okta
Okta API Error Codes
Error codes returned by the Okta API in the errorCode field of a JSON error response, alongside an errorSummary and HTTP status. Covers authentication, authorization, session, and rate-limit failures encountered when integrating with Okta's Core API and Authentication API.
12 codes
references developer.okta.com/docs/reference/error-codes/developer.okta.com/docs/reference/rate-limits/
· All codes 12 codes
- E0000001 API Validation Failed A general-purpose error returned when a request violates an endpoint-specific precondition, such as a malformed or missing required field. The accompanying errorSummary (e.g. "Api validation failed: authRequest") identifies the specific field or object that failed validation. Returned with HTTP 400; check the errorCauses array in the response body for the exact field.
- E0000004 Authentication Failed The credentials supplied to the Authentication API (username/password, or a SAML assertion) were not accepted. Okta also reuses this code for some authorization mismatches, such as a SAML AudienceURI that doesn't match the service provider's configuration. Returned with HTTP 401; verify the credentials and, for SAML, the app's configured Audience URI.
- E0000005 Invalid Session The session ID or session cookie provided with the request is invalid or has expired. Returned with HTTP 401; the client should re-authenticate to obtain a new session rather than retry the same session token.
- E0000006 Access Denied The authenticated principal doesn't have permission to perform the requested action, typically because the API token's admin role lacks the required scope. Returned with HTTP 403; check the role assigned to the API token or user making the request.
- E0000007 Resource Not Found The requested resource, such as a user, app, or group ID, doesn't exist in the org. Returned with HTTP 404; the errorSummary names the resource type and identifier that couldn't be found.
- E0000009 Internal Server Error An unexpected error occurred on Okta's side while processing the request. Returned with HTTP 500; if the error persists, contact Okta Support with the errorId from the response body for a server-side trace.
- E0000011 Invalid Token Provided The API token or bearer token included in the request is invalid, revoked, or malformed. Returned with HTTP 401; regenerate the API token in the Okta admin console and confirm the Authorization header is formatted as SSWS <token> for API tokens or Bearer <token> for OAuth access tokens.
- E0000015 Feature Access Denied The requesting org's subscription or feature flags don't include the feature being accessed, even though the caller is otherwise authorized. Returned with HTTP 403; confirm the feature is enabled for the org, or contact Okta about upgrading the subscription.
- E0000016 User Already Active An activation request was sent for a user who is already in the ACTIVE status. Returned with HTTP 403; check the user's current status before calling the activate lifecycle operation.
- E0000017 Password Reset Failed The reset-password lifecycle operation couldn't be completed for the target user, commonly because the user isn't in a status that allows a password reset. Returned with HTTP 403; check the user's current lifecycle status.
- E0000047 API Rate Limit Exceeded The API call exceeded the rate limit for its endpoint bucket. Returned with HTTP 429 along with X-Rate-Limit-* headers indicating the limit, remaining calls, and reset time; back off and retry after the reset time, or request a rate limit increase from Okta Support for sustained high-volume use.
- E0000068 Invalid Passcode/Answer The one-time passcode, security question answer, or other factor response submitted during an MFA challenge didn't match. Returned with HTTP 403; the user should retry the challenge, requesting a new passcode if it may have expired.