API — error catalogue

Amalda · Yangilangan 04.10.2026

Every error has one shape, whatever the endpoint:

{"error": {"code": "policy_denied", "reason": "SYSTEM_NOT_ALLOWED", "message_uz": "…",
           "request_id": "01J…", "detail": null}}

code — the stable identifier. Program against it; it never changes meaning.
reason — a refinement: the policy reason for policy_denied (table below), the field path for invalid_request, otherwise usually null.
message_uz — a sentence for a person, in Uzbek. It may be reworded; do not parse it.
request_id — quote it when you write to support; it is on every journal entry of the request.
detail — identifiers only (what was compared), never document content.
retryable — present on signing_failed only: true means the same request may succeed.

A 429 from the signing endpoint carries Retry-After (seconds to the end of the minute). In a batch (documents of more than one) each failed document has its own error in results[i] and the HTTP status is 200; a request of one document answers with the error's own status.

Retrying safely. Send the same Idempotency-Key with the same body: within ten minutes the first answer comes back and nothing is signed twice. A different body under the same key is idempotency_mismatch; a retry that arrives while the first request still runs is request_in_progress (wait a second and retry). One edge: if the server dies after signing but before it stores the answer, the key stays "in progress" for the rest of the ten minutes and a retry after that signs again. request_in_progress lasting minutes means exactly that: before retrying with a new key, look the documents up (the key owner's journal, or your own records of audit_refs) so a second signature is a decision, not an accident.

Codes an integrator meets

Code	HTTP	Meaning	What to do
`unauthorized`	401	No bearer token, an unknown or expired one, or a token of a disabled account.	Get a new token (`POST /api/v1/token`).
`invalid_client`	401	Wrong `client_id` / `client_secret`, the account (or its responsible person's account) is disabled, or the secret was rotated while the token was being issued.	Check the credentials; after a rotation use the new secret.
`too_many_requests`	429	A budget is spent: tokens (30 issued and 30 wrong secrets an hour per client, 100 an hour per address), or documents per minute (`sign:client`).	Every 429 carries `Retry-After` (seconds) and `detail` («N daqiqadan keyin»). Signing: wait that long. Token: at most one a minute is plenty - reuse it for its hour.
`invalid_request`	422	The body does not validate; `reason` names the field (also `idempotency_key`, `page_url`, `platform act`).	Fix the request; do not retry it as is.
`idempotency_key_required`	422	A service account's signing request had no `Idempotency-Key`.	Send one per request (8–64 of `A-Z a-z 0-9 . _ -`).
`idempotency_mismatch`	422	The key was used for a different body within the window.	Use a new key for a new request.
`request_in_progress`	409	The same key's first request is still running.	Retry shortly with the same key.
`policy_denied`	403	The owner's act does not cover this signature; `reason` says why (next table).	Ask the key owner to widen the act; never retry unchanged.
`unknown_key`	404	No such `credential_id`.	Take ids from `GET /api/v1/client/credentials`.
`not_found`	404	No such resource (a stored signature of another signer, an unknown path).	Check the id and the `credential_id` parameter.
`key_not_active`	409	The key has no bound certificate or was retired.	Tell the key owner.
`no_certificate`	409	The key has no certificate yet.	Tell the key owner.
`key_owner_mismatch`	409	The key's owner disagrees with the journal - the key is held back.	Tell support with the `request_id`.
`key_unavailable`	409	The key is not in the HSM (a restored database without the key).	Tell the key owner / support.
`document_too_large`	422	More than 5 MiB of documents in one request.	Split the batch.
`cms_invalid`	422	A PKCS#7 in the request could not be read.	Send the file as issued.
`cms_not_attached`	422	Co-signing needs an attached PKCS#7; this one is detached.	Send the attached form.
`signer_not_found`	422	No signer with that serial in the PKCS#7 (`attach-timestamp`).	Use the serial from the signature.
`signing_failed`	502	The HSM or the CMS assembly failed; the intent is closed in the journal.	Retry if `retryable` is `true`; else tell support.
`internal`	500	An unexpected error; nothing was signed without a journal entry.	Retry once with the same key; then tell support.

