Error Codes

Errors are returned as { "code": "…", "message": "…", "data": {…} }. Policy denials are 400 with vault-access-denied (not 403).

Authorization and requests

Code	HTTP	Meaning
vault-access-denied	400	The caller’s CPET or access rule does not permit this operation
vault-invalid-payload	400	Malformed request body
vault-invalid-secret-key	400	The named key was not found
vault-invalid-certificate-path	400	Invalid certificate path
vault-invalid-validity-days	400	Invalid/empty validity window
vault-invalid-ip / vault-invalid-uri	400	Invalid SAN IP / URI
vault-not-found	404	Requested record not found
vault-missing-certificate	400	Certificate details missing from the request
vault-max-active-certificate-limit-reached	400	The key already has the maximum active records (3)

PKI / CRL / OCSP

Code	HTTP	Meaning
vault-revocation-not-configured	503	CRL/OCSP requested but the revocation emitter isn’t wired
vault-failed-to-generate-certificate	500	Certificate generation failed
vault-failed-to-generate-key	500	Key generation failed
vault-failed-to-create-cert-pair	500	Cert/key pair creation failed
vault-failed-to-parse-certificate / vault-failed-to-parse-private-key	400	Supplied PEM could not be parsed
vault-failed-to-convert-pem-to-certificate / vault-failed-to-convert-pem-to-key	400	PEM conversion failed
vault-failed-to-retrieve-certificates	500	Certificate lookup failed

Storage backend

Code	HTTP	Meaning
vault-not-connected	503	The storage backend is unreachable — consumers have no secret cache
vault-failed-to-connect-to-vault	503	Could not connect to the storage backend
vault-failed-to-retrieve-secret	500	Secret read failed
vault-failed-to-save-secret	500	Secret write failed
vault-failed-to-delete	500	Delete failed
vault-failed-to-renew-token / vault-invalid-non-renewable-token	500	Backend token could not be renewed (missing policy)

See also Operations → Failure modes.