Error codes

Every CHW-NNNN error the Chainsaw API emits, with HTTP status and remediation guidance.

Every error the Chainsaw API returns carries a stable CHW-NNNN code in the response body (error.code) and in a docs URL that points operators and integrators at the page for that specific failure.

{
  "error": {
    "code": "CHW-2001",
    "message": "request blocked by configured policy",
    "docs": "https://docs.chain305.com/errors/CHW-2001"
  }
}

Numbering

RangeCategoryTypical HTTP
CHW-1xxxAuthentication & authorization, caller rate limits, plan quotas401 / 403 / 429 / 402
CHW-2xxxPolicy enforcement403 / 451
CHW-3xxxUpstream registry failures429 / 404 / 502 / 504
CHW-4xxxMalformed client input400 / 404 / 409 / 422
CHW-5xxxInternal / storage failures500
CHW-8xxxDomain-scoped, outside the 1–5 split (grouped below as Other)varies

Codes are never re-used — once assigned to a failure, a code keeps that meaning even if the failure path is later deleted. Read the leading digit as where the code was minted, not as a predicate on HTTP status: CHW-1301 and CHW-1304 are rate limits (429) that live in the auth block by design.

Authentication & authorization

CodeHTTPReasonMessage
CHW-1001401UNAUTHORIZEDauthentication required
CHW-1002401TOKEN_EXPIREDauthentication token expired
CHW-1003403INSUFFICIENT_SCOPEforbidden
CHW-1101401—invalid credentials
CHW-1102401—two-factor authentication required; complete the /api/auth/2fa/verify handshake
CHW-1103401—invalid verification code
CHW-1104429—too many verification attempts; please log in again
CHW-1105400—SSO state is invalid or has already been consumed; restart the sign-in flow
CHW-1106400—SSO session expired; please start sign-in again
CHW-1107403—your email domain is not allowed for this organization
CHW-1108400—SSO nonce validation failed; restart the sign-in flow
CHW-1109502—identity provider returned an error or could not be contacted
CHW-1110403—organization seat limit reached; contact an administrator to upgrade the plan
CHW-1111401—account is disabled
CHW-1112401—invalid password
CHW-1113403—SSO is not included in this organization’s current plan; contact an administrator
CHW-1201403—org admin privileges are required for this action; ask an org admin or owner to perform it
CHW-1202403—global admin privileges are required to assign or modify the global-admin role
CHW-1203403—the requested role grants permissions beyond the caller’s own; ask a broader-privileged admin to assign it
CHW-1204403—the target member holds broader permissions than the caller; ask an equally-or-more privileged admin to make the change
CHW-1205403—cannot remove yourself from the organization; ask another org admin to remove your membership
CHW-1206403—an active membership in the target org is required; ask an org admin to invite you
CHW-1207403—the invitation was issued to a different email than the signed-in account; sign in with the invited email or ask the inviter to re-issue
CHW-1208403—the default org cannot be purged; it is load-bearing for single-tenant deployments
CHW-1209403—Cloudflare Turnstile security check failed; refresh and retry, or disable browser extensions that block challenges
CHW-1301429RATE_LIMITEDrepository rate limit exceeded; slow down or check the Retry-After header before retrying
CHW-1302402PLAN_UPGRADE_REQUIREDorganization usage quota exceeded; upgrade the plan or free storage before retrying
CHW-1303404—unknown organization in repository URL; verify the @{org-slug} segment or ask an admin to confirm the org exists
CHW-1304429RATE_LIMITEDfeedback rate limit exceeded for this user — slow down or check the Retry-After header before retrying
CHW-1305429RATE_LIMITEDscan capacity is saturated; retry after the interval in the Retry-After header
CHW-1306409NOT_SEQUENCEDrun the basic scan for this coordinate before requesting a deep scan
CHW-1401402PLAN_UPGRADE_REQUIREDthis feature is not included in your current plan; upgrade the organization plan to continue
CHW-1402503—Billy is not configured on this instance; ask an operator to set OPENROUTER_API_KEY to enable the AI assistant
CHW-1403503—payment processor not configured on this instance; contact support or self-host operator
CHW-1404429RATE_LIMITEDtoo many plan changes from this organization — please wait and try again
CHW-1405409—no paid subscription on file for this organization; upgrade to a paid plan before opening the billing portal
CHW-1406503—billing store is not available; the server started without a database — check the operator dashboard
CHW-1407503—paddle webhook not configured; operator must set the webhook secret before paddle events can be accepted
CHW-1408400—Billy action could not be applied; inspect the request-specific error message for the next step
CHW-1501403—an organisation context is required to read usage data; switch into a specific org before retrying
CHW-1601403—global runtime settings must be managed from /api/admin/settings; per-org endpoints reject clamav and data_sources fields
CHW-1801403—you do not have permission to manage this client credential; ask an org admin or the credential owner
CHW-1802403—this package version has been quarantined by an administrator; contact the org admin who quarantined it if you believe this is an error
CHW-1803401—client credentials are required to access this repository; supply them via basic auth or the Authorization header
CHW-1920403—requested scope exceeds your current permissions; you can only mint a key whose permissions you already hold
CHW-1921403—cannot widen an existing key’s scope; mint a new key instead

