Problems

A refusal is an RFC 9457 problem, application/problem+json, whose type is urn:nodeasset:problem: and its code. Branch on the code and its check, never on detail. A write’s refusal comes as the call’s answer or, once the write runs, as its operation’s problem, and each route’s page lists the codes it answers by status.

Fields

Field	What it carries
`type`	`urn:nodeasset:problem:<slug>`.
`title`	A short, fixed summary of the problem’s type.
`status`	The HTTP status.
`detail`	What happened, in plain words.
`gate`	The control that refused, such as `supply-ledger`.
`check`	The rule that refused, such as `policy:max-holders`.
`recovery`	What would make the same request succeed.
`retryAfter`	Seconds after which time alone may clear the refusal; also `Retry-After` when the problem is the answer itself.
`retryable`	Whether the same request can succeed later, once the cause is put right.
`packageName`	`package-not-vetted`: the package a hosting Canton node has not vetted.
`party`	`package-not-vetted`: the party whose hosting Canton node has not vetted the package.
`contractId`	`not-yet-projected`, `no-such-holding`: the holding the request cites.
`projectionOffset`	`not-yet-projected`: the offset the projection had read to.
`ledgerEnd`	`not-yet-projected`: the Canton node’s ledger end when it was decided.
`code`	`policy-refused`: the rule’s stable numeric code, DS Protocol’s where it has the rule.
`reason`	`policy-refused`: the rule’s stable reason; `holder-frozen`, `holder-liquidate-only`: the restriction’s reason code.
`policyVersion`	`policy-refused`: the policy version that refused; 0 is the manifest’s admission terms.
`errors`	Every invalid field, on a 400.
`requestId`	The request’s id, as the answer’s `X-Request-Id` carries it.

Statuses

Status	When
200	A read; a write replayed with the same key and body; a rejection; a statement already stored.
201	A record made in the call: a reconciliation run, an external statement.
202	A write accepted as an operation, or a four-eyes action awaiting an approver.
204	A write finished in the call with nothing to return: a deleted webhook.
400	Malformed or invalid input; `errors` lists every invalid field.
401	No bearer, one the engine cannot verify, or a signed request whose signature does not hold.
403	A role the route does not admit, another holder’s record, or an approver who audits.
404	No record by the id in the path, or by an id the body names.
405	A method the route does not take.
409	Refused by the current state: a record that exists, moved or ended; a hold, a gate or a restriction; a policy or supply ledger rule judged now; an offset the projection does not hold.
413	A body over its limit.
415	A statement in a format no adapter reads.
422	Refused on its own terms: a request no state could make valid, such as the wrong kind of instrument, a missing citation, or a reused idempotency key.
429	Over the caller’s rate limit; `Retry-After` says when to try again.
500	A failure the engine could not state, or an operation a restart cut short.
503	The ledger, the projection or the identity provider did not answer; `Retry-After` says when to try again.

Examples

A 400 lists every invalid field:

{
  "type": "urn:nodeasset:problem:bad-request",
  "title": "Bad request",
  "status": 400,
  "detail": "2 fields are invalid: units must be positive; holderId is required",
  "errors": [
    {
      "pointer": "/units",
      "detail": "units must be positive"
    },
    {
      "pointer": "/holderId",
      "detail": "holderId is required"
    }
  ],
  "requestId": "crm-7f3a9c"
}

A 409 names the control, the rule and the recovery:

{
  "type": "urn:nodeasset:problem:policy-refused",
  "title": "Refused by policy",
  "status": 409,
  "detail": "Max supply: FUND would count 1000500 units in issue, above its cap of 1000000",
  "gate": "supply-ledger",
  "check": "policy:supply-cap",
  "code": 53,
  "reason": "Max supply",
  "policyVersion": 4,
  "recovery": "subscribe at most 500 units less, or raise the supply cap with a new policy version",
  "requestId": "crm-7f3aa0"
}

A 422 refuses what the request asks:

