Errors

Every IAM error carries a stable numeric error_code and a machine-readable reason. This page lists the logical error codes IAM can return, across its domain groups (6_3xx) and infrastructure groups (6_6xx). For the full error envelope (the google.rpc.Status shape, the reason and metadata fields, and how codes are structured) see Errors.

IAM codes begin with 6 (for example 6308004, read as 6_308_004: service, group, specific error). The wire value is always the flat integer; you can match on either error_code or reason, both are stable.

The first two codes (6000001 and 6000002) are reserved framework authentication results raised by the platform gateway before a request reaches a service. The rest are domain codes raised by IAM itself.

The Status column is the canonical gRPC status the error maps to, which the gateway renders as the matching HTTP status (see the status codes table).

Code	Reason	Status	Description
6000001	UNAUTHENTICATED	UNAUTHENTICATED	User is not authenticated.
6000002	ACCESS_DENIED	PERMISSION_DENIED	User is not authorized.
6300001	INVALID_CREDENTIALS	UNAUTHENTICATED	Invalid email or password.
6300002	SELF_SERVICE_SUBJECT_UNRESOLVED	UNAUTHENTICATED	The request acts on the caller, but no caller could be resolved.
6300003	CREDENTIAL_NOT_RECOGNISED	UNAUTHENTICATED	Credential is not recognised.
6302001	ROLE_NAME_IS_BLANK	INVALID_ARGUMENT	Role name must not be blank.
6302002	ROLE_NOT_FOUND	NOT_FOUND	Role not found.
6302003	SYSTEM_ROLE_IMMUTABLE	INVALID_ARGUMENT	System roles cannot be modified or deleted.
6302004	ROLE_NAME_ALREADY_EXISTS	ALREADY_EXISTS	A role with this name already exists.
6302005	ROLE_IS_DISABLED	INVALID_ARGUMENT	Disabled roles cannot be assigned to bindings.
6302006	CUSTOM_ROLE_SCOPE_ID_IS_NOT_VALID	INVALID_ARGUMENT	Custom role scope ID is required and must be a valid ID.
6302007	ROLE_NAME_TOO_LONG	INVALID_ARGUMENT	Role name must not exceed 128 characters.
6302008	ROLE_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Role must be marked for deletion before removal.
6302009	ROLE_DISPLAY_NAME_IS_BLANK	INVALID_ARGUMENT	Role display name is required.
6302010	ROLE_DISPLAY_NAME_TOO_LONG	INVALID_ARGUMENT	Role display name must not exceed 128 characters.
6302011	ROLE_DISPLAY_NAME_NOT_VALID	INVALID_ARGUMENT	Role display name must not contain control characters.
6302012	ROLE_NAME_NOT_VALID	INVALID_ARGUMENT	Role name must be valid: lowercase letters, digits and hyphens, starting with a letter and ending with a letter or digit.
6302013	ROLE_PERMISSION_ALREADY_GRANTED	ALREADY_EXISTS	The role already grants this permission.
6302014	ROLE_DESCRIPTION_NOT_VALID	INVALID_ARGUMENT	Role description must be at most 1024 characters and carry no control or bidirectional characters.
6303001	POLICY_NAME_IS_BLANK	INVALID_ARGUMENT	Policy name must not be blank.
6303002	POLICY_CONDITIONS_EMPTY	INVALID_ARGUMENT	Policy must have at least one condition.
6303003	POLICY_NOT_FOUND	NOT_FOUND	Policy not found.
6303004	POLICY_WORKSPACE_ID_IS_NOT_VALID	INVALID_ARGUMENT	Policy workspace ID must be a valid UUID.
6303005	POLICY_HAS_ACTIVE_BINDINGS	INVALID_ARGUMENT	Cannot delete a policy that has active IAM bindings referencing it.
6303006	SOURCE_IP_CONDITION_CIDRS_EMPTY	INVALID_ARGUMENT	Source IP condition must have at least one CIDR range.
6303007	ROLE_CONDITION_SERVICES_EMPTY	INVALID_ARGUMENT	Role condition must have at least one service.
6303008	POLICY_NAME_TOO_LONG	INVALID_ARGUMENT	Policy name must not exceed 128 characters.
6303009	POLICY_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Policy must be marked for deletion before removal.
6303010	LOCATION_CONDITION_IDS_EMPTY	INVALID_ARGUMENT	Location condition must have at least one allowed location id.
