this workspace to a set of networks, and the request did not come from one.

What to do: Connect from an allowed network. The setting refuses to save a list that would exclude the author's own address, so an administrator cannot lock the workspace out this way.

Your organization requires single sign-on.

The workspace requires members to sign in through its identity provider.

What to do: Use your organization's sign-in link. The last owner's password path stays open deliberately, so the workspace can always be recovered.

A digest needs at least one connected dependency.

A scheduled digest would report nothing. Sample data does not count, because the mailed digest reports real activity only.

What to do: Connect a source and let real traffic arrive, then set the digest frequency.

At the plan limit for monitored dependencies.

Every monitoring slot on the plan is spent. Discovering a dependency never spends one; choosing to monitor it does.

What to do: Stop monitoring one you no longer need, or move to a plan with more slots.

At the plan limit for projects.

A project is the unit the CI gate binds a repository to, and the plan sets how many a workspace may hold. The ceiling has been reached.

What to do: Remove a project you no longer gate, or move to a plan with a higher ceiling. Existing gate runs are unaffected.

This feature is not on the current plan.

The capability belongs to a higher plan. This is checked where the work happens, not only where the button is, so an API caller sees the same boundary as the interface.

What to do: Review the plan comparison on the pricing page, or ask an owner to change plan.

Unknown ingest key.

The key is unrecognized or revoked. Keys are stored only as hashes, so a lost key cannot be recovered, only replaced.

What to do: Create a new key under Sources and update the recorder's configuration.

Batch rejected: value-bearing payload.

The batch carried a real value where the contract permits only a typed placeholder. This is the value-free guarantee enforced as an input validator: the batch is refused rather than stored, and nothing from it is kept.

What to do: The response names the exact path that offended. Update the recorder, which strips values in your process before anything is sent, and resend.

Batch exceeds the size limit.

The payload is larger than the endpoint accepts.

What to do: Send smaller batches. The recorder batches on your behalf and is the supported path.

Ingest rate limit reached.

Too many batches arrived in the window. Ingestion has its own limiter, separate from sign-in.

What to do: Back off and retry. The recorder does this for you.

Payment required.

The workspace is read-only because a trial lapsed or an invoice is outstanding. Reading, exporting, billing, invitations, and withdrawal from the corpus all keep working: a boundary that traps the customer instead of the product would be the worse bug.

What to do: Settle the outstanding invoice. Nothing is deleted while a workspace is read-only, and paying restores it.

A plan change is already in progress.

Another plan change is mid-flight for this workspace.

What to do: Wait for it to settle, then retry.

Downgrade needs quota resolution first.

The target plan holds fewer slots than the workspace currently uses, or single sign-on is live and the target plan does not carry it. Nothing is torn down silently to make a downgrade fit.

What to do: Choose what to keep in the resolution step, or keep the current plan.

Unknown plan or interval.

The requested plan or billing interval is not one we sell.

What to do: Choose a listed plan. Enterprise is arranged by agreement rather than self-serve.

Billing is not configured for this organization.

A checkout was requested where no payment processor exists. ShiftGraph invoices and is paid by transfer, so there is no checkout to send you to.

What to do: Request the plan from the billing page. We send an invoice, and the plan starts when it is paid.

Unknown gate run.

The run identifier does not belong to this workspace.

What to do: Check the identifier the command line reported.

No project is bound for this gate run.

The run named no project, so no per-project policy could be applied.

What to do: None required: the gate falls back to the default policy, which fails on a breaking change and passes on an additive one.

Invalid request.

The request did not match the endpoint's schema.

What to do: Compare the body against the documented shape. The response's detail field names what failed.

Something went wrong on our side.

An unexpected condition. The message stays generic on purpose; the specifics are logged server-side rather than returned.

What to do: Retry. If it persists, send us the trace id from the response and we can find the exact request.

Rate limit reached.

Too many requests arrived in the window for this caller. Limits are applied per surface, so ingestion, sign-in, and the general API are counted separately and one cannot exhaust another.

What to do: Back off and retry, ideally with exponential backoff. If you are hitting this steadily rather than in bursts, tell us what you are building and we will look at the limit.

Method not allowed.

The path exists but not for this HTTP method.

What to do: Use the method the endpoint documents.

Request too large.

The request body is larger than this endpoint accepts. The limit exists so that a single request cannot occupy resources that belong to every other caller.

What to do: Split the work across several requests. If this is a capture rather than an API call, the recorder batches for you and is the supported path.