HTTP 403, workspaces and membership

TENANT-008

Your organization requires single sign-on.

What it means

The workspace requires members to sign in through its identity provider.

What to do

Use your organization's sign-in link. The last owner's password path stays open deliberately, so the workspace can always be recovered.

The response

Every failure arrives in this shape. The trace_id is worth keeping: it identifies the request in our logs and carries nothing about your data.

{
  "type": "https://shiftgraph.dev/errors/TENANT-008",
  "title": "Your organization requires single sign-on.",
  "status": 403,
  "code": "TENANT-008",
  "trace_id": "01J8Z…"
}

Related codes

Organizations, roles, invitations, and the org-level policies an administrator can set. A workspace you cannot see returns Not found rather than Forbidden, so that membership itself is never disclosed.

• TENANT-001Not found.HTTP 404
• TENANT-002This needs a higher role.HTTP 403
• TENANT-003That invitation is no longer valid.HTTP 400
• TENANT-004That slug is taken.HTTP 409
• TENANT-005An organization keeps at least one owner.HTTP 400
• TENANT-006Already a member of this organization.HTTP 409
• TENANT-007Blocked by your organization's IP allowlist.HTTP 403
• TENANT-009A digest needs at least one connected dependency.HTTP 400

The full error reference, or write to support@shiftgraph.dev with the trace id.