6303011	POLICY_DESCRIPTION_NOT_VALID	INVALID_ARGUMENT	Policy description must be at most 1024 characters and carry no control or bidirectional characters.
6304001	IAM_BINDING_NOT_FOUND	NOT_FOUND	IAM binding not found.
6304002	IAM_BINDING_ADMIN_NON_REMOVABLE	INVALID_ARGUMENT	Admin binding for the organisation owner cannot be removed.
6304003	IAM_BINDING_ALREADY_EXISTS	ALREADY_EXISTS	An IAM binding for this principal, role, and scope already exists.
6304004	IAM_BINDING_PRINCIPAL_ID_NOT_VALID	INVALID_ARGUMENT	IAM binding principal ID must be a valid UUID.
6304005	IAM_BINDING_ROLE_ID_IS_NOT_VALID	INVALID_ARGUMENT	IAM binding role ID must be a valid UUID.
6304006	IAM_BINDING_SCOPE_ID_IS_NOT_VALID	INVALID_ARGUMENT	IAM binding scope ID must be a valid UUID.
6304007	IAM_BINDING_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	IAM binding must be marked for deletion before removal.
6305001	IAM_OPERATION_PROGRESS_OUT_OF_RANGE	INVALID_ARGUMENT	Operation progress must be between 0 and 100.
6305002	IAM_OPERATION_END_TIME_BEFORE_START_TIME	INVALID_ARGUMENT	Operation end time must not be before start time.
6305003	IAM_OPERATION_NOT_FOUND	NOT_FOUND	IAM operation not found.
6305004	OPERATION_SCOPE_TYPE_NOT_VALID	INVALID_ARGUMENT	Operation scope type is not valid.
6306001	AUTHENTICATION_TOKEN_IS_BLANK	INVALID_ARGUMENT	Authentication token must not be blank.
6306002	AUTHENTICATION_TOKEN_EXPIRY_IS_NOT_VALID	INVALID_ARGUMENT	Authentication token expiry must be after creation time.
6306003	AUTHENTICATION_TOKEN_IS_EXPIRED	UNAUTHENTICATED	Authentication token has expired.
6306004	AUTHENTICATION_TOKEN_NOT_FOUND	NOT_FOUND	Authentication token was not found.
6306006	AUTHENTICATION_TOKEN_TOKEN_HASH_NOT_VALID	INVALID_ARGUMENT	Authentication token hash is not valid.
6306007	AUTHENTICATION_TOKEN_FAMILY_ID_NOT_VALID	INVALID_ARGUMENT	Authentication token family identifier is not valid.
6306008	REFRESH_TOKEN_NOT_FOUND	NOT_FOUND	Refresh token was not found.
6306009	REFRESH_TOKEN_IS_EXPIRED	UNAUTHENTICATED	Refresh token has expired.
6306010	REFRESH_TOKEN_TYPE_NOT_VALID	UNAUTHENTICATED	Token is not a valid refresh token.
6307001	PERMISSION_OPERATION_NOT_IMPLEMENTED	UNIMPLEMENTED	Permission operation is not yet implemented.
6307002	PERMISSION_NOT_FOUND	INVALID_ARGUMENT	Permission not found.
6307003	PERMISSION_NAME_NOT_VALID	INVALID_ARGUMENT	Permission name is not valid.
6308001	PERSON_EMAIL_IS_BLANK	INVALID_ARGUMENT	Person email is required.
6308002	PERSON_EMAIL_INVALID_FORMAT	INVALID_ARGUMENT	Person email format is not valid.
6308004	PERSON_NOT_FOUND	NOT_FOUND	Person not found.
6308005	PERSON_EMAIL_ALREADY_EXISTS	ALREADY_EXISTS	A person with this email already exists.
6308006	PERSON_IS_INACTIVE	INVALID_ARGUMENT	Person account is inactive.
6308008	AVATAR_NOT_FOUND	NOT_FOUND	This account has no avatar.
6309001	SERVICE_ACCOUNT_EMAIL_NOT_VALID	INVALID_ARGUMENT	Service account email is not valid.
6309002	SERVICE_ACCOUNT_BOUNDED_CONTEXT_IS_BLANK	INVALID_ARGUMENT	Service account context is required.
6309003	SERVICE_ACCOUNT_NOT_FOUND	NOT_FOUND	Service account not found.
6309004	SERVICE_ACCOUNT_IS_INACTIVE	INVALID_ARGUMENT	Service account is inactive.
6310001	PERSON_DEACTIVATED	FAILED_PRECONDITION	Person account is deactivated.
6310002	PERSON_NOT_INVITED	FAILED_PRECONDITION	Person is not in the invited state.
6310003	PERSON_NOT_DEACTIVATED	FAILED_PRECONDITION	Person is not in the deactivated state.
6310004	PERSON_ALREADY_DEACTIVATED	FAILED_PRECONDITION	Person is already deactivated.
6310005	PERSON_ACTIVE_REQUIRES_PASSWORD	INVALID_ARGUMENT	An active person requires a password.
6310006	PERSON_NAME_IS_REQUIRED	INVALID_ARGUMENT	Person name and surname are required.