{
  "type": "urn:nodeasset:problem:not-rebasing",
  "title": "Not rebasing",
  "status": 422,
  "detail": "CASH does not rebase: it has no distributions to execute",
  "recovery": "Name a rebasing instrument.",
  "requestId": "crm-7f3aa4"
}

A 429 says when to try again:

{
  "type": "urn:nodeasset:problem:rate-limited",
  "title": "Rate limited",
  "status": 429,
  "detail": "svc-1 is over its rate limit",
  "retryAfter": 12,
  "retryable": true,
  "recovery": "wait 12 s, when the window ends, and send the request again",
  "requestId": "crm-7f3aa8"
}

Codes from a kind of route

These codes are not listed again on each route’s page:

Every signed-in route: 401 unauthenticated, 401 signature-invalid, 403 role-refused, 429 rate-limited.
Every route that reads the ledger at at or asOf: 409 offset-unavailable, 409 before-horizon.
Every write: 400 bad-request, 400 unknown-field, 413 payload-too-large, 422 idempotency-key-reused.
Every write that reaches the ledger: 409 package-not-vetted, 503 ledger-unavailable.
Every four-eyes route: 409 approval-rejected, 409 approval-in-flight.
Any route, when the engine cannot answer: 503 unavailable, 503 projection-empty, 500 internal.

Codes

400 Bad request

Code	What it means	Recovery
`bad-request`	A parameter or body field is missing, of the wrong type or out of range; `errors` lists each.	Correct each field `errors` names and send the request again.
`unknown-field`	The body carries a field the route does not take.	Send only the fields the route’s body lists.

401 Unauthenticated

Code	What it means	Recovery
`signature-invalid`	A signed request’s signature does not hold; `check` names the part: `key`, `timestamp`, `nonce` or `signature`.	Sign the request as sent, with the current time and a new nonce.
`unauthenticated`	No bearer, or one the engine cannot verify.	Present a bearer your identity provider issued for the engine.

403 Forbidden

Code	What it means	Recovery
`auditor-never-approves`	An approver who holds the auditor role tried to approve an action.	An approver without the auditor role approves it.
`not-your-holder`	An investor named another holder, in the path, a list’s `holderId` or a body. Another holder’s subscription, redemption or settlement, read by its own id, answers 404 as one that does not exist.	Act on the holder your bearer’s holder claim names.
`role-refused`	The caller’s roles do not admit the route.	Call with a bearer carrying one of the route’s roles.

404 Not found

Code	What it means	Recovery
`no-amendment`	The reserve has no amendment with that id.	Check the id; the reserve’s list shows its amendments.
`no-dealing-cycle`	No open dealing cycle has that id.	Check the id; the list shows the ones that exist.
`no-distribution`	No distribution has that id.	Check the id; the list shows the ones that exist.
`no-hold`	No hold has that id.	Check the id; the list shows the ones that exist.
`no-holder`	The holder the request names is not registered.	Register it with `POST /v1/holders` first.
`no-instrument`	No instrument has that id.	Check the id; the list shows the ones that exist.
`no-lock-agreement`	The reserve has no lock agreement for that asset.	Check the asset’s id; the reserve’s list shows its agreements.
`no-redemption`	No redemption claim has that id.	Check the id; the list shows the ones that exist.
`no-reserve`	No reserve has that id.	Check the id; the list shows the ones that exist.
`no-reserve-mint`	The reserve has no mint with that id.	Check the id; the reserve’s list shows its mints.
`no-reserve-redemption`	The reserve has no redemption with that id.	Check the id; the reserve’s list shows its redemptions.
`no-restriction`	No restriction has that id.	Check the id; the list shows the ones that exist.
`no-standing-approval`	No standing approval has that id.	Check the id; the list shows the ones that exist.
`no-standing-settlement`	No live standing settlement has that id.	Check the id; the list shows the ones that exist.
`no-subscription`	No subscription has that id.	Check the id; the list shows the ones that exist.
`no-tenant`	The deployment configures no tenant with that id.	Name a tenant the deployment configures.
`no-webhook`	No webhook has that id.	Check the id; the list shows the ones that exist.
`not-found`	No record has the id in the path.	Check the id; the list shows the ones that exist.
`unknown-source`	The deployment configures no external source with that id.	Name a source the deployment configures.