Policy enforcement

CodeHTTPReasonMessage
CHW-2001403POLICY_BLOCKrequest blocked by configured policy; review the policy that matched in the policy audit log
CHW-2002403VULNERABILITY_DETECTEDpackage blocked because it contains a known vulnerability at or above the configured severity threshold; upgrade the package or lower the…
CHW-2003403LICENSE_BLOCKpackage blocked because its license is not on the allowed list for this repository; add the SPDX ID to the allowlist or choose a compatib…
CHW-2004403TYPOSQUAT_DETECTEDpackage name resembles a known-good package and was blocked as a suspected typosquat; verify the intended name or allowlist the coordinate
CHW-2301403POLICY_BLOCKpackage release is younger than the configured minimum-age window; wait for the version to age out or add an exception for this coordinate
CHW-2302403POLICY_BLOCKrequest blocked by configured policy; review the matched policy in the audit log or request an exception from an org admin
CHW-2303403MALWARE_DETECTEDpackage flagged as known malicious by the supply-chain scanner and blocked; verify the package coordinate and report the detection if it …
CHW-2304403HOOK_BLOCKrequest blocked by repository hook; review the hook response or the hook configuration
CHW-2305403CHECKSUM_MISMATCHartifact checksum mismatch: upstream-declared hash disagrees with downloaded bytes; inspect the X-Chainsaw-Checksum-Mismatch header or ra…
CHW-2306403POLICY_BLOCKpublish blocked by policy; the rule that fired is named in the response payload’s policy_id / rule_id field
CHW-2307403COVERAGE_UNAVAILABLErequired signal coverage unavailable: a data source your deployment marked mandatory could not be evaluated for this package, so the requ…

Upstream registry

CodeHTTPReasonMessage
CHW-3001502—upstream registry is unreachable; retry shortly or check network connectivity to the configured mirror
CHW-3002429—upstream registry rate-limited this request; slow down or configure an authenticated mirror
CHW-3003404—upstream registry returned 404 for this coordinate; verify the package name and version
CHW-3401400—paddle webhook signature verification failed; reject suspected replay or misconfigured secret
CHW-3402400—paddle webhook event body could not be parsed; event_id / event_type missing
CHW-3403400—paddle webhook body could not be read; retry shortly
CHW-3404502—paddle did not accept the checkout / subscription update request; retry shortly and if it persists contact support
CHW-3405502—could not prepare the paddle customer record for this organization; retry shortly
CHW-3406502—could not open the paddle billing portal; retry shortly
CHW-3407500—Billy could not complete the request; please try again, and if the problem persists check that OPENROUTER_API_KEY has remaining credit
CHW-3408500—could not clear Billy history; please retry
CHW-3701502—webhook test delivery failed; the endpoint was unreachable or returned a non-2xx response — verify the URL and the endpoint’s handling …
CHW-3702502—SIEM test delivery failed; the configured endpoint was unreachable or rejected the probe — check host/port/token and firewall rules
CHW-3703502—the SAML identity provider’s metadata endpoint could not be fetched or parsed; verify the IdP metadata URL is reachable and returns well-…

