Errors

Every IAM error carries a stable numeric error_code and a machine-readable reason. This page lists the logical (domain) error codes IAM can return. For the full error envelope (the google.rpc.Status shape, the reason and metadata fields, and how codes are structured) see Errors.

IAM codes begin with 6 (for example 6308004, read as 6_308_004: service, group, specific error). The wire value is always the flat integer; you can match on either error_code or reason, both are stable.

The first two codes (6000001 and 6000002) are reserved framework authentication results raised by the platform gateway before a request reaches a service. The rest are domain codes raised by IAM itself.

The Status column is the canonical gRPC status the error maps to, which the gateway renders as the matching HTTP status (see the status codes table).

Code	Reason	Status	Description
6000001	UNAUTHENTICATED	UNAUTHENTICATED	User is not authenticated.
6000002	ACCESS_DENIED	PERMISSION_DENIED	User is not authorized.
6300001	INVALID_CREDENTIALS	UNAUTHENTICATED	Invalid email or password.
6302001	ROLE_NAME_IS_BLANK	INVALID_ARGUMENT	Role name must not be blank.
6302002	ROLE_NOT_FOUND	NOT_FOUND	Role not found.
6302003	SYSTEM_ROLE_IMMUTABLE	INVALID_ARGUMENT	System roles cannot be modified or deleted.
6302004	ROLE_NAME_ALREADY_EXISTS	ALREADY_EXISTS	A role with this name already exists.
6302005	ROLE_IS_DISABLED	INVALID_ARGUMENT	Disabled roles cannot be assigned to bindings.
6302006	CUSTOM_ROLE_SCOPE_ID_IS_NOT_VALID	INVALID_ARGUMENT	Custom role scope ID is required and must be a valid ID.
6302007	ROLE_NAME_TOO_LONG	INVALID_ARGUMENT	Role name must not exceed 128 characters.
6302008	ROLE_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Role must be marked for deletion before removal.
6303001	POLICY_NAME_IS_BLANK	INVALID_ARGUMENT	Policy name must not be blank.
6303002	POLICY_CONDITIONS_EMPTY	INVALID_ARGUMENT	Policy must have at least one condition.
6303003	POLICY_NOT_FOUND	NOT_FOUND	Policy not found.
6303004	POLICY_WORKSPACE_ID_IS_NOT_VALID	INVALID_ARGUMENT	Policy workspace ID must be a valid UUID.
6303005	POLICY_HAS_ACTIVE_BINDINGS	INVALID_ARGUMENT	Cannot delete a policy that has active IAM bindings referencing it.
6303006	SOURCE_IP_CONDITION_CIDRS_EMPTY	INVALID_ARGUMENT	Source IP condition must have at least one CIDR range.
6303007	ROLE_CONDITION_SERVICES_EMPTY	INVALID_ARGUMENT	Role condition must have at least one service.
6303008	POLICY_NAME_TOO_LONG	INVALID_ARGUMENT	Policy name must not exceed 128 characters.
6303009	POLICY_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Policy must be marked for deletion before removal.
6304001	IAM_BINDING_NOT_FOUND	NOT_FOUND	IAM binding not found.
6304002	IAM_BINDING_ADMIN_NON_REMOVABLE	INVALID_ARGUMENT	Admin binding for the organisation owner cannot be removed.
6304003	IAM_BINDING_ALREADY_EXISTS	ALREADY_EXISTS	An IAM binding for this principal, role, and scope already exists.
6304004	IAM_BINDING_PRINCIPAL_ID_NOT_VALID	INVALID_ARGUMENT	IAM binding principal ID must be a valid UUID.
6304005	IAM_BINDING_ROLE_ID_IS_NOT_VALID	INVALID_ARGUMENT	IAM binding role ID must be a valid UUID.
6304006	IAM_BINDING_SCOPE_ID_IS_NOT_VALID	INVALID_ARGUMENT	IAM binding scope ID must be a valid UUID.
6304007	IAM_BINDING_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	IAM binding must be marked for deletion before removal.
6305001	IAM_OPERATION_PROGRESS_OUT_OF_RANGE	INVALID_ARGUMENT	Operation progress must be between 0 and 100.
6305002	IAM_OPERATION_END_TIME_BEFORE_START_TIME	INVALID_ARGUMENT	Operation end time must not be before start time.
6305003	IAM_OPERATION_NOT_FOUND	NOT_FOUND	IAM operation not found.
6306001	AUTHENTICATION_TOKEN_IS_BLANK	INVALID_ARGUMENT	Authentication token must not be blank.
6306002	AUTHENTICATION_TOKEN_EXPIRY_IS_NOT_VALID	INVALID_ARGUMENT	Authentication token expiry must be after creation time.
6306003	AUTHENTICATION_TOKEN_IS_EXPIRED	INVALID_ARGUMENT	Authentication token has expired.
6306004	AUTHENTICATION_TOKEN_NOT_FOUND	NOT_FOUND	Authentication token was not found.
6306005	AUTHENTICATION_TOKEN_USER_ID_NOT_VALID	INVALID_ARGUMENT	Authentication token user identifier is not valid.
6306006	AUTHENTICATION_TOKEN_TOKEN_HASH_NOT_VALID	INVALID_ARGUMENT	Authentication token hash is not valid.
6306007	AUTHENTICATION_TOKEN_FAMILY_ID_NOT_VALID	INVALID_ARGUMENT	Authentication token family identifier is not valid.
6306008	REFRESH_TOKEN_NOT_FOUND	NOT_FOUND	Refresh token was not found.
6306009	REFRESH_TOKEN_IS_EXPIRED	INVALID_ARGUMENT	Refresh token has expired.
6306010	REFRESH_TOKEN_TYPE_NOT_VALID	INVALID_ARGUMENT	Token is not a valid refresh token.
6307001	PERMISSION_OPERATION_NOT_IMPLEMENTED	UNIMPLEMENTED	Permission operation is not yet implemented.
6307002	PERMISSION_NOT_FOUND	NOT_FOUND	Permission not found.
6307003	PERMISSION_NAME_NOT_VALID	INVALID_ARGUMENT	Permission name is not valid.
6308001	PERSON_EMAIL_IS_BLANK	INVALID_ARGUMENT	Person email is required.
6308002	PERSON_EMAIL_INVALID_FORMAT	INVALID_ARGUMENT	Person email format is not valid.
6308003	PERSON_PASSWORD_HASH_IS_BLANK	INVALID_ARGUMENT	Person password hash is required.
6308004	PERSON_NOT_FOUND	NOT_FOUND	Person not found.
6308005	PERSON_EMAIL_ALREADY_EXISTS	ALREADY_EXISTS	A person with this email already exists.
6308006	PERSON_IS_INACTIVE	INVALID_ARGUMENT	Person account is inactive.
6308007	PERSON_NOT_MARKED_FOR_DELETION	INVALID_ARGUMENT	Person must be marked for deletion before removal.
6309001	SERVICE_ACCOUNT_EMAIL_NOT_VALID	INVALID_ARGUMENT	Service account email is not valid.
6309002	SERVICE_ACCOUNT_BOUNDED_CONTEXT_IS_BLANK	INVALID_ARGUMENT	Service account context is required.
6309003	SERVICE_ACCOUNT_NOT_FOUND	NOT_FOUND	Service account not found.
6309004	SERVICE_ACCOUNT_IS_INACTIVE	INVALID_ARGUMENT	Service account is inactive.