Errors

Every Vault error carries a stable numeric error_code and a machine-readable reason. This page lists the logical (domain) error codes Vault can return. For the full error envelope (the google.rpc.Status shape, the reason and metadata fields, and how codes are structured) see Errors.

Vault codes begin with 2 (for example 2301003, read as 2_301_003: service, group, specific error). The wire value is always the flat integer; you can match on either error_code or reason, both are stable.

The Status column is the canonical gRPC status the error maps to, which the gateway renders as the matching HTTP status (see the status codes table).

Code	Reason	Status	Description
2300001	VAULT_OPERATION_PROGRESS_OUT_OF_RANGE	INVALID_ARGUMENT	Vault operation progress must be between 0 and 100.
2300002	VAULT_OPERATION_END_TIME_BEFORE_START_TIME	INVALID_ARGUMENT	Vault operation end time must not be before start time.
2300003	VAULT_OPERATION_NOT_FOUND	NOT_FOUND	Vault operation not found.
2301001	SECRET_NAME_NOT_VALID	INVALID_ARGUMENT	Secret name must match ^[a-z0-9][a-z0-9/\-_]{1,254}[a-z0-9]$ (3 to 256 chars).
2301002	SECRET_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Secret workspace ID is required.
2301003	SECRET_NOT_FOUND	NOT_FOUND	Secret not found.
2301004	SECRET_ALREADY_EXISTS	ALREADY_EXISTS	A secret with this name already exists in the workspace.
2301005	SECRET_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Secret is not marked for deletion.
2301006	SECRET_VERSION_NOT_FOUND	NOT_FOUND	Secret version not found.
2301007	SECRET_VERSION_ALREADY_DESTROYED	FAILED_PRECONDITION	Secret version is already destroyed.
2301009	SECRET_WORKSPACE_NOT_FOUND	NOT_FOUND	The workspace this secret belongs to does not exist.
2302001	SECRET_VERSION_SECRET_ID_NOT_VALID	INVALID_ARGUMENT	Secret version’s parent secret ID is required.
2302002	SECRET_VERSION_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Secret version’s workspace ID is required.
2302003	SECRET_VERSION_NUMBER_NOT_VALID	INVALID_ARGUMENT	Secret version number must be a positive, monotonically increasing integer.
2302004	SECRET_VERSION_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Secret version is not marked for deletion.
2303001	ACCESS_POLICY_NAME_NOT_VALID	INVALID_ARGUMENT	Access policy name must match ^[a-z0-9][a-z0-9/\-_]{1,254}[a-z0-9]$ (3 to 256 chars).
2303002	ACCESS_POLICY_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Access policy workspace ID is required.
2303003	ACCESS_POLICY_NOT_FOUND	NOT_FOUND	Access policy not found.
2303004	ACCESS_POLICY_ALREADY_EXISTS	ALREADY_EXISTS	An access policy with this name already exists in the workspace.
2303005	ACCESS_POLICY_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Access policy is not marked for deletion.
2303006	ACCESS_POLICY_DOCUMENT_HAS_CONFLICTING_RULES	INVALID_ARGUMENT	Access policy document contains rules that share the same resource name pattern.
2303007	ACCESS_POLICY_WORKSPACE_NOT_FOUND	NOT_FOUND	The workspace this access policy belongs to does not exist.
2304001	CRYPTO_KEY_NAME_NOT_VALID	INVALID_ARGUMENT	Crypto key name must match ^[a-z0-9][a-z0-9/\-_]{1,254}[a-z0-9]$ (3 to 256 chars).
2304002	CRYPTO_KEY_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Crypto key workspace ID is required.
2304003	CRYPTO_KEY_ALGORITHM_DOES_NOT_MATCH_PURPOSE	INVALID_ARGUMENT	Crypto key algorithm is not compatible with its purpose.
2304004	CRYPTO_KEY_MIN_DECRYPTABLE_VERSION_NOT_VALID	INVALID_ARGUMENT	Crypto key minimum decryptable version must be >= 1.
2304005	CRYPTO_KEY_NOT_FOUND	NOT_FOUND	Crypto key not found.
2304006	CRYPTO_KEY_ALREADY_EXISTS	ALREADY_EXISTS	A crypto key with this name already exists in the workspace.
2304007	CRYPTO_KEY_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Crypto key is not marked for deletion.
2304009	CRYPTO_KEY_WORKSPACE_NOT_FOUND	NOT_FOUND	The workspace this crypto key belongs to does not exist.
2305001	CRYPTO_KEY_VERSION_CRYPTO_KEY_ID_NOT_VALID	INVALID_ARGUMENT	Crypto key version’s parent crypto key ID is required.
2305002	CRYPTO_KEY_VERSION_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Crypto key version’s workspace ID is required.
2305003	CRYPTO_KEY_VERSION_NUMBER_NOT_VALID	INVALID_ARGUMENT	Crypto key version number must be a positive, monotonically increasing integer.