Client input

CodeHTTPReasonMessage
CHW-4001400—request payload failed validation; see endpoint documentation for the expected shape
CHW-4002400—package coordinate could not be parsed; supply name, version, and (where required) namespace in the format the ecosystem expects
CHW-4101400—signup payload failed validation; email, password, and org_name are required
CHW-4102409—An account with this email already exists. Sign in instead.
CHW-4103400—request payload was missing or malformed; see endpoint documentation for the expected JSON shape
CHW-4104400—password must be at least 12 characters
CHW-4105400—signup requires a business email address; personal / disposable providers are not accepted
CHW-4106400—new password and confirmation do not match
CHW-4107400—invalid or expired verification link
CHW-4108400—this verification link has expired; please request a new one
CHW-4109400—this verification link has already been used
CHW-4110400—invalid or expired reset link
CHW-4111400—this reset link has expired; please request a new one
CHW-4112400—this reset link has already been used
CHW-4113400—no TOTP setup in progress; call /api/settings/2fa/setup first
CHW-4114409—two-factor authentication is already enabled; disable it before re-enrolling
CHW-4115400—no TOTP setup in progress; start setup before verifying a code
CHW-4116400—SSO configuration payload is missing required fields for the chosen protocol
CHW-4117404—SSO is not configured for this organization
CHW-4118409—a mapping for this group value already exists on this provider
CHW-4119404—SSO group mapping not found
CHW-4120404—member not found in your organization
CHW-4121400—this member does not have two-factor authentication enabled
CHW-4122404—this feature is not enabled on this instance
CHW-4123409—An account already exists for the underlying email address. Sign in or use a different email.
CHW-4124409—A workspace with this name already exists. Try a different name.
CHW-4201404—organization not found; verify the org_id and that it has not been deleted
CHW-4202404—user not found in this organization; verify the user_id and that the membership still exists
CHW-4203404—group not found in this organization; verify the group_id
CHW-4204404—role not found in this organization; verify the role slug or id
CHW-4205404—invitation not found; verify the token or ask the inviter to re-issue
CHW-4206400—invitation has expired; ask the inviter to re-issue it
CHW-4207400—invitation has already been accepted; sign in with the invited email to access the org
CHW-4208409—org slug is already in use; pick a different slug
CHW-4209409—this email is already registered; invite by inviting the existing account or ask them to sign in and accept
CHW-4210409—a pending invitation already exists for this email; revoke it before issuing a new one
CHW-4211409—an account with this email already exists; sign in and then accept the invitation from the same session
CHW-4212409—member limit reached — ask an owner to upgrade the organization’s plan
CHW-4213400—unknown role; supply a built-in role slug or an existing custom role in this org
CHW-4214400—built-in roles cannot be edited or deleted; create a custom role instead
CHW-4215409—role is in use; reassign members, invitations, and SSO defaults before deleting
CHW-4216400—the invitation’s role is no longer available; ask the inviter to re-issue with a current role
CHW-4217400—email failed validation; use a business email address accepted by the org policy
CHW-4218400—password must be at least 12 characters; supply a longer passphrase
CHW-4301404—package not found; verify the package id and that it has not been deleted
CHW-4302404—package version not found; verify the version string and that it has not been deleted
CHW-4303404—package permission not found; verify the permission id and the caller’s org
CHW-4304409—package slug already exists for this repository; pick a different package_name or update the existing slug
CHW-4305409—package name already exists in the upstream registry; only names unused upstream can be registered as internal packages
CHW-4306404—repository not found; verify the repository name and that it is configured for this org
CHW-4307400—invalid repository path; use /repository/@{org-slug}/{repo}/{path} or /repository/{repo}/{path}
CHW-4308400—missing package or permission identifier in URL; supply /api/packages/{id} or /api/package-permissions/{id}
CHW-4309400—required fields are missing from the request body; see endpoint documentation for the expected shape
CHW-4310409—package permission already exists for this client, pattern, and repository; edit the existing row instead of creating a duplicate
CHW-4311400—client not found in this organization; verify the client_id or create the client credentials first
CHW-4312404—exception policy not found; verify the exception id and that it has not been deleted