405 Method not allowed

Code	What it means	Recovery
`method-not-allowed`	The route does not take this method.	Use a method the route lists.

409 Conflict

Code	What it means	Recovery
`accepted-terms-version`	The version is not the one the tenant names now.	Show the investor the current version and accept that one.
`admission-consent-exists`	A register keeper’s admission consent is live for the instrument.	Change its terms with the policy, `PUT /v1/instruments/{instrumentId}/policy`, which proposes them to it.
`admission-consents-ambiguous`	Two of the register keeper’s admission consents are live for the instrument.	The venue or the register keeper closes all but one; then admit again.
`admission-live`	The holder has an admission live.	Withdraw each admission first.
`admission-open-ended`	An admission under the register keeper’s consent names an end, and its credential is open-ended.	Send no `validUntil`; the register keeper ends an admission by revoking its credential.
`agreement-exists`	The issuer powers agreement is in force already.	Nothing is left to propose.
`agreement-proposed`	The agreement awaits the Registrar’s accept.	The Registrar accepts it on its own node.
`allocation-stale`	An allocation under the order is not what it settles now; the detail names each and why.	Release the order; the next settle asks again.
`amendment-decided`	The issuer has decided the amendment already, or the venue withdrew it.	Read it; to change the terms again, propose new ones.
`amendment-id-taken`	The reserve has an amendment with that id already, of other terms.	Choose another id, or repeat the request that made it.
`approval-decided`	The action was approved or rejected already.	A new request starts a new action.
`approval-in-flight`	The action is approved and its operation is not open yet.	Retry in a moment.
`approval-rejected`	The four-eyes action this request makes was rejected, so it never runs.	Send the request with a new `Idempotency-Key` to start a new action.
`asset-held`	The new terms drop an asset the reserve still holds.	Keep the asset in the terms until the reserve holds none of it.
`asset-leaving`	An accepted amendment drops the asset, so the reserve takes in no more of it.	Deposit another of the reserve’s assets.
`before-horizon`	The instant asked for is before the projection’s history.	Ask for a later instant, or for an offset the projection holds with `at`.
`below-minimum`	The iteration pays less than the standing settlement’s minimum.	Settle a larger order.
`concentration-cap`	An asset would be more of the reserve’s value than its cap allows.	Deposit another asset, or less of this one.
`consent-exists`	A consent exists already: the fund’s live primary market in the payment asset, or the holder’s given issuer powers consent.	Use the consent there; a fund’s is closed by its signatories before another in the same payment asset.
`consent-offered`	The holder’s consent is offered and awaits its answer.	The holder’s custodian accepts it.
`consents-ambiguous`	The fund has more than one live consent in the order’s payment asset.	Its signatories close all but one; then settle again.
`cover-short`	The reserve’s cover would fall below the minimum its terms set.	Change the request so the cover holds, or have the issuer add margin first.
`dealing-cycle-exists`	A dealing cycle has the id already.	Use a new id.
`distributed`	The period is distributed already.	The next point opens the next period.
`distribution-not-payable`	The distribution awaits its fund administrator’s list, or is held.	The fund administrator posts its list; one that agrees makes it payable.
`distribution-unrolled`	An earlier distribution has a paid line not rolled to its holder’s accrual.	Roll the earlier distribution first.
`exceeds-standing-approval`	The scheduler’s period would pay more than the grant’s `maxTotalPayout`.	A person executes the period under four eyes.
`findings-not-held`	The deployment’s reconciliation settings would let a blocking finding pass, so no grant executes.	Keep reconciliation blocking with every blocking check; until then a person executes.
`hold-released`	The hold is released already.	Nothing is left to release.
`holder-closed`	The holder is closed and takes part in nothing.	Act on the holder that succeeds it, if one does.
`holder-credential`	The reserve’s holder has no live credential for the asset, so no unit of it moves into or out of the holder’s account.	Have the asset’s credential issuer issue the holder one; then try again.
`holder-exists`	The holder id is registered already.	Choose another holder id.
`holder-frozen`	A freeze on the holder refuses the act; `reason` carries the restriction’s reason code.	The restriction is lifted first.
