Authentication Service Errors

The Agentforce authentication service manages org provisioning and the credentials that allow Agentforce and Einstein AI features to operate. Errors from this service typically indicate that an org couldn’t be provisioned, that authentication credentials couldn’t be validated, or that a platform dependency the service relies on was temporarily unavailable.

The API key you provided was rejected. Agentforce couldn’t authenticate your request because the key is incorrect, has been revoked, or was issued for a different service.

This error occurs when:

• The API key is mistyped, truncated, or includes extra whitespace.
• The API key has been revoked or rotated.
• The key was issued for a different service or environment.

To resolve this error:

1. Confirm the API key is correct and copied without modifications.
2. Rotate or re-issue the API key if it’s been revoked.
3. Verify the key is valid for the service and environment you’re using.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: API_KEY_AUTHENTICATION_FAILED
• A description of what you were trying to do when the error occurred

The platform couldn’t complete an internal trust operation because a dependency is temporarily unavailable. This is usually a temporary issue — wait a moment and try again.

This error occurs when:

• A platform dependency is temporarily unavailable or undergoing maintenance.
• A temporary network issue is preventing the platform from reaching the dependency.
• The dependency is reducing capacity under high load.

To resolve this error:

1. Wait at least 30 seconds and try again — this is a temporary error that usually clears on its own.
2. If the error persists after several retries, check trust.salesforce.com for known incidents.
3. If you’re sending a high volume of requests, reduce the number of concurrent requests.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: C2C_GRANT_TRUST_FAILED
• A description of what you were trying to do when the error occurred

The platform couldn’t validate an internal service credential for this