CHW-4313400—only vulnerability-exception policies can be renewed; other policy types have no expiry to extend
CHW-4314400—org-scoped URL required: /repository/@{org-slug}/{repo-name}/…; legacy URLs without the org slug are disabled on this instance
CHW-4315404—finding not found; verify the id and that it belongs to the caller’s org
CHW-4316400—finding status transition not allowed; see the finding state machine documentation for the legal moves
CHW-4317404—scan subsystem not initialised on the server
CHW-4318400—lockfile could not be parsed; verify the base64 payload and the lockfileType
CHW-4319400—bulk request exceeds 500 items; split the request or lower maxResults
CHW-4320400—unsupported lockfile type; valid values are “npm” and “pnpm”
CHW-4321400—unsupported sbom output format; this server emits CycloneDX only (use ?format=cyclonedx or omit the parameter; for ecosystem filtering us…
CHW-4322400—risk weight override malformed; expected body {“weights”:{“vulnerability”:0.5,…}} with numeric values
CHW-4323400—risk weight override fails validation: weights must be non-negative, known categories, sum > 0, and no single weight above 0.8
CHW-4324404—no risk weight override set for this org; defaults apply until a PUT /api/v1/intel/weights is made
CHW-4325404—tuning suggestion not found; verify the id and that it belongs to the caller’s org
CHW-4326409—tuning suggestion is not in the ‘open’ state; only open suggestions can be accepted or dismissed (the next action must come from a new po…
CHW-4327400—feedback action must be one of: false_positive, true_positive, retract; retract requires a referencing_event_id
CHW-4401400—plan_id is not one of the allowed plan slugs; supply a current plan from /api/billing/plans
CHW-4402400—billing_cycle must be either “month” or “year”
CHW-4403400—the selected plan is not available on the requested billing cycle; pick a different cycle or contact support
CHW-4404400—billing request body was missing or malformed; see /api/billing documentation for the expected shape
CHW-4405400—Billy chat requires a non-empty message field
CHW-4406400—unsupported Billy action type; supply one of the handler-registered action kinds
CHW-4407400—Billy policy payload was missing or malformed; supply a decodable policy draft
CHW-4408400—Billy action is missing its required target id or policy draft
CHW-4409404—service token not found in this organization; verify the client id
CHW-4410400—target client is not a service token; service_token.disable cannot apply to user-owned credentials
CHW-4411404—policy not found in this organization; verify the policy id
CHW-4412400—policy store rejected the draft; fix the validation issue and retry
CHW-4413429RATE_LIMITEDBilly chat rate limit exceeded — please wait and retry
CHW-4501409—cannot delete this pricing plan: it is still assigned to one or more organisations; reassign those orgs to a different plan first
CHW-4502409—another pricing plan is already marked as the default; clear the existing default before promoting a new one
CHW-4503400—pricing plan features JSON failed validation; supply a JSON object whose keys match the documented feature flags
CHW-4504400—plan assignment requires both orgId and planId in the request body
CHW-4505400—user id segment is required on /api/usage/users/{userId}
CHW-4506400—org_id query parameter is required for this admin endpoint
CHW-4507400—saved traffic view requires a non-empty “name” field so it can be identified in the UI
CHW-4508400—view id segment is required on DELETE /api/traffic/views/{id}
CHW-4509400—violation id segment must be a numeric value; check the URL
CHW-4510404—violation not found in this organisation; verify the id and that the violation has not been purged
CHW-4511400—repository name segment is required on this endpoint
CHW-4512400—vulnerabilities path must match {repository}/vulnerabilities; check the URL
CHW-4513400—audit event payload was missing required fields or could not be decoded; check the request body shape
CHW-4514400—scan request body could not be decoded or contained an empty packages list; supply {“packages”:[{“name”:"…",“version”:"…"},…]}
CHW-4515400—attestation payload was missing required fields (device_id, ecosystems, direct_registry_egress) or could not be decoded; check the reques…
CHW-4516400—coverage flag payload requires a non-empty client_id; check the request body shape
CHW-4517400—bypass exemption payload requires a non-empty client_id and reason; check the request body shape
CHW-4518409—this exemption cannot be resolved yet: bypass confidence has not stayed below threshold for the required 24h window
CHW-4519413—audit export refused: this org has more rows than the in-memory export endpoint can safely return; use the (forthcoming) streaming /api/a…
CHW-4601400—settings payload failed validation; check field types and ranges against the endpoint documentation