6310007	AVATAR_REFERENCE_NOT_VALID	INVALID_ARGUMENT	Avatar reference is not valid.
6310008	PRINCIPAL_NOT_FOUND	NOT_FOUND	Principal not found.
6310009	INHERITED_ROLE_NOT_REVOCABLE	FAILED_PRECONDITION	An inherited role cannot be revoked at this scope.
6310010	PRINCIPAL_TYPE_NOT_VALID	INVALID_ARGUMENT	Principal type is not valid.
6310011	AVATAR_IMAGE_NOT_ACCEPTABLE	INVALID_ARGUMENT	Avatar image type is not in the allowed set or its content does not match the declared type.
6310012	AVATAR_IMAGE_TOO_LARGE	INVALID_ARGUMENT	Avatar image exceeds the maximum allowed size.
6310013	PERSON_NOT_ACTIVE	FAILED_PRECONDITION	Person is not in the active state.
6310014	AVATAR_IMAGE_DIMENSIONS_NOT_ACCEPTABLE	INVALID_ARGUMENT	Avatar image dimensions exceed the maximum allowed, or its header does not declare readable dimensions.
6311001	UNSUPPORTED_ACCESS_SCOPE	INVALID_ARGUMENT	The scope type and scope id are not a valid combination.
6311002	UNKNOWN_TEST_PERMISSION	INVALID_ARGUMENT	A candidate permission does not exist in the catalogue.
6311003	CALLER_NOT_AUTHENTICATED	INVALID_ARGUMENT	The calling principal could not be resolved.
6311004	BINDING_DRAIN_INCOMPLETE	RESOURCE_EXHAUSTED	The bindings could not be read within the drain ceiling.
6312001	ACCESSIBLE_SCOPE_ID_IS_NOT_VALID	DATA_LOSS	Persisted binding scope id is not a valid identifier.
6312002	CONDITION_CONTEXT_SOURCE_IP_IS_NOT_VALID	INVALID_ARGUMENT	The asserted condition context source ip is not a valid address.
6313001	CREDENTIAL_TOKEN_NOT_VALID	INVALID_ARGUMENT	Credential token is not valid.
6313002	CREDENTIAL_TOKEN_EXPIRED	INVALID_ARGUMENT	Credential token has expired.
6313003	CREDENTIAL_TOKEN_ALREADY_USED	INVALID_ARGUMENT	Credential token has already been used.
6313004	CREDENTIAL_TOKEN_NOT_FOUND	NOT_FOUND	Credential token not found.
6313005	CREDENTIAL_TOKEN_ISSUE_CONFLICT	ABORTED	Another credential token was issued concurrently.
6313006	CREDENTIAL_TOKEN_TYPE_MISMATCH	INVALID_ARGUMENT	Credential token is not valid for this operation.
6314001	PASSWORD_TOO_SHORT	INVALID_ARGUMENT	Password does not meet the minimum length.
6314002	PASSWORD_TOO_LONG	INVALID_ARGUMENT	Password exceeds the maximum length.
6314003	PASSWORD_EFFECTIVELY_EMPTY	INVALID_ARGUMENT	Password must not be empty.
6314004	PASSWORD_IS_COMMON	INVALID_ARGUMENT	Password is too common.
6314006	PASSWORD_RECENTLY_USED	INVALID_ARGUMENT	Password matches a recently used password.
6314007	BOOTSTRAP_ADMIN_PASSWORD_NOT_COMPLIANT	FAILED_PRECONDITION	The platform-admin password supplied to bootstrap does not meet the password policy.
6314008	PASSWORD_MISSING_UPPERCASE	INVALID_ARGUMENT	Password must contain an uppercase letter.
6314009	PASSWORD_MISSING_LOWERCASE	INVALID_ARGUMENT	Password must contain a lowercase letter.
6314010	PASSWORD_MISSING_DIGIT	INVALID_ARGUMENT	Password must contain a digit.
6314011	PASSWORD_MISSING_LETTER	INVALID_ARGUMENT	Password must contain a letter.
6314012	PASSWORD_MISSING_SPECIAL_CHARACTER	INVALID_ARGUMENT	Password must contain a special character.
6314013	PASSWORD_RESEMBLES_IDENTITY	INVALID_ARGUMENT	Password must not be based on your name, email or the service name.
6314014	PASSWORD_HISTORY_DEPTH_NOT_CONFIGURED	FAILED_PRECONDITION	iam.password-policy.history-depth must be at least 1, or password reuse is not enforced.
6315001	CREDENTIAL_ENCODING_NOT_RECOGNISED	DATA_LOSS	The stored credential was produced by an algorithm this platform does not recognise.
6316001	ANONYMOUS_REQUEST_BUDGET_EXCEEDED	RESOURCE_EXHAUSTED	Too many anonymous requests.
6317001	SCOPE_IS_NOT_VALID	INVALID_ARGUMENT	A requested scope string is not valid.