Policy refusals (`policy_denied` → `reason`)

Reason	Meaning
`NO_GRANT`	No live act gives this account this key.
`GRANT_REVOKED`	The act was revoked by the key owner.
`NOT_YET_VALID`	The act's period has not started.
`EXPIRED`	The act's period is over.
`GRANT_USED`	A one-shot act was already used.
`SYSTEM_NOT_ALLOWED`	The `site` is not among the act's systems.
`DOC_KIND_NOT_ALLOWED`	The document kind (`doc_class`) is not among the act's kinds.
`UNCLASSIFIED_CONTENT`	The content is of no kind the platform recognises, and a site-scoped act accepts only recognised kinds (or structural kinds the owner named, such as `xml:report`).
`SITE_NOT_TRUSTED`	Only site trust could allow this; a service account has none (its act must name the site).
`CONSTRAINT_VIOLATED`	The document breaks a constraint of the act (an amount, a form code).
`CONSTRAINT_UNCHECKABLE`	The act has a constraint and the document lacks the field to check it.
`NOT_DELEGABLE`	Platform documents (grant acts) are signed by the key owner only.
`CERT_NOT_VALID`	The key's certificate is outside its validity period.
`SINGLE_KEY_UNVERIFIED`	The key owner has not passed the single-key check yet.
`SINGLE_KEY_VIOLATED`	A re-check found another active key of the owner; the key signs no site documents.
`CONFIRMATION_REQUIRED`	Allowed, but not without the person (ADR-0061): the request came without the confirmation token a `preview` issued. Browser and agent sessions only - a service account is never asked.

Codes of the person's API (panel, extension, agent)

A service account does not reach these endpoints (unauthorized); they are listed so the catalogue is whole.