`holder-holds`	The holder holds units, so it is neither closed nor its admission withdrawn.	The holder redeems or retires what it holds first.
`holder-liquidate-only`	A liquidate-only restriction refuses the act; the holder may only leave.	The holder redeems, or the restriction is lifted first.
`holder-succeeded`	The holder has a successor already.	A later custodian change succeeds the successor.
`in-dealing-cycle`	The order is in an open dealing cycle.	Settle or release that dealing cycle.
`instrument-held`	Reconciliation holds the instrument, or one it is built on.	Put the findings right, then release the hold under four eyes.
`instrument-recorded`	The manifest records the instrument differently.	An instrument is recorded once; keep the terms recorded.
`insufficient-units`	The holder holds fewer units unlocked than the claim asks, beyond its open claims.	Claim fewer units.
`investor-pending`	Another redemption of the investor’s is pending in the pool.	Settle that one first.
`investor-twice`	An investor has more than one order in the cycle.	Put the others in the next cycle.
`lock-agreement-exists`	The reserve has a lock agreement for the asset already, live or proposed.	Read the reserve’s agreements; delete the proposal first to propose again.
`lock-agreement-in-use`	The reserve still holds units of the agreement’s asset.	Pay the asset out of the reserve and amend its terms to drop it; then release the agreement.
`lock-agreement-missing`	The asset is another registrar’s, and no live lock agreement lets the reserve lock it.	Create the lock agreement and have its registrar, the holder and the issuer sign it.
`manifest-moved`	The manifest changed while the operation ran.	Send the request again; it reads the new version.
`mint-bound`	The mint delivered another subscription already.	Deliver against the mint requested for this subscription.
`mint-id-taken`	The reserve has a mint with that id already, of another request.	Choose another id, or repeat the request that made it.
`mint-of-another-subscription`	The mint names another subscription of the holder’s.	Deliver that subscription against it.
`minted-by-registrar`	The Registrar minted the subscription’s units already.	Deliver the subscription against that mint.
`moves-partly-committed`	Some moves committed before a later one failed; the detail names those that did.	Send the others again once the failure is put right.
`nav-not-agreed`	The fund administrator’s NAV for the point is not agreed, so the scheduler does not execute.	The administrator posts its NAV and a run compares it.
`no-admission-consent`	The instrument requires its register keeper’s credential, and no admission consent is live.	Propose it with `PUT /v1/instruments/{instrumentId}/admission-consent`; the register keeper accepts it.
`no-agreement`	The Registrar’s issuer powers agreement is not in force.	Propose it with `POST /v1/issuer-powers-agreements`; the Registrar accepts it.
`no-consent`	A holder on either side has not consented to the issuer powers.	Offer the consent for the holder to accept.
`no-mint`	No accepted mint request matches the subscription.	The holder requests the mint and the Registrar accepts it; then deliver.
`no-oracle`	The instrument names no oracle.	Record the instrument with its oracle.
`no-payout-decimals`	The instrument records no payout decimals.	Record its `distribution.payoutDecimals`.
`no-point`	The oracle has published no point.	The oracle publishes a point first.
`no-primary-market`	The fund has no live consent to a primary market paid on the ledger, or none in the order’s payment asset.	Deliver against the Registrar’s mint instead, or propose the consent in the payment asset.
`no-row`	The holder whose units move has no accrual row on the rebasing instrument.	Move units only off a holder with a row.
`no-such-holding`	`GET /api/v1/da/transfer-context` was asked for a holding that never reaches the projection; `contractId` names it.	Cite a holding that is live on the ledger.
`no-supply-ledger`	The instrument has no supply ledger.	Update the instrument’s policy, which proposes one, and its registrar accepts it.
`not-a-reserve-asset`	The asset is none of the reserve’s assets.	Name one of the assets its terms list, or amend the terms.
`not-admitted`	The holder is not admitted to the instrument.	Offer the admission for the holder to accept.
`not-burned`	The Registrar has not accepted the burn request yet.	The Registrar accepts the burn request; then settle.
`not-committed`	A party has not answered its allocation request yet.	Its custodian answers the request; then settle.