6600001	AUTHENTICATION_CACHE_UNAVAILABLE	UNAVAILABLE	The authentication cache is unavailable; refused to leave stale credentials in cache.
6600002	JWT_GENERATE_TOKEN_GRANT_NOT_SUPPORTED	UNIMPLEMENTED	JwtTokenService cannot issue service-account JWTs directly. Call IssueServiceAccountJwtHandler.handle(…) instead.
6601001	UNKNOWN_SCHEMA_VERSION	DATA_LOSS	Schema version is not recognized.
6601002	USER_NOT_FOUND	NOT_FOUND	The user was not found.
6601003	ROLE_NOT_FOUND	NOT_FOUND	The role was not found.
6601004	IAM_BINDING_NOT_FOUND	NOT_FOUND	The IAM binding was not found.
6601005	POLICY_NOT_FOUND	NOT_FOUND	The policy was not found.
6601006	IAM_OPERATION_NOT_FOUND	NOT_FOUND	The IAM operation was not found.
6601007	TOKEN_TYPE_NOT_VALID	DATA_LOSS	The token type is not recognized.
6601008	ROLE_TYPE_NOT_VALID	DATA_LOSS	The role type is not recognized.
6602001	UNSUPPORTED_SCOPE_TYPE	INVALID_ARGUMENT	The scope type is not supported.
6602002	UNSUPPORTED_PRINCIPAL_TYPE	INVALID_ARGUMENT	The principal type is not supported.
6602003	UNKNOWN_TAXONOMY_EVENT	INVALID_ARGUMENT	The taxonomy event type is not recognized.
6602004	UNKNOWN_INTEGRATION_VERSION	INVALID_ARGUMENT	The integration version is not recognized.
6602005	UNKNOWN_MESSAGE_TYPE	INVALID_ARGUMENT	The message type is not recognized.
6602006	CONDITION_TYPE_NOT_SPECIFIED	INVALID_ARGUMENT	Condition type must be specified.
6602007	UNSUPPORTED_SOURCE_IP_OPERATOR	INVALID_ARGUMENT	The source IP operator is not supported.
6602008	UNSUPPORTED_TIME_WINDOW_OPERATOR	INVALID_ARGUMENT	The time window operator is not supported.
6602009	UNSUPPORTED_ROLE_CONDITION_OPERATOR	INVALID_ARGUMENT	The role condition operator is not supported.
6602010	INVALID_TIMEZONE	INVALID_ARGUMENT	The timezone is not valid.
6602011	INVALID_TIME_OF_DAY	INVALID_ARGUMENT	The time of day is not valid.
6602012	CIDR_PREFIX_NOT_VALID	INVALID_ARGUMENT	The CIDR prefix is not valid.
6602013	UNSUPPORTED_LOCATION_CONDITION_OPERATOR	INVALID_ARGUMENT	The location condition operator is not supported.
6603001	RSA_PRIVATE_KEY_NOT_VALID	FAILED_PRECONDITION	The RSA private key PEM content is not valid or empty. Set the IAM_JWT_PRIVATE_KEY environment variable to a PKCS#8 RSA PEM (matching iam.jwt.private-key). For local development run scripts/generate-dev-keys.sh and then source .dev-keys before starting the application.
6603002	RSA_PUBLIC_KEY_NOT_VALID	FAILED_PRECONDITION	The RSA public key PEM content is not valid or empty. Set the IAM_JWT_PUBLIC_KEY environment variable to an X.509 RSA PEM (matching iam.jwt.public-key). For local development run scripts/generate-dev-keys.sh and then source .dev-keys before starting the application.
6604001	COMMON_PASSWORD_BLOCKLIST_NOT_AVAILABLE	FAILED_PRECONDITION	The bundled common-password corpus is missing or truncated, so the common-password check cannot be enforced. Rebuild the iam module so common-passwords.txt.gz is packaged.

Codes that reach you on an operation, not on a call

These never appear as the status of a request. They record why a long-running operation did not finish, so they arrive in the operation record’s errors list while the call that started it succeeded.

Code	Reason	Description
6306005	AUTHENTICATION_TOKEN_USER_ID_NOT_VALID	Authentication token user identifier is not valid.

Codes that are reported, not returned

None of these is ever a request’s error_code. They say why something further down refused, and they surface in one of two places: the errors list of an operation record, or the detail of the error actually returned, written as code:reason. Read them as the cause behind the status you were given.

Code	Reason	Description
6306005	AUTHENTICATION_TOKEN_USER_ID_NOT_VALID	Authentication token user identifier is not valid.