Error codes

Exact strings vary by edge version. Use this as a map of typical failures, not as a guaranteed enum.

REST (token administration)

Typical HTTP statuses:

• 400 Bad Request — invalid JSON, invalid expires_at, invalid channel rule, TTL over 24 hours, invalid tenant name after tenant_prefix
• 401 Unauthorized — missing or invalid master token
• 403 Forbidden — customer disabled, or caller IP not in the master token allow_ip_masks
• 404 Not Found — unknown token_id on refresh
• 200 OK — token operation succeeded

WebSocket handshake

• 401 — missing, invalid, expired, or restricted access token
• close after connect — origin / IP / region / protocol not allowed, or token revoked

The handshake echoes only llps.v1. It never reflects the token.

Application errors on the socket

Forbidden subscribe/publish and protocol mistakes usually arrive as a text line:

• ERR:...

The official SDKs surface this as an error. A handmade JSON { "code": "..." } frame is not the wire format.

Close codes you may still see:

• 1008 Policy Violation — forbidden action or invalid message
• 1009 Message Too Big — payload/frame over the size limit
• 1011 Internal Error — retry with backoff

Subscription / delivery (often not an error code)

No messages after subscribe is often not a coded error:

• join window after subscribe
• tenant or channel spelling
• token does not allow that subscribe rule
• writer used a different tenant

See Delivery semantics and Troubleshooting.

Typical causes (any transport)

• INVALID_TOKEN_FORMAT — not AT_{id}_{secret}
• TOKEN_EXPIRED / TOKEN_REVOKED
• ORIGIN_NOT_ALLOWED / IP_NOT_ALLOWED / REGION_NOT_ALLOWED
• TENANT_NOT_ALLOWED
• CHANNEL_NOT_ALLOWED_PUB / CHANNEL_NOT_ALLOWED_SUB
• INVALID_PATTERN
• PAYLOAD_TOO_LARGE
• SLOW_CONSUMER

REST may return these ideas as HTTP status plus a JSON body. WebSocket usually uses ERR: or a close.