Errors
When the Magistrate module throws, no decision was made. Treat every error as NO in your app, and your backend gets no receipt to accept.
A deny is not an error. It comes back as a DecisionResult.
Module errors
Swift throws PolicyError. Kotlin throws a subclass of PolicyException with the same name in upper camel case, for example PolicyException.NoProofProduced.
| Swift case | What happened | What to do |
|---|---|---|
notProvisioned |
No policy is connected to your license yet | Ask your Octet contact to connect your published policy. See Write a Policy |
licenseIdUnavailable |
The SDK hasn't activated its license yet | Wait for Octet.start to finish, then retry |
bundleFetchFailed(_) |
The policy couldn't be downloaded | Check the network and retry |
bundleRejected(.badSignature) |
The policy isn't signed by Octet | Don't retry. Write to developer@octetproof.com |
bundleRejected(.malformed) |
The policy couldn't be read | Don't retry. Write to developer@octetproof.com |
bundleRejected(.stale) |
The policy is older than one this device already used | Retry. A cache may be serving an old version |
bundleRejected(.unsupportedPlan) |
The policy needs a newer Magistrate module | Update the module |
unsupportedRegion(canonical:) |
The policy names a region this module can't prove yet | Update the module |
malformedTrustRoot(kid:) |
A key on your license that verifies policies is malformed | Write to developer@octetproof.com |
noProofProduced(details:) |
The SDK couldn't make any proof the policy needs | Retry after a few seconds. details says why for each region |
bindingUnavailable |
The policy has a disc, and this SDK version can't prove one yet |
Use a policy without discs until an SDK release supports them |
invalidPolicySet(count:) |
decideMany got no policies, or more than 16 |
Pass 1 to 16 policy names |
decideRejected(_, detail:) |
The engine refused the request. See below | Depends on the reason |
decideFailed(_) |
The request to the engine failed for another reason | Check the network and retry |
The String values in bundleFetchFailed, decideRejected and decideFailed are diagnostics for your logs. Don't branch on them.
decideRejected reasons
| Reason | HTTP | What happened |
|---|---|---|
badRequest |
400 | The engine couldn't read the request |
challengeUnknownOrExpired |
401 | The challenge expired before the proofs arrived. Retry |
challengeReused |
409 | The challenge was already used. With decideMany, also when a policy got a new version during the check. Retry |
policyScopeMismatch |
422 | The challenge was issued for another policy |
Publishing errors
The studio shows these when it publishes a policy. The engine refuses the policy and nothing changes for your apps.
| HTTP | Message | What to do |
|---|---|---|
| 400 | the OPL doesn't parse: parse error at <line>:<column>: … |
Fix the policy text at that position. A disc with an out-of-range latitude, longitude or radius is a parse error too |
| 400 | the OPL doesn't parse: check error: … |
A name is defined twice or used without being defined. Fix the name |
| 422 | policy can't be published: unknown country code "XX" |
The code isn't an ISO 3166 country. Check the code |
| 422 | policy can't be published: unknown subdivision code "US-ZZ" |
The code isn't an ISO 3166 subdivision. Check the code |
| 422 | policy can't be published: country code "VA" has no map data in this engine |
The code is valid, but the engine has no boundary for it yet. The same message exists for subdivision codes. Write to developer@octetproof.com |
| 422 | policy can't be published: city("…") isn't supported yet; use a disc around the city instead |
Use a disc around the city |
| 422 | policy can't be published: region `…` is not defined |
The policy uses a region name it doesn't define. Fix the name |