Error codes
Responses carry a stable code. Git clients may only display the HTTP status — check the broker logs or audit record for details.
Policy & approvals
| Status | Code | Meaning |
|---|---|---|
| 403 | DENIED | A rule denied the action, or nothing matched |
| 403 | REQUIRE_APPROVAL | Held for review; approve on the host and retry |
| 403 | PUSH_OPTION_DENIED | Push option not in allowedPushOptions |
| 403 | SELF_APPROVAL | Reviewer is the delegating human |
| 403 | REVIEWER_SOURCE_NOT_ALLOWED | Rule doesn't accept this reviewer source |
| 403 | REVIEWER_SOURCE_UNVERIFIED | oidc: review without a valid signature |
| 409 | APPROVAL_SUPERSEDED | Policy reloaded; retry to create a new request |
| 429 | TOO_MANY_PENDING | Pending approval cap reached |
Content scanning
| Status | Code | Meaning |
|---|---|---|
| 403 | CONTENT_BLOCKED | Secret, blocked path, or oversized blob found |
| 403 | UNSCANNABLE_OBJECT | Pack carries objects no pushed ref reaches |
| 503 | SCAN_UNAVAILABLE | No mirror available; fails closed |
Pull requests
| Status | Code | Meaning |
|---|---|---|
| 409 | PR_NOT_MERGEABLE | Closed or draft PR |
| 409 | HEAD_MOVED | Head no longer matches the reviewed SHA |
| 409 | BASE_CHANGED | Base branch changed before merge |
| 404 | NOT_A_PULL_REQUEST | Target number is an issue |
Authentication & limits
| Status | Code | Meaning |
|---|---|---|
| 401 | UNAUTHENTICATED | Missing or wrong bearer token |
| 401 | ASSERTION_INVALID | Runtime assertion failed verification |
| 403 | CLIENT_NOT_ALLOWED | Browser origin or unexpected Host |
| 413 | BODY_TOO_LARGE | Request over the size limit |
| 429 | RATE_LIMITED | Per-client rate limit; honor retry-after |
| 503 | BUSY | Concurrency limit reached |
| 503 | DISK_LOW | State volume under 256 MiB free |
Fleet
| Status | Code | Meaning |
|---|---|---|
| 503 | POLICY_EXPIRED | Bundle past expiresAt with no newer one |
| 503 | REVOCATIONS_EXPIRED | Revocation list expired in assertion mode |
Git LFS
| Status | Code | Meaning |
|---|---|---|
| 502 | LFS_UNTRUSTED_HOST | Storage host not in AGENTGATE_LFS_HOSTS |
| 400 | LFS_HASH_MISMATCH | Transferred bytes didn't match the oid |
| 503 | LFS_BUSY | Transfer pool full |