MISSING_SCOPE | API key exists but lacks the required scope or capability. error.details.required_scope names the missing scope. |
PHI_BLOCKED | Message contains PHI and phi_mode=block is configured. error.details.entity_types lists what was detected. |
FEATURE_NOT_HIPAA_ELIGIBLE | The requested AI feature is not HIPAA-eligible and is disabled in the allowlist. |
MODEL_ACCESS_DENIED | Opus model access is disabled for this org. Enable at Settings → AI Workspace → Models. |
TOOL_NOT_IN_SCOPE (Agent SDK) | The agent attempted to invoke a tool outside its delegated scope grant. |
SCOPE_CONSTRAINT_VIOLATION (Agent SDK) | The request violates a constraint attached to the agent’s scope grant (e.g. a resource-id allowlist). |
AI_PAUSED | AI is paused for this organization. An org admin can resume it in Settings → AI Controls. |
FEATURE_NOT_AVAILABLE | The requested feature is not included in the org’s current plan tier. error.details.required_tier names the tier that unlocks it. |
ORGANIZATION_MISMATCH | The authenticated caller does not belong to the organization that owns the requested resource. |
RAG_RETRIEVAL_DISABLED | Knowledge retrieval is disabled for this org or persona. |
RETRIEVAL_PHI_BLOCKED | The knowledge-search query or a retrieved chunk was blocked because it contains PHI and the resolved PHI policy forbids returning it. |
ORG_ADMIN_REQUIRED | The action requires the delegating user to be an organization admin. |
INTEGRATIONS_DISABLED | The Integrations (BYO-Tool) feature is disabled for this org. |
CONVERSATION_OWNER_REQUIRED | Server-owned conversations are owned by the credential that creates them, and this credential type cannot hold that ownership. Use an API key or an agent credential. |
IP_NOT_ALLOWED (Data API) | The project API key carries an IP allowlist and the request came from an address outside it. |
FORBIDDEN (Data API) | The caller does not reach the project in the URL — a project API key or agent credential for a different project or org, or a session user with no access to the project — or, on GET /api/hasp/v1/bootstrap, the signed-in user has no access to the app. Data API access is scoped per project. An X-Hasp-AppId naming an app of a different project gets NOT_FOUND instead, so an anonymous caller learns nothing about a project it cannot use. |
INSUFFICIENT_ROLE (Data API) | The caller reaches the project, but its role lacks the record capability the HTTP method needs (read, write, or delete). error.details.required_capability names it. |
BOT_VERIFICATION_REQUIRED (Data API) | An anonymous public-form submission failed or omitted the Turnstile challenge. Send the widget’s token as cf-turnstile-response (body) or X-Turnstile-Response (header). error.details.turnstile_required is true. |