Error message glossary

What Eddytor's REST error codes and common verbatim error strings mean - and where to fix them.

What you'll see, what it means, and where to fix it.

REST error envelope

Every REST error has the same shape - branch on code, show message, log request_id:

{ "code": "not_found", "message": "…", "request_id": "550e8400-…",
  "details": [{ "field": "…", "message": "…" }] }

`code`	Meaning
`validation_error`	Malformed request / bad field (`details` lists fields).
`authentication_error`	Missing/invalid/expired credential.
`forbidden`	Authenticated, but role/scope doesn't allow it.
`not_found`	Resource doesn't exist.
`conflict`	Uniqueness/PK violation (DML → `409`).
`unprocessable_entity`	Domain / CHECK / NOT NULL violation (DML → `422`).
`rate_limited`	Too many requests (`429` + `Retry-After`).
`provider_reauth_required`	A linked Azure/Google credential lapsed - re-link.
`provider_upstream_error`	The cloud provider returned an error.
`internal_error`	Server fault - retry with backoff.

Default rate limit is 60 req/min (OAuth 10/min); a 5xx without an envelope is an opaque internal fault.

Message	Cause → fix
`GetFlightInfo failed: Invalid or expired token`	Flight URL unset, or a 15-min login token instead of an API key → fix.
`authentication failed …` (registration)	Storage credentials rejected → storage probe.
`storage path or bucket not found …`	Wrong bucket/container or `base_path` → storage probe.
`could not reach storage …`	Network/endpoint problem → storage probe.
`managed identity unavailable - not running on Azure infrastructure…`	`use_msi` off Azure → use a service principal → Azure Blob.
`400 redirect_uri does not match any registered URI`	UI origin not registered → redirect_uri mismatch.
`secret decrypt failed` (at boot)	Wrong/missing `EDDYTOR_ENCRYPTION_KEY` → backups & key rotation.
`extension "citext" is not allow-listed`	Azure Postgres extensions not allow-listed → AKS.
`Invalid hierarchy format`	Hierarchical domain keyed by parent string, not UUID → set a domain.