CHW-4602400—settings payload contained no mutable fields; supply at least one field to update
CHW-4603400—policy payload failed validation; check rule shape, action, and scope against the policy schema
CHW-4604409—policy conflicts with an existing one (duplicate name or precedence); pick a unique identifier or precedence
CHW-4605404—policy not found in this organisation
CHW-4606404—proxy/repository not found in this organisation
CHW-4607400—proxy update payload failed validation; check remote_url, cache_negative_ttl_seconds, and that at least one mutable field is supplied
CHW-4608400—unknown data source; expected one of openssf, trivydb, epss, clamavdb
CHW-4609400—cache purge path is malformed; expected /api/cache/repos/{repo}/packages/{package}/{version}
CHW-4610404—no cached artifacts found for the supplied repository, package, and version
CHW-4611400—cache purge-all requires a password in the request body
CHW-4612403—incorrect password
CHW-4613404—client not found in this organisation
CHW-4614400—org_id is required for this endpoint; supply it as a query parameter or path segment
CHW-4615400—unknown persona; supply a recognised persona slug or omit the field to clear it
CHW-4616400—repo→team mapping payload failed validation; both repoPattern and team are required
CHW-4617404—repo→team mapping not found in this organisation
CHW-4618409—repo→team mapping with this pattern already exists in the organisation
CHW-4701400—webhook request body was missing or malformed; supply a JSON object with url (and optionally enabled) fields
CHW-4702400—webhook url is required
CHW-4703400—webhook url was rejected; it must be an https URL pointing to a publicly routable host
CHW-4704400—maximum of 5 webhooks per user; delete an existing webhook before creating a new one
CHW-4705400—webhook id is required in the path; use /api/webhooks/{id}
CHW-4706404—webhook not found
CHW-4707400—SIEM integration id is required in the path; use /api/siem/integrations/{id}
CHW-4708404—SIEM integration not found
CHW-4709400—SIEM integration config failed validation; check name, provider, and provider-specific config fields
CHW-4710404—SCIM token not found
CHW-4711400—SCIM token request was malformed; see /api/orgs/{org_id}/scim/tokens docs for the expected shape
CHW-4712400—organization slug is required in the path; use /api/auth/saml/metadata/{slug}
CHW-4713404—SAML SSO is not configured for this organization
CHW-4714400—the configured SSO provider for this organization is not SAML; use the OIDC metadata endpoint instead
CHW-4715400—persona payload was missing or malformed; supply a JSON object with optional persona, inferred, and skipped fields
CHW-4716400—persona value is not recognised; supported values are appsec, devsecops, enterprise_it
CHW-4717400—could not read postmark webhook body; the request was truncated or the connection dropped mid-request
CHW-4718413—postmark webhook body exceeded the 256 KiB limit
CHW-4719403—email send skipped because the recipient is in the local postmark suppression ledger (hard bounce, spam complaint, or manual suppression)
CHW-4801400—client identifier is required; supply it in the URL path (/api/clients/{client_id})
CHW-4802400—client credential payload could not be decoded; ensure the body is a JSON object matching the schema
CHW-4803400—client credential fields are invalid or conflict with an existing record; verify client_id, client_type, and expiry_date
CHW-4804404—client credential not found; verify the client id and that it has not been deleted
CHW-4805400—quarantine action requires a package name segment in the path before /versions/
CHW-4806400—quarantine request body could not be decoded; supply a JSON object with optional reason and logical_paths fields
CHW-4807404—no cached artifacts found for this package version; nothing to quarantine
CHW-4808400—upload could not be parsed; verify the request body matches the ecosystem’s publish protocol
CHW-4809400—could not determine package name and version from upload; include the package metadata expected by the ecosystem
CHW-4810403—the uploaded package is not registered in this repository; ask an admin to create a package slug before publishing
CHW-4811403—the client does not have write permission for this package on this repository; ask an admin to grant package-permissions.write
CHW-4812409—this package version already exists; delete it first to republish, or publish a new version
CHW-4813400—docker blob upload request is missing the upload UUID segment
CHW-4814404—docker blob upload session not found; the session may have expired — re-initiate the push
CHW-4815400—docker blob upload completion requires the ?digest= query parameter
CHW-4816400—docker manifest push path is malformed; expected {name}/manifests/{reference}
CHW-4817400—unsupported docker push operation; only blob upload and manifest push are implemented
CHW-4818400—repository name is required in the path; use /api/repos/{repository}/…