2305004	CRYPTO_KEY_VERSION_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Crypto key version is not marked for deletion.
2305006	CRYPTO_KEY_VERSION_NOT_FOUND	NOT_FOUND	Crypto key version not found.
2305007	CRYPTO_KEY_VERSION_ALREADY_DESTROYED	FAILED_PRECONDITION	Crypto key version is already destroyed.
2306001	LEASE_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Lease workspace ID is required.
2306002	LEASE_PRINCIPAL_ID_NOT_VALID	INVALID_ARGUMENT	Lease principal ID is required.
2306003	LEASE_TTL_EXCEEDS_MAX	INVALID_ARGUMENT	Lease TTL must be positive and not exceed max TTL.
2306004	LEASE_EXPIRES_BEFORE_ISSUED	INVALID_ARGUMENT	Lease expires_at must be after issued_at.
2306005	LEASE_NOT_FOUND	NOT_FOUND	Lease not found.
2306006	LEASE_NOT_RENEWABLE	FAILED_PRECONDITION	Lease is not renewable.
2306007	LEASE_NOT_REVOCABLE	FAILED_PRECONDITION	Lease is not revocable.
2306008	LEASE_ALREADY_TERMINAL	FAILED_PRECONDITION	Lease is already in a terminal state.
2306009	LEASE_WORKSPACE_NOT_FOUND	NOT_FOUND	The workspace this lease belongs to does not exist.
2306010	LEASE_SOURCE_ROLE_NOT_VALID	INVALID_ARGUMENT	Lease source role is required and must be non-blank.
2307001	CERTIFICATE_AUTHORITY_NAME_NOT_VALID	INVALID_ARGUMENT	Certificate authority name must match ^[a-z0-9][a-z0-9\-_]{1,254}[a-z0-9]$ (3 to 256 chars).
2307002	CERTIFICATE_AUTHORITY_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Certificate authority workspace ID is required.
2307003	CERTIFICATE_AUTHORITY_INTERMEDIATE_MISSING_PARENT	INVALID_ARGUMENT	Intermediate certificate authority requires a parent CA reference.
2307004	CERTIFICATE_AUTHORITY_VALIDITY_WINDOW_NOT_VALID	INVALID_ARGUMENT	Certificate authority valid_until must be strictly after valid_from.
2307005	CERTIFICATE_AUTHORITY_NOT_FOUND	NOT_FOUND	Certificate authority not found.
2307006	CERTIFICATE_AUTHORITY_ALREADY_EXISTS	ALREADY_EXISTS	A certificate authority with this name already exists in the workspace.
2307008	CERTIFICATE_AUTHORITY_PARENT_NOT_FOUND	NOT_FOUND	Parent certificate authority referenced by this intermediate does not exist.
2307010	CERTIFICATE_AUTHORITY_WORKSPACE_NOT_FOUND	NOT_FOUND	The workspace this certificate authority belongs to does not exist.
2307011	CERTIFICATE_AUTHORITY_TYPE_NOT_VALID	INVALID_ARGUMENT	Certificate authority type must be ROOT or INTERMEDIATE.
2307012	CERTIFICATE_AUTHORITY_IS_REVOKED	FAILED_PRECONDITION	Certificate authority is revoked and cannot issue new certificates.
2307013	CERTIFICATE_AUTHORITY_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Certificate authority must be marked for deletion before removal.
2308001	CERTIFICATE_SERIAL_NOT_VALID	INVALID_ARGUMENT	Certificate serial is required and must be at most 128 characters.
2308002	CERTIFICATE_SUBJECT_NOT_VALID	INVALID_ARGUMENT	Certificate subject is required.
2308003	CERTIFICATE_VALIDITY_WINDOW_NOT_VALID	INVALID_ARGUMENT	Certificate not_after must be strictly after not_before.
2308004	CERTIFICATE_NOT_FOUND	NOT_FOUND	Certificate not found.
2308006	CERTIFICATE_ALREADY_REVOKED	FAILED_PRECONDITION	Certificate has already been revoked.
2308007	CERTIFICATE_ALREADY_TERMINAL	FAILED_PRECONDITION	Certificate is already in a terminal state and cannot be revoked.
2308008	CERTIFICATE_REVOCATION_REASON_NOT_VALID	INVALID_ARGUMENT	Certificate revocation reason must be a valid RFC 5280 reason.
2309001	CLOUD_PROVIDER_NOT_VALID	INVALID_ARGUMENT	Cloud provider must be AWS, GCP, or AZURE.
2310001	WRAPPING_PAYLOAD_NOT_VALID	INVALID_ARGUMENT	Wrapping payload must be non-empty.
2310002	WRAPPING_TTL_IS_NOT_VALID	INVALID_ARGUMENT	Wrapping TTL must be positive.
2310003	WRAPPING_TOKEN_IS_BLANK	INVALID_ARGUMENT	Wrapping token must be non-blank.
2310004	WRAPPING_TOKEN_NOT_FOUND	FAILED_PRECONDITION	Wrapping token does not exist or has already been redeemed.
2311001	APPLICATION_CREDENTIAL_NAME_NOT_VALID	INVALID_ARGUMENT	Application credential name is not valid.
2311002	APPLICATION_CREDENTIAL_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Application credential workspace ID is required.
