Error Codes

Request-time responses

The gateway returns standard HTTP statuses at the edge:

HTTP	Condition
400	The request host matches no `domainmaps` entry
403	`kisai-auth` rejected the request and no `loginurl` is configured
302 / 307	Auth redirect to `loginurl`, or an entrypoint/endpoint redirect
404	No route/endpoint matched the path (static servers honor `notfoundpath`)
429	A rate-limit middleware tripped
502 / 503 / 504	Backend error / unavailable / timeout

TLS: if ACME issuance fails, the gateway serves its self-signed default certificate rather than failing the listener.

Config-validation codes

These are returned at boot or on a config reload; a failed reload keeps the last-known-good config live.

Code	Meaning
`gateway-sd-watcher-invalid-config`	The service-discovery watcher config is invalid
`gateway-invalid-tls-options-config`	A `tlsoptions` block is malformed
`gateway-invalid-tls-options-not-found`	A route references a `tlsoptions` name that isn’t defined
`gateway-invalid-internal-port`	Legacy listener mode requires a valid `internal.port`
`gateway-invalid-or-empty-entry-point`	An entrypoint has no name
`gateway-invalid-or-empty-backend`	A backend has no name or URLs

Additional reload failures — duplicate names, unresolved route→domainmap/endpoint/backend references, unknown certresolver or extramiddlewares, and writes to protected passthrough paths — abort the reload with a message naming the offender.