CHW-4819404—unsupported API route; see /api/openapi.yaml for the list of supported endpoints
CHW-4820400—packages API path is invalid; expected /api/repos/{repository}/packages/{package…}
CHW-4821404—repository not found; verify the repository name and the org context
CHW-4822404—package not found in this repository; verify the package name
CHW-4823400—FindPackagesById() requires the id query parameter
CHW-4824409—Idempotency-Key was reused with a different request body; pick a fresh key or resend the original body to receive the cached response
CHW-4825400—X-Chainsaw-Action-Source header value is not in the allowlist; valid sources are direct, inventory_view, coverage_silent, bypass_clients,…
CHW-4826400—bulk action exceeded the maximum allowed items per request; split into smaller batches
CHW-4827400—bulk action failed up-front validation; nothing was committed — see the response body for per-item details
CHW-4828409—K8s Fail-mode hardening bundle is blocked: cluster has not soaked safely in Ignore mode yet — see the gate object in the response for w…
CHW-4829400—admission shadow decision payload is malformed; required fields are org_id, cluster, and decision (one of would_allow, would_block, inter…
CHW-4830409—this org requires a preview before saving risk weights — POST /api/v1/intel/weights/simulate first and submit the returned simulate_id …
CHW-4831409—this org requires a preview before deletion — POST /api/orgs/{id}/delete/preview first and submit the returned simulate_id on the DELETE
CHW-4832409—the org inventory drifted since the simulate was produced; re-run the preview before deleting
CHW-4833409—the multi-key approval nonce is not valid — see the approval.reason field for the specific sub-reason (missing, expired, unsigned, self…
CHW-4834409—the preview backing this save was degraded and projected nothing — re-run POST /api/v1/intel/weights/simulate, or resubmit with “acknow…
CHW-4835409—the delete preview backing this request was degraded and could not compute the blast radius — re-run the preview once the database is h…
CHW-4840415—Content-Type must be application/json; the cocoapods trunk only accepts JSON bodies
CHW-4841422—podspec failed validation; verify the name, version, and source fields
CHW-4842404—trunk repository not bound to a tenant; verify the request lands inside a hosted-trunk repo prefix
CHW-4900410UPSTREAM_DEPRECATEDrubygems /api/v1/dependencies was deprecated upstream in 2023; use the Compact Index (versions, names, info/{name}), /api/v1/versions/{na…
CHW-4901404—action not found for this org; call list_recent_actions or /api/actions to find an id
CHW-4902409—action already undone; retrying will not change the state
CHW-4903400—undo is not supported for this action type; use the Web UI or delete+recreate the resource
CHW-4904400—this action cannot be undone — the operation destroyed state (e.g. cleartext secret) that no surface can restore; mint a fresh credenti…
CHW-4910409—quorum not met; collect additional approvals before emitting the hardening bundle
CHW-4911404—harden proposal not found for this org (it may have expired or belong to another org); list current proposals in the admin hardening dash…
CHW-4912409—harden bundle already emitted from this proposal; propose a new one to ship again
CHW-4913409—proposer cannot self-approve when quorum >= 2; ask a different org admin to approve
CHW-4914409—this user has already approved the proposal; quorum requires N distinct approvers
CHW-4915400—action id is required in the URL path
CHW-4920400—invalid key_type filter; expected ‘personal’ or ‘agent’
CHW-4921400—name is required
CHW-4922400—key_type / agent_kind combination is invalid; personal keys must omit agent_kind and agent keys must supply it
CHW-4923400—either preset or scopes is required; supply one of the canonical preset names or a concrete scopes object
CHW-4924400—missing api key id
CHW-4925404—api key not found
CHW-4926400—name cannot be empty
CHW-4927409—api key is not active; rotate is only permitted on active keys
CHW-4928409—simulate snapshot stale; re-run –dry-run
CHW-4929409—simulate_id was minted for a different action; mint a fresh one with chainsaw org delete --dry-run
CHW-4940400—invalid nonce; expected a hex string of 16-128 characters
CHW-4941400—port out of range; supply a loopback-accessible port between 1024 and 65535
CHW-4942400—missing or invalid device_code
CHW-4943404—device code not found or expired; restart the chainsaw auth login flow
CHW-4944410—device code has already been consumed; restart the chainsaw auth login flow
CHW-4945400—user_code is required
CHW-4946404—code not found or expired
CHW-4947409—device grant state changed between lookup and approval; restart the chainsaw auth login flow
CHW-4948400—missing or invalid exchange code
CHW-4949410—exchange code not found, expired, or already used; restart the chainsaw auth login flow