`not-eligible`	The holder cannot show a claim the instrument’s admission requires; `check` names the rule.	Update the holder’s attributes, then offer the admission again.
`not-funded`	No burn request of the holder’s names the claim.	The holder’s custodian requests the burn, naming the claim; then settle.
`not-in-manifest`	An instrument the request names is not recorded in the manifest.	Record it with `POST /v1/instruments` first.
`not-on-registry`	The Registry does not configure the instrument for the venue.	The Registrar configures the instrument first.
`not-oracle-attested`	The fund’s oracle did not attest the subscription.	Close it; the fund’s oracle prices a new one.
`not-priced`	The fund’s oracle has not priced the claim.	The oracle prices the claim; then settle again.
`not-restatable`	The distribution was frozen before plans recorded the offset they read.	Preview a distribution executed since.
`not-successor`	The successor is not the one registered for the holder.	Register it as the holder’s successor first.
`not-sweep-investor`	The subscription is another investor’s than the sweep’s.	Settle the sweep investor’s own subscription.
`nothing-to-recover`	Nothing the holder holds is under a consent, so it all moves by custodian succession.	The custodians transfer the units.
`nothing-to-release`	No allocation request and no allocation names the order.	Nothing is left to release.
`offer-ends-early`	The offer would end at or before now, or a re-issue before the credential it replaces.	Name a later `validUntil`.
`offset-unavailable`	The projection does not hold the offset asked for, yet or any more.	Retry after `Retry-After`, or read at an offset the projection holds.
`onboard-conflict`	The onboarding would bind the KYC, the party or the holder id to something else; `check` names which.	Read the holder and onboard again with what it is bound to.
`order-asked`	The order was asked for alone, or in another cycle or pool.	Settle it there, or release it first.
`order-ended`	The mint or the redemption has settled or ended already.	Read it; nothing is left to cancel.
`order-live`	The order can still settle as asked.	Settle it, or withdraw the claim; release it once the request’s deadline passes.
`other-kind`	The iteration names the other kind of order than the standing settlement settles.	Name a subscription for a sweep, a redemption for a pool.
`outstanding-exceeded`	The redemption burns more units than the reserve has outstanding.	Redeem at most the units outstanding.
`over-limit`	The iteration would pass the window’s limit.	Settle it in the next window.
`package-not-vetted`	A hosting Canton node has not vetted a package the command needs, or the venue’s own Canton node does not have the reserve’s packages an act on a reserve needs; `packageName` and `party` name the package and the party where they are known.	Upload and vet the package on that Canton node, then send the same request again.
`paid-on-ledger`	The fund is paid on the ledger, so the order settles against the payment asset.	Settle it against the payment asset, or the Registrar rejects the burn request.
`party-registered`	Another holder has the party already.	A party is one holder; use its holder id.
`payment-instrument-required`	The order names no payment asset, and its fund takes more than one now.	End the order and make it again, naming its payment asset in `paymentInstrumentId`.
`period-mismatch`	The plan at the oracle’s latest point is for another period than the one named.	Name the period the latest point is in.
`period-open`	The provision period has not ended.	Propose it once the period ends.
`policy-moved`	The policy’s latest version is not the `expectedVersion` the request names.	Read the policy again and send the change against its `latestVersion`.
`policy-refused`	The instrument’s policy or its supply ledger’s terms refuse the act; `check`, `code` and `reason` name the rule.	Act within the rule; a limit’s refusal says when its next window starts.
`pool-short`	The pool still commits less than the iteration pays.	Stand a pool that commits more.
`pool-spent`	The liquidity pool commits nothing any more.	Stand a new pool.
`price-moved`	A price moved between the quote and the settlement, so the order no longer matches what is due.	Start a new order at the price now.
`price-stale`	An asset’s price source has no price point inside the asset’s freshness window.	Wait for the price source’s next point; then try again.
`proposal-pending`	A consent proposal for the fund in the payment asset awaits its signatures.	The Registrar and the treasury decide it first.
`rate-changed-in-period`	The period’s points carry more than one withholding rate.	Execute again with `acknowledgeRateChange: true` once the rate to apply is confirmed.