2311003	APPLICATION_CREDENTIAL_NOT_FOUND	NOT_FOUND	Application credential not found.
2311004	APPLICATION_CREDENTIAL_ALREADY_EXISTS	ALREADY_EXISTS	An application credential with this name already exists in the workspace.
2311005	APPLICATION_CREDENTIAL_IS_REVOKED	FAILED_PRECONDITION	Application credential is revoked.
2311006	APPLICATION_CREDENTIAL_AUTHENTICATION_FAILED	UNAUTHENTICATED	Application credential authentication failed.
2311007	APPLICATION_CREDENTIAL_WORKSPACE_NOT_FOUND	NOT_FOUND	The workspace this application credential belongs to does not exist.
2312001	DATABASE_ROLE_NAME_NOT_VALID	INVALID_ARGUMENT	Database role name is not valid.
2312002	DATABASE_ROLE_CREATION_STATEMENTS_NOT_VALID	INVALID_ARGUMENT	Database role creation statements are required and must be non-blank.
2312003	DATABASE_ROLE_REVOCATION_STATEMENTS_NOT_VALID	INVALID_ARGUMENT	Database role revocation statements are required and must be non-blank.
2312004	DATABASE_ROLE_NOT_FOUND	NOT_FOUND	Database role not found.
2312005	DATABASE_ROLE_ALREADY_EXISTS	ALREADY_EXISTS	A database role with this name already exists in the workspace.
2312006	DATABASE_ROLE_DRY_RUN_FAILED	INVALID_ARGUMENT	Database role dry-run validation failed.
2312007	DATABASE_ROLE_STATEMENT_CONTAINS_FORBIDDEN_KEYWORD	INVALID_ARGUMENT	Database role statement contains a forbidden keyword.
2312008	DATABASE_ROLE_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	Database role is not marked for deletion.
2312009	DATABASE_ROLE_HAS_ACTIVE_LEASES	FAILED_PRECONDITION	Database role has active leases and cannot be deleted.
2312010	DATABASE_ROLE_WORKSPACE_NOT_FOUND	NOT_FOUND	The workspace this database role belongs to does not exist.
2312011	DATABASE_ROLE_DB_ENGINE_NOT_VALID	INVALID_ARGUMENT	Database engine is not valid.
2312012	DATABASE_ROLE_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	Database role workspace ID is required.
2313001	PKI_ROLE_NAME_NOT_VALID	INVALID_ARGUMENT	PKI role name is not valid.
2313002	PKI_ROLE_ALLOWED_DOMAINS_NOT_VALID	INVALID_ARGUMENT	PKI role allowed_domains must contain at least one valid domain pattern.
2313003	PKI_ROLE_MAX_TTL_NOT_VALID	INVALID_ARGUMENT	PKI role max_ttl must be positive and not exceed the parent CA validity remaining.
2313004	PKI_ROLE_ALLOWED_KEY_TYPES_NOT_VALID	INVALID_ARGUMENT	PKI role allowed_key_types must contain at least one entry.
2313005	PKI_ROLE_ALLOWED_EXTENDED_KEY_USAGES_NOT_VALID	INVALID_ARGUMENT	PKI role allowed_extended_key_usages must contain at least one entry.
2313006	PKI_ROLE_NOT_FOUND	NOT_FOUND	PKI role not found.
2313007	PKI_ROLE_ALREADY_EXISTS	ALREADY_EXISTS	A PKI role with this name already exists for the certificate authority.
2313008	PKI_ROLE_NOT_MARKED_FOR_DELETION	FAILED_PRECONDITION	PKI role is not marked for deletion.
2313009	PKI_ROLE_WORKSPACE_ID_NOT_VALID	INVALID_ARGUMENT	PKI role workspace ID is required.
2313010	PKI_ROLE_CERTIFICATE_AUTHORITY_NOT_FOUND	NOT_FOUND	The certificate authority this PKI role belongs to does not exist.
2313011	PKI_ROLE_DOMAIN_NOT_ALLOWED	INVALID_ARGUMENT	Requested certificate domain is not in the role’s allowed_domains list.
2313012	PKI_ROLE_TTL_EXCEEDS_MAX	INVALID_ARGUMENT	Requested certificate TTL exceeds the role’s max_ttl.
2313013	PKI_ROLE_KEY_TYPE_NOT_ALLOWED	INVALID_ARGUMENT	Requested certificate key type is not in the role’s allowed_key_types list.
2313014	PKI_ROLE_EXTENDED_KEY_USAGE_NOT_ALLOWED	INVALID_ARGUMENT	Requested certificate extended key usage is not in the role’s allowed_extended_key_usages list.