Code	HTTP	Meaning
`auth_failed`	401	Wrong login, password or one-time code.
`forbidden`	403	The role does not allow this action.
`locked`	423	The panel session is idle-locked; the PIN opens it.
`pin_not_set`	409	No PIN yet.
`pin_invalid`	422	A PIN is six to eight digits.
`pin_weak`	422	The PIN is too simple.
`reauth_required`	401	ADR-0062: a sensitive setting was asked without a password and the session's re-authentication window (10 minutes after a login, `POST /auth/reauth` or `POST /auth/reauth/passkey`; any lock closes it) is not open. Re-authenticate and repeat, or send the password.
`pin_wrong`	401	Wrong PIN. On the unlock, `detail` says how many tries are left (`N ta urinish qoldi`); the fifth revokes the session (`sessiya yopildi`).
`totp_wrong`	401	Wrong authenticator code.
`totp_reset_invalid`	422	Invalid authenticator re-enrolment token.
`totp_reset_expired`	409	The authenticator re-enrolment expired.
`passkeys_disabled`	409	Passkeys are off on this server.
`passkey_invalid`	422	The passkey response did not verify.
`passkey_challenge_invalid`	422	Unknown passkey challenge.
`passkey_challenge_expired`	409	The passkey challenge expired.
`passkey_exists`	409	This passkey is already registered.
`passkey_limit`	409	At most five passkeys.
`passkey_not_set`	409	The account has no passkey.
`passkey_wrong`	401	The passkey unlock was refused.
`confirmation_required`	409	The policy wants the person's confirmation first (ADR-0061): `POST /signatures/preview`, show what it answers, send the token with `sign`.
`passkey_not_found`	404	No such passkey.
`recovery_required`	403	A recovery session: restore the second factor first.
`second_factor_required`	422	Give exactly one of a one-time code or a recovery code.
`cert_key_mismatch`	409	The certificate's public key is not the HSM key's.
`owner_mismatch`	409	The certificate's owner (STIR/JSHSHIR) is not the account's.
`cert_untrusted`	409	The certificate's issuer is unknown or the certificate is invalid.
`key_already_bound`	409	The key already has a certificate.
`key_not_awaiting_cert`	409	The key is not waiting for a certificate.
`invalid_site`	422	Not a site name.
`trusted_site_limit`	409	Too many trusted sites.
`pfx_not_personal`	422	The pfx holds no personal certificate.
`already_registered`	409	An account with this JSHSHIR exists.
`key_already_imported`	409	This key is already present.
`pfx_key_mismatch`	422	The pfx key does not match its certificate.
`key_not_live`	409	The key is already retired (ADR-0057).
`recovery_key_mismatch`	409	Account recovery (ADR-0056): the pfx is not the one the account was founded by - its key is not the account's.
`pfx_no_leaf`	422	The pfx has no owner certificate.
`pfx_no_certificate`	422	The pfx has no certificate.
`pfx_no_key`	422	The pfx has no key.
`pfx_unsupported`	422	Unsupported pfx format.
`pfx_password`	422	Wrong pfx password.
`pfx_invalid`	422	The pfx could not be read.
`import_not_allowed`	403	Import is allowed at the «nazorat» tier only.
`not_grant_owner`	403	Only the key owner (or the organization's admin, for revocation).
`grantee_not_found`	404	No account with this JSHSHIR.
`certificate_no_pinfl`	409	The key's certificate has no JSHSHIR; a grant act needs it.
`grantee_not_attested`	409	The grantee has no attested account.
`invalid_grant`	422	Invalid grant parameters (`reason` names which).
`invalid_declaration`	422	Invalid declaration parameters.
`other_keys_active`	409	The e-imzo.uz cabinet lists other active keys; `others` lists them (`serial_hex`, `valid_to`, `dest`, `key_type`) for the owner to choose which to suspend (ADR-0063, `suspend_serials`, panel session within the re-authentication window only).
`cabinet_suspend_failed`	502	The cabinet refused a suspension the owner asked for; the check stays violated, `others` lists the keys still active.
`cabinet_unavailable`	502	The e-imzo.uz cabinet did not answer.
`cabinet_busy`	503	Too many cabinet checks at once.
`cabinet_identity_mismatch`	409	The cabinet's person or key does not match the certificate.
`member_exists`	409	Already a member.
`member_not_found`	404	No such member.
`person_not_attested`	409	No attested account with this JSHSHIR.
`owner_protected`	409	The director's membership does not change.
`already_revoked`	409	The grant is already revoked.
`duplicate_act`	409	The same act already exists.
`invalid_pinfl`	422	A JSHSHIR is 14 digits.
`demo_readonly`	403	Demo session: this action is not performed.
`demo_unavailable`	404	No demo on this server.
`channel_unavailable`	409	The notification channel is not configured.
`identity_unconfirmed`	403	The person's identity is not confirmed yet (pfx registration).
`channel_send_failed`	502	The notification was not sent.
`link_code_invalid`	422	Wrong or expired link code.
`registration_not_attested`	409	Get the ERI at e-imzo.uz first.
`terms_not_accepted`	422	The current offer and privacy policy must be accepted.
`registration_closed`	403	Registration is open to pilot participants only.
`invite_invalid`	403	The invitation code is wrong, used or expired.
`operator_required`	403	Platform operators only.
`invitation_not_found`	404	No such invitation.
`invitation_used`	409	The invitation was used.
`invitation_revoked`	409	The invitation was revoked.
`invalid_note`	422	Say whom the invitation is for.
`invalid_days`	422	1 to 90 days.
`service_account_not_found`	404	No such service account (or not the caller's).
`service_account_disabled`	409	The service account is disabled.
`service_account_limit`	409	At most ten active service accounts per person.
`invalid_name`	422	A name of 1–120 characters.
`service_owner_not_attested`	409	The service account's responsible person is not attested; no act can name it.
`registration_not_pending`	409	The registration is finished or abandoned.
`totp_attempts_exceeded`	409	Five wrong codes: the registration was abandoned.
`weak_password`	422	At least ten characters.
`password_unchanged`	422	The new password equals the current one.
`key_limit`	409	One key during registration.
`request_not_found`	404	No such grant request.
`request_not_pending`	409	The grant request is decided or expired.
`requester_not_attested`	409	Asking for a right needs an attested account.
`request_exists`	409	A request for this key is already pending.
`self_request`	422	The owner signs with their own key without an act.
`reason_required`	422	A rejection needs a reason (three characters or more).
`organization_exists`	409	A company with this STIR exists under another director.
`company_key_exists`	409	The company already has an active key.
`identity_taken`	409	An account with this JSHSHIR exists.
`activation_refused`	409	The activation signature was refused.
`not_implemented`	501	The flow is not recorded yet.

