Errors

TKeeper fails closed. If a protected operation cannot pass auth, policy, audit, lifecycle, or quorum checks, no proof is produced.

Error response shape

Error responses include:

{
  "error": "ACCESS_DENIED",
  "details": "...",
  "imposters": [],
  "dead": []
}

Fields:

Field	Meaning
`error`	stable error enum
`details`	optional diagnostic detail
`imposters`	peers identified as bad where the protocol can identify them
`dead`	peers that were unavailable or failed to respond where tracked

imposters is not guaranteed for every failure. Threshold ML-DSA can abort normally during rejection sampling without identifying an imposter.

Error	Usually means	First check
`UNAUTHENTICATED`	no accepted client identity	token/header/JWKS
`ACCESS_DENIED`	client lacks required permission	permission claim and negative grants
`KEEPER_SEALED`	node is sealed	unseal state
`NOT_COORDINATOR`	request sent to non-coordinator	coordinator config
`INVALID_AUTHORITY`	invalid authority list, id, OCI reference, document, or policy	key authority configuration and artifact digest
`AUTHORITY_VIOLATION`	command authority is not attached to the key	key authorities and command `authorityId`
`INVALID_AUTHORITY_ARTIFACT`	command cannot be decoded or feature missing	authority type and build features
`POLICY_VIOLATION`	policy denied the intent	materialized intent and matched rules
`AUDIT_NOT_AVAILABLE`	no audit sink is usable	audit sink config
`AUDIT_FAILED`	audit write failed	sink health and timeout
`SESSION_MAX_ROUNDS_EXCEEDED`	retry cap exhausted	peer health, request deadline, ML-DSA retries

For the complete enum, see ../../openapi.yaml.