Internal / storage

CodeHTTPReasonMessage
CHW-5001500—internal error; the request was not completed — retry, and if the error persists include the request ID when reporting
CHW-5002500—storage backend failed while processing this request; retry shortly or check the backend health endpoint
CHW-5101503—a required dependency is not available; retry shortly or contact the operator
CHW-5102500—server-side encryption is not configured; ask an operator to set the required key
CHW-5103502—identity provider could not be contacted; retry shortly
CHW-5104500—unable to issue session token; please retry
CHW-5105500—user store is unavailable; please retry
CHW-5201503—org store is not available; the server started without a database — check the operator dashboard
CHW-5301503—policy store is not available; the server started without a database — check the operator dashboard
CHW-5302500—package store request failed; retry shortly or check the backend health endpoint
CHW-5303503—repository is disabled; ask an operator to re-enable it or route the request to an active repository
CHW-5304500—repository hook failed; retry shortly or check the hook configuration and logs
CHW-5305500—cached content could not be opened for streaming; retry shortly or purge the cache entry
CHW-5306500—exception policy store request failed; retry shortly or check the operator dashboard
CHW-5307500—findings store request failed; retry shortly or check the operator dashboard
CHW-5308500—tuning suggestion store request failed; retry shortly or check the operator dashboard
CHW-5401500—unable to load the current plan for this organization; retry shortly
CHW-5402500—unable to load the paddle subscription for this organization; retry shortly
CHW-5403500—unable to update the plan assignment; retry shortly and contact support if the failure persists
CHW-5404500—unable to check plan feature flags; retry shortly
CHW-5405500—paddle webhook event could not be persisted; paddle will retry the delivery
CHW-5406500—unable to load service token record; retry shortly
CHW-5407503—policy store is not available on this instance; the server started without a policy backend
CHW-5408503—primary store is not available; the server started without a database
CHW-5501500—usage / billing store write failed; retry shortly and contact support if the failure persists
CHW-5502500—saved traffic views store call failed; retry shortly
CHW-5503500—unable to load violation history; retry shortly
CHW-5504503—violation data is temporarily unavailable; retry shortly
CHW-5505503—package metadata store is not available on this instance; the server started without a metadata backend
CHW-5506500—unable to load vulnerability metadata; retry shortly
CHW-5507500—unable to generate SBOM export; retry shortly
CHW-5508503—event log is not available on this instance; the server started without an event store
CHW-5509503—settings store is not available on this instance; the server started without a database
CHW-5510503—repository manager is not available on this instance; the server started without proxy bindings
CHW-5511500—unable to list organisations; retry shortly and contact support if the failure persists
CHW-5512503—violation data is temporarily unavailable; retry shortly
CHW-5601500—failed to persist settings; retry shortly and check operator logs if the failure repeats
CHW-5603500—policy store failed while processing the request; retry shortly
CHW-5604503—data source manager is not wired up; manual refresh cannot be triggered
CHW-5605502—data source refresh failed against the upstream; check connectivity and the source health endpoint
CHW-5606503—onboarding endpoints require the configuration store; the server started without one
CHW-5607500—repository storage backend is not wired up; cache operations cannot proceed
CHW-5608500—failed to enumerate cached artifacts on the storage backend; retry shortly
CHW-5701500—failed to list webhooks; retry shortly or check /healthz
CHW-5702500—failed to enumerate existing webhooks; retry shortly or check /healthz
CHW-5703500—failed to create webhook; retry shortly or check /healthz
CHW-5704500—failed to update webhook; retry shortly or check /healthz
CHW-5705500—failed to delete webhook; retry shortly or check /healthz
CHW-5706500—failed to list SIEM integrations; retry shortly or check /healthz
CHW-5707500—failed to load SIEM integration; retry shortly or check /healthz
CHW-5708500—failed to persist SIEM integration; retry shortly or verify that the SIEM encryption key is configured
CHW-5709500—failed to delete SIEM integration; retry shortly or check /healthz
CHW-5710500—failed to manage SCIM token; retry shortly or check /healthz
CHW-5711500—SAML service-provider configuration could not be built; verify the SP keypair and ACS/metadata URLs in the SSO admin UI, then retry
CHW-5712503—user store is not available; retry shortly or ask the operator to check the database connection
CHW-5713500—failed to load profile; retry shortly or check /healthz
CHW-5714500—failed to save profile changes; retry shortly or check /healthz
CHW-5715503—postmark webhook receiver is not configured; set POSTMARK_WEBHOOK_USER and POSTMARK_WEBHOOK_PASSWORD on the server before re-enabling the…
CHW-5801503—client credential store is unavailable; the server started without a database — check the operator dashboard
CHW-5802500—client credential storage write failed; retry shortly or check the backend health endpoint
CHW-5803500—repository storage backend is unavailable; quarantine cannot remove artifacts until it recovers
CHW-5804500—failed to discover cached artifacts for this package version; retry shortly or check the backend health endpoint
CHW-5805500—failed to remove cached artifacts; retry shortly or inspect the storage backend error log
CHW-5806500—failed to store uploaded artifact; retry shortly or check the backend health endpoint
CHW-5807500—failed to read docker blob upload chunk; retry the push from scratch
CHW-5808500—failed to persist docker blob; retry the push
CHW-5809500—failed to read docker manifest from the request; retry the push
CHW-5810500—failed to persist docker manifest; retry the push
CHW-5811502—upstream NuGet server could not be contacted or returned an unreadable response; retry shortly
CHW-5812501—automatic config generation for this format is not yet implemented; use the manual recipe in tutorial 02 in the meantime
CHW-5813500—bulk action executed partially before failing; previously-applied items have been rolled back so the request had no net effect
CHW-5920503—api keys store unavailable
CHW-5921500—list failed
CHW-5922500—generate failed
CHW-5923500—create failed
CHW-5924500—get failed
CHW-5925500—patch failed
CHW-5926500—revoke failed
CHW-5927500—rotate failed
CHW-5940500—mint failed
CHW-5941503—device flow unavailable
CHW-5942500—issue failed