Foydalanuvchi koʼradigan matn

Har kod bilan server yuboradigan oʼzbekcha gap (message_uz). Jadval server kodidan yasaladi, shuning uchun har doim u bilan bir xil.

Kod	HTTP	Matn
`activation_refused`	409	Aktivatsiya imzosi rad etildi: muddat, takror yoki shakl
`already_registered`	409	Bu JSHSHIR bilan akkaunt bor. Kiring
`already_revoked`	409	Huquq allaqachon chaqirib olingan
`auth_failed`	401	JSHSHIR, parol yoki kod notoʼgʼri
`cabinet_busy`	503	Hozir koʼp tekshiruv ketmoqda. Bir daqiqadan keyin qayta urinib koʼring
`cabinet_identity_mismatch`	409	Kabinetdagi shaxs yoki kalit sertifikatga mos kelmadi
`cabinet_suspend_failed`	502	Kabinetdagi kalitni toʼxtatib boʼlmadi. Uni kabinetda oʼzingiz toʼxtating, keyin qayta tekshiring
`cabinet_unavailable`	502	ERI kabineti bilan aloqa yoʼq. Keyinroq qayta urinib koʼring
`cert_key_mismatch`	409	Sertifikatdagi ochiq kalit seyfdagi kalitga mos emas
`cert_untrusted`	409	Sertifikatni bergan markaz tanilmadi yoki sertifikat haqiqiy emas
`certificate_no_pinfl`	409	Kalit sertifikatida JSHSHIR yoʼq. Huquq berish uchun u kerak
`channel_send_failed`	502	Xabar yuborilmadi. Keyinroq qayta urinib koʼring
`channel_unavailable`	409	Bu kanal serverda sozlanmagan
`cms_invalid`	422	Imzo fayli (PKCS#7) oʼqilmadi
`cms_not_attached`	422	Imzo faylida hujjat yoʼq (detached). Qoʼshib imzolab boʼlmaydi
`company_key_exists`	409	Tashkilotning faol kaliti bor. Ikkinchi kalit berilmaydi
`confirmation_required`	409	Imzodan oldin tasdiq kerak. Muhrdor oynasida koʼring
`demo_readonly`	403	Demo: bu amal namoyishda bajarilmaydi. Oʼz akkauntingizni oching
`demo_unavailable`	404	Demo bu serverda ochilmagan
`document_too_large`	422	Hujjat juda katta: bitta soʼrovda jami 5 MB gacha
`duplicate_act`	409	Aynan shunday huquq allaqachon berilgan
`forbidden`	403	Bu amal uchun ruxsat yoʼq
`grantee_not_attested`	409	Huquq oluvchi avval oʼz ERIsini Muhrdorda olsin
`grantee_not_found`	404	Bu JSHSHIR boʼyicha akkaunt yoʼq
`idempotency_key_required`	422	Har imzolash soʼrovida Idempotency-Key kerak
`idempotency_mismatch`	422	Bu Idempotency-Key boshqa soʼrov uchun ishlatilgan
`identity_taken`	409	Bu JSHSHIR bilan akkaunt bor. Kiring
`identity_unconfirmed`	403	Shaxsingiz hali tasdiqlanmagan (fayl bilan roʼyxat). Huquq berish, aʼzo qoʼshish va tashkilot ochish tasdiqdan keyin ochiladi
`import_not_allowed`	403	Import faqat «Nazorat» darajasida
`internal`	500	Ichki xatolik. Qayta urinib koʼring
`invalid_client`	401	client_id yoki sir notoʼgʼri
`invalid_days`	422	Muddat 1 dan 90 kungacha
`invalid_declaration`	422	Bayonot parametrlari notoʼgʼri
`invalid_grant`	422	Huquq parametrlari notoʼgʼri
`invalid_name`	422	Nomini yozing (120 belgigacha)
`invalid_note`	422	Kim uchun ekanini yozing
`invalid_pinfl`	422	JSHSHIRni 14 raqamda kiriting