`receiver-block-listed`	The receiver is on the Registrar’s block list with no freeze of the venue’s behind it.	The Registrar lifts the entry first.
`receiver-ineligible`	The receiver is closed, restricted on the instrument, or holds no live credential for it.	Admit the receiver, or lift its restriction.
`reconciliation-finding`	A reconciliation run found a blocking finding in the instrument’s scope, so the scheduler does not execute.	A person executes the period under four eyes.
`reconciliation-not-current`	No reconciliation run has read the plan’s point yet, so the scheduler does not execute.	A run reads the point; until then a person executes.
`record-date-not-ended`	The scheduler’s period has a record date that has not ended (UTC).	The scheduler executes the day after.
`redemption-closed`	The redemption is settled or withdrawn already.	Nothing is left to settle.
`redemption-id-taken`	The redemption id is in use.	Use a new id.
`redemption-not-claimed`	The redemption is funded or ended, so it is no open claim.	Settle a funded claim on its own path.
`requirements-beyond-manager`	The instrument requires credentials beyond the venue’s own, so the Registry would refuse the move.	The Registrar sets the instrument’s requirements to the venue’s credential.
`reserve-asset-short`	The reserve holds less of the asset than the redemption pays.	Redeem fewer units, or name another asset.
`reserve-exists`	A reserve, or a proposal of one, has that id already.	Choose another id, or read the reserve that has it.
`reserve-not-open`	The reserve is still proposed: its issuer or its holder has not accepted it.	Wait until both accept it from their own wallets.
`reserve-outstanding`	The reserve still backs units outstanding, and closes only when none are.	Redeem every unit outstanding first.
`restriction-lifted`	The restriction is lifted already.	Nothing is left to lift.
`row-differs`	The holder’s accrual row does not count the units that move.	Recover once the row counts what the holder holds.
`row-short`	The holder’s accrual row carries fewer units than move.	Move at most what the row carries.
`same-approver`	The approver is the action’s maker, or has signed it already.	Another approver, not the maker, signs it.
`same-holder`	The move names one holder on both sides.	Name two holders.
`settlement-open`	The holder has a settlement open.	Let each settle, or close it.
`standing-approval-live`	A standing approval is live on the instrument already.	Revoke it first; a wider or renewed grant is a new one.
`standing-approval-not-live`	The grant was revoked or lapsed before its operation froze the plan.	A person executes the period under four eyes.
`standing-settlement-exists`	A standing settlement has the id already.	Use a new id.
`standing-settlement-paused`	The standing settlement is paused.	Resume it, then settle again.
`strike-mismatch`	The orders are priced at more than one NAV.	Open a cycle per strike.
`strike-moved`	An order is no longer priced at the cycle’s strike.	Release the cycle and open another at one strike.
`subscription-id-taken`	The subscription id is in use.	Use a new id.
`subscription-not-claimed`	The subscription is priced or ended, so it is no claim to withdraw.	The venue and its attestors close a priced subscription together.
`subscription-not-priced`	The subscription is not priced, or is delivered already.	Wait for the oracle’s price; a delivered subscription has nothing left to settle.
`successor-has-row`	The successor already has an accrual row on the instrument.	Recover onto a successor with no row.
`supply-ledgers-ambiguous`	Two supply ledgers of the instrument are live.	The registrar closes all but one.
`timelock-too-short`	A loosening was approved too late for the `effectiveAt` it names.	Send it again with a later `effectiveAt`, or none.
`treasury-short`	The treasury holds less of the payment asset unlocked than it pays.	Fund the treasury, then settle again.
`units-exceed-holdings`	The holder holds fewer units unlocked than move.	Move at most what is unlocked; a locked holding moves once it is unlocked.
`units-locked`	Some of the holder’s units are locked, and a recovery moves the accrual row whole.	Recover once the lock is settled or withdrawn.
`units-not-positive`	The units to move are not above zero.	Move a positive number of units.
`until-past`	The deadline `until` has passed.	Name a deadline in the future.
`webhook-configured`	The deployment’s configuration defines the webhook.	Remove it from the configuration and restart the engine.
`webhook-exists`	A webhook has the id already.	Choose another id, or delete the one there.

