ENUM

HaapiErrorCode

Contents

• Cases
  • nonHaapiLink
  • haapiRedirectRefused
  • insecureTransport
  • foreignHaapiTarget
  • insecureHaapiConfiguration
  • attestationLimited

public enum HaapiErrorCode: String, Sendable

The specific codes reported through IdsvrError.error for refusals raised by the SDK itself — a request, or a session setup, the SDK refused — as opposed to OAuth or transport errors.

IdsvrError.error carries two kinds of value. Most failures report a coarse category shared by every framework — "networking", "haapi", "unexpected", and, from IdsvrHaapiDriver, "attestation" and "dpop" — which says what went wrong but not which check rejected the call. A refusal instead reports one of the specific codes below. Only these are enumerated here; the categories are not, since they are produced by all three frameworks rather than owned by this one.

Expect the list to grow as further refusals are added; a code, once published, keeps its raw value.

A refused HAAPI request arrives as the error of a failed HaapiResult. haapiRedirectRefused on an OAuth token, refresh or revocation request arrives in the .error case of TokenResponse or TokenRevocationResponse, and one hit while creating an accessor (attestation validation or client registration) is thrown. A setup refusal (insecureHaapiConfiguration) is thrown as a HaapiError when a HaapiManager or an accessor is created. attestationLimited is thrown when an accessor is created, and arrives as the error of a failed HaapiResult when a request needs a new App Attest key. Compare against the error of a failed HaapiResult:

if case .error(let error) = result,
   (error as? IdsvrError)?.error == HaapiErrorCode.nonHaapiLink.rawValue
{
    // The link target was not the configured identity server; no request was sent.
}

Cases

nonHaapiLink

case nonHaapiLink = "non_haapi_link"

A link follow was refused because its target is not the configured identity server.

haapiRedirectRefused

case haapiRedirectRefused = "haapi_redirect_refused"

An HTTP redirect was refused: the SDK never follows one, so nothing was sent to the redirect target. The error's cause is a HaapiRedirectRefusal carrying the redirect's status code.

insecureTransport

case insecureTransport = "insecure_transport"

A request was refused because mutual TLS is configured and the URL is not https, so client authentication and server pinning could not apply. Nothing was sent. The error's cause is a HaapiInsecureTransportRefusal carrying the refused URL's scheme and host. Building an accessor or a token manager with mutual TLS and a non-https token endpoint fails with the same code.

foreignHaapiTarget

case foreignHaapiTarget = "foreign_haapi_target"

A HAAPI request was refused because its target is neither the configured base address nor the configured authorization endpoint. Nothing was sent to it.

insecureHaapiConfiguration

case insecureHaapiConfiguration = "insecure_haapi_configuration"

Setting up a session was refused because a configured identity-server address does not use https and insecure addresses are not permitted — or they are, and it uses neither https nor http. The error's cause is a HaapiInsecureConfigurationRefusal naming which address, never its value.

attestationLimited

case attestationLimited = "attestation_limited"

A new App Attest key was refused because the app-wide App Attest key limit is reached; no key was generated. The error's cause is a HaapiAttestationLimitRefusal carrying when a new key is next allowed.