`invalid_request`	422	Soʼrov notoʼgʼri
`invalid_site`	422	Sayt nomini manzil koʼrinishida kiriting (masalan: sayt.uz)
`invitation_not_found`	404	Taklif topilmadi
`invitation_revoked`	409	Taklif allaqachon bekor qilingan
`invitation_used`	409	Taklif allaqachon ishlatilgan. Bekor qilib boʼlmaydi
`invite_invalid`	403	Taklif kodi notoʼgʼri, ishlatilgan yoki muddati oʼtgan
`key_already_bound`	409	Kalitga sertifikat allaqachon bogʼlangan
`key_already_imported`	409	Bu kalit allaqachon bor
`key_limit`	409	Roʼyxatdan oʼtish davomida faqat bitta kalit yaratiladi
`key_not_active`	409	Kalit faol emas: sertifikat bogʼlanmagan yoki kalit oʼchirilgan
`key_not_awaiting_cert`	409	Kalit sertifikat kutish holatida emas
`key_not_live`	409	Kalit allaqachon oʼchirilgan
`key_owner_mismatch`	409	Kalit egasi jurnaldagi yozuvga mos kelmaydi
`key_unavailable`	409	Kalit seyfda yoʼq: baza tiklangan, kalit esa tiklanmagan boʼlishi mumkin. Texnik yordamga xabar bering yoki yangi ERI oling
`link_code_invalid`	422	Kod notoʼgʼri yoki muddati oʼtgan
`locked`	423	Panel qulflangan: PINni kiriting
`member_exists`	409	Bu shaxs allaqachon aʼzo
`member_not_found`	404	Bunday aʼzo yoʼq
`no_certificate`	409	Kalitga sertifikat bogʼlanmagan
`not_found`	404	Topilmadi
`not_grant_owner`	403	Buni faqat kalit egasi qiladi (chaqirib olishni tashkilot admini ham)
`not_implemented`	501	Bu amal hali ishlamaydi
`operator_required`	403	Bu amal faqat platforma operatori uchun (panel sessiyasi bilan)
`organization_exists`	409	Bu STIR bilan tashkilot allaqachon roʼyxatda (boshqa rahbar)
`other_keys_active`	409	ERI kabinetida boshqa faol ERI bor. Panelda Muhrdor toʼxtatishi mumkin yoki kabinetda oʼzingiz toʼxtating, keyin qayta tekshiring
`owner_mismatch`	409	Sertifikat egasi (STIR/JSHSHIR) foydalanuvchiga mos emas
`owner_protected`	409	Rahbar aʼzoligi oʼzgartirilmaydi
`passkey_challenge_expired`	409	Passkey soʼrovi muddati oʼtdi. Qayta urinib koʼring
`passkey_challenge_invalid`	422	Passkey soʼrovi notoʼgʼri. Qayta urinib koʼring
`passkey_exists`	409	Bu passkey allaqachon roʼyxatga olingan
`passkey_invalid`	422	Passkey javobi tekshiruvdan oʼtmadi
`passkey_limit`	409	Koʼpi bilan 5 ta passkey
`passkey_not_found`	404	Passkey topilmadi
`passkey_not_set`	409	Bu akkauntda passkey yoʼq
`passkey_wrong`	401	Passkey bilan ochish rad etildi
`passkeys_disabled`	409	Passkey bu serverda yoqilmagan
`password_unchanged`	422	Yangi parol joriy parol bilan bir xil
`person_not_attested`	409	Bu JSHSHIR bilan tasdiqlangan akkaunt yoʼq. Shaxs avval oʼz ERIsi bilan roʼyxatdan oʼtsin
`pfx_invalid`	422	pfx fayli oʼqilmadi
`pfx_key_mismatch`	422	pfx kaliti sertifikatga mos emas
`pfx_no_certificate`	422	pfx da sertifikat yoʼq
`pfx_no_key`	422	pfx da kalit yoʼq
`pfx_no_leaf`	422	pfx da egasini koʼrsatuvchi sertifikat yoʼq