413 Too large

Code	What it means	Recovery
`payload-too-large`	The body is over `venue.api.max-body-bytes`, 1 MiB by default.	Send a smaller body.
`statement-too-large`	The statement is over `venue.recon.external.max-body-bytes`.	Split the statement, or raise the limit.

415 Unsupported format

Code	What it means	Recovery
`format-unsupported`	No adapter reads the statement’s format.	Send canonical JSON, the source’s CSV, or camt.053 or semt.002 XML.

422 Unprocessable

Code	What it means	Recovery
`action-not-grantable`	The action is not one a grant may name; only `distribution.execute` is.	Name `distribution.execute`.
`approval-mismatch`	An approval by key replays to a route that is not four-eyes, or one the engine does not dispatch.	The maker starts a new action on a four-eyes route.
`asset-is-backed`	An asset of the terms is the backed instrument itself.	Remove the backed instrument from the assets.
`asset-repeated`	Two assets of the terms share an id.	Name each asset once, under ids of their own.
`evidence-required`	No evidence is cited.	Send `evidence` with its `reference` and `documentHash`.
`growth-bound`	The price would grow faster than its bound allows.	Under a grant, a person executes the period under four eyes.
`holder-not-distinct`	The holder is the venue or the issuer; a reserve’s holder is a party of its own.	Allocate the reserve a holder party of its own.
`holder-repeated`	A holder appears in more than one move of the batch.	Send the moves of one holder as separate requests.
`idempotency-key-reused`	The `Idempotency-Key` was sent before with another body.	Send the original body, or a new key for a new request.
`instrument-mismatch`	The statement names another instrument than `instrumentId`.	Send the `instrumentId` the statement names, or none.
`instrument-not-in-source`	The source does not state the instrument.	Post it from a source that states the instrument.
`instrument-unknown`	The manifest records no instrument the statement names.	Name the instrument by its id, ISIN, CUSIP or FIGI.
`invalid-valid-until`	`validUntil` is not after now and within a year.	Make the grant again with a `validUntil` inside the year.
`issuer-asset`	The issuer administers the asset, so the reserve locks it in its own authority and needs no agreement.	Propose agreements for other registrars’ assets only.
`kind-mismatch`	The statement’s kind is not the kind its source sends.	Post it as its own source’s statement.
`loosening-too-soon`	The terms loosen, and ask to take effect sooner than the reserve’s delay after the acceptance allows.	Ask for a later effectiveAt, or none.
`manifest-refused`	The candidate manifest does not validate; the detail lists what fails.	Correct what the detail names and send the request again.
`not-rebasing`	The instrument does not rebase.	Name a rebasing instrument.
`oracle-is-issuer`	The fund’s registrar or treasury is named as the oracle.	Name a price source apart from the fund’s registrar and treasury.
`oracle-is-manager`	The venue’s own party is named as the oracle.	Name the fund’s oracle.
`order-required`	No order is cited.	Send `order` with its `reference` and `documentHash`.
`payment-instrument-mismatch`	Orders settled together, or an order and the standing settlement it settles under, are paid in different payment assets.	Settle each payment asset’s orders apart, in a dealing cycle or under a standing settlement of their own.
`payment-instrument-required`	The fund takes more than one payment asset, and the request names none.	Name the payment asset in `paymentInstrumentId`.
`payment-is-the-fund`	The fund is named as its own payment asset.	Name a cash asset on the DA Registry.
`statement-unreadable`	The statement cannot be read: empty, or a field or a line out of shape.	Correct what the detail names and post it again.
`timelock-too-short`	A loosening names an `effectiveAt` before its timelock ends.	Name a later `effectiveAt`, or none.
`treasury-is-registrar`	The registrar is named as the treasury.	Name the party that owns the fund’s payment account.
`valuation-not-backed`	The manifest records the instrument as rebasing; a reserve backs a par or an accumulating instrument.	Record the backed instrument as par or accumulating.
`webhook-destination-refused`	The webhook’s URL leads to an address the engine does not post to: private, loopback, link-local or reserved, outside the networks the venue allows.	Use a receiver at a public address, or have the venue allow the receiver’s network (`venue.recon.webhook-delivery.allowed-networks`).
`webhook-secret`	The key file is missing, unreadable, shorter than 32 bytes or outside the engine’s webhook secret directory.	Put a key of at least 32 bytes in a file in the webhook secret directory, readable by the engine.