Other

CodeHTTPReasonMessage
CHW-8301404—no hosted huggingface repository registered for this org; ask an operator to register one before pushing
CHW-8302400—name is required
CHW-8303400—could not parse repo_id from path; expected /api/{repo_type}s/{org}/{name}
CHW-8304400—could not parse commit path; expected /api/{repo_type}s/{org}/{name}/commit/{revision}
CHW-8305400—could not parse NDJSON commit body; verify the header line and per-file entries
CHW-8306400—commit file content could not be decoded; only base64 encoding is supported
CHW-8307400—unknown commit entry kind; expected “file” or “lfsFile”
CHW-8308400—lfsFile entry missing required oid field
CHW-8309404—LFS object not found; upload the blob via PUT /lfs/objects/{oid} before referencing it from a commit
CHW-8310400—could not parse lfs upload path; expected /{repo_id}.git/lfs/objects/{oid}
CHW-8311413—lfs object exceeds 2GiB cap
CHW-8312400—lfs object oid mismatch; the body hash disagrees with the oid in the URL
CHW-8313422—lfs object size mismatch between client claim and stored blob
CHW-8320415UNSUPPORTED_ENCODINGmonitored-target upload is not UTF-8 text; it decoded as UTF-16, which is what Excel’s “Unicode Text” save produces — re-save the file …
CHW-8321400—monitored-target CSV has no recognisable header row; the first row must name a package column, an ecosystem column and a version column (…
CHW-8322422—monitored-target upload parsed zero package rows; the header was read but no data rows followed it, and a target with no packages would r…
CHW-8323413PAYLOAD_TOO_LARGEmonitored-target upload is larger than the accepted size cap; nothing was parsed — split the branch inventory across targets, or upload…
CHW-8324413TOO_MANY_ROWSmonitored-target upload declares more package rows than one target accepts; the file parsed but was not stored — split the branch inven…
CHW-8326422—package row rejected because its ecosystem is not one Chainsaw indexes; the value did not match any supported ecosystem — correct the c…
CHW-8327422—package row rejected because its purl could not be parsed; a purl must look like pkg:npm/lodash@4.17.21 — correct the value, or supply …
CHW-8328404—monitored target not found in this organisation; it was deleted, or the id belongs to a different organisation — list GET /api/v1/targe…
CHW-8329409—a monitored target already exists for this repository label and branch; targets are unique per organisation, repository label and branch …
CHW-8330409—monitored target is archived, so it accepts no uploads and is skipped by the monitoring worker; un-archive it before uploading, or create…
CHW-8331400—the uploaded file is empty, so no packages were read and no target was created. Upload a CSV whose first line is the header `name,ecosyst…
CHW-8332400—the file could not be read as CSV. Every line must be comma-separated, and a value containing a comma or a double quote must be wrapped i…
CHW-8333422—a required column is empty for this row. Every row needs the package name exactly as the registry publishes it, the registry the package …
CHW-8334422—this row has fewer comma-separated values than the header names columns, so Chainsaw cannot tell which value is which. Add the missing co…
CHW-8335400—the file is not valid JSON, so it cannot be a CycloneDX SBOM. Chainsaw reads the CycloneDX JSON form only — if your tool exported XML, …
CHW-8336400—the file is JSON but not a CycloneDX SBOM: it does not carry “bomFormat”: “CycloneDX”. SPDX is not supported in either direction. Re-expo…

Response shape

{
  "error": {
    "code": "CHW-2001",
    "message": "package blocked by policy",
    "reason": "POLICY_VIOLATION",
    "docs": "https://docs.chain305.com/errors/CHW-2001",
    "fields": {
      "package": "lodash",
      "version": "4.17.20",
      "policy_id": "pol-age-gate-7d"
    }
  }
}

fields is optional — it appears only when a handler attaches structured context via errcodes.WithField. Clients should tolerate its absence.