`pfx_not_personal`	422	pfx da shaxsiy sertifikat yoʼq
`pfx_password`	422	pfx paroli notoʼgʼri
`pfx_unsupported`	422	pfx formati qoʼllab-quvvatlanmaydi
`pin_invalid`	422	PINni 6–8 raqamda kiriting
`pin_not_set`	409	Avval PIN oʼrnating
`pin_weak`	422	PIN juda oddiy: ketma-ket yoki takror raqamlar, tugʼilgan sana boʼlmasin
`pin_wrong`	401	PIN notoʼgʼri
`policy_denied`	403	Imzolash rad etildi: huquq yoʼq
`reason_required`	422	Sababni yozing (kamida 3 belgi)
`reauth_required`	401	Parolni qayta tasdiqlang
`recovery_key_mismatch`	409	Bu fayl akkauntdagi kalitga mos kelmadi. Akkaunt ochilgan pfx faylni va uning parolini kiriting
`recovery_required`	403	Tiklash rejimi: avval autentifikatorni qayta ulang
`registration_closed`	403	Roʼyxat hozir faqat pilot ishtirokchilari uchun ochiq. Ariza: info@muhrdor.uz
`registration_not_attested`	409	Avval ERI oling. Sertifikat bogʼlangach roʼyxat davom etadi
`registration_not_pending`	409	Bu roʼyxat yakunlangan yoki bekor qilingan
`request_exists`	409	Bu kalit uchun soʼrovingiz allaqachon kutmoqda
`request_in_progress`	409	Xuddi shu soʼrov hali bajarilmoqda. Biroz kutib qayta soʼrang
`request_not_found`	404	Soʼrov topilmadi
`request_not_pending`	409	Soʼrov allaqachon koʼrib chiqilgan yoki muddati oʼtgan
`requester_not_attested`	409	Huquq soʼrash uchun oʼz ERIngiz bilan tasdiqlangan akkaunt kerak
`second_factor_required`	422	Autentifikator kodi yoki tiklash kodi kerak
`self_request`	422	Oʼz kalitingizga huquq kerak emas: egasi aktsiz imzolaydi
`service_account_disabled`	409	Xizmat akkaunti oʼchirilgan. Yangisini yarating
`service_account_limit`	409	Koʼpi bilan 10 ta faol xizmat akkaunti
`service_account_not_found`	404	Xizmat akkaunti topilmadi
`service_owner_not_attested`	409	Xizmat akkauntining masʼul shaxsi oʼz ERIsi bilan tasdiqlanmagan. Huquq berib boʼlmaydi
`signer_not_found`	422	Imzo faylida bu seriya raqamli imzolovchi yoʼq
`signing_failed`	502	Imzolab boʼlmadi
`terms_not_accepted`	422	Oferta va maxfiylik siyosatining joriy nusxasini qabul qiling
`too_many_requests`	429	Juda koʼp urinish. Keyinroq qayta urinib koʼring
`totp_attempts_exceeded`	409	Kod 5 marta notoʼgʼri kiritildi. Roʼyxat bekor qilindi, qaytadan boshlang
`totp_reset_expired`	409	Qayta ulash muddati oʼtdi; qaytadan boshlang
`totp_reset_invalid`	422	Qayta ulash kodi notoʼgʼri
`totp_wrong`	401	Autentifikator kodi notoʼgʼri
`trusted_site_limit`	409	Ishonilgan saytlar soni chegarada
`unauthorized`	401	Kirish kerak
`unknown_key`	404	Kalit topilmadi
`weak_password`	422	Parol kamida 10 belgidan iborat boʼlsin

API — error catalogue

Codes an integrator meets

Policy refusals (policy_denied → reason)

Codes of the person's API (panel, extension, agent)

Foydalanuvchi koʼradigan matn

Policy refusals (`policy_denied` → `reason`)