429 Too many requests

Code	What it means	Recovery
`rate-limited`	The caller is over its rate limit.	Wait `retryAfter` seconds, then send the request again.

500 Internal error

Code	What it means	Recovery
`internal`	The engine failed in a way it could not state.	Report it with the problem’s `requestId`.
`interrupted`	A restart cut an operation short, and what it acted on does not show it finished.	Do what `recovery` says; a repeat may need a new approval.

503 Unavailable

Code	What it means	Recovery
`idp-unavailable`	The identity provider’s keys could not be read to verify the bearer.	Retry once the identity provider is reachable again.
`ledger-unavailable`	The ledger did not answer, or the engine had no service bearer for it.	Read the record to see whether the write took effect, then retry.
`not-yet-projected`	`GET /api/v1/da/transfer-context` was asked for a holding past the offset the projection has read to.	Send the same request again after `Retry-After`.
`projection-empty`	The projection holds no transaction yet.	Retry once it has read the ledger.
`unavailable`	The ledger or the projection did not answer.	Retry after `Retry-After`.

Related: Conventions · How the API works

Get started

Instruments

Policies

Prices

Holders

Subscriptions

Redemptions

Dealing cycles

Reserves

Standing settlements

Distributions

Restrictions and issuer powers

Holds and pauses

Reconciliation

Approvals and operations

Reports

Events

System

Fields

Statuses

Examples

Codes from a kind of route

Codes

400 Bad request

401 Unauthenticated

403 Forbidden

404 Not found

405 Method not allowed

409 Conflict

413 Too large

415 Unsupported format

422 Unprocessable

429 Too many requests

500 Internal error

503 Unavailable

​Fields

​Statuses

​Examples

​Codes from a kind of route

​Codes

​400 Bad request

​401 Unauthenticated

​403 Forbidden

​404 Not found

​405 Method not allowed

​409 Conflict

​413 Too large

​415 Unsupported format

​422 Unprocessable

​429 Too many requests

​500 Internal error

​503 Unavailable

Fields

Statuses

Examples

Codes from a kind of route

Codes

400 Bad request

401 Unauthenticated

403 Forbidden

404 Not found

405 Method not allowed

409 Conflict

413 Too large

415 Unsupported format

422 Unprocessable

429 Too many requests

500 Internal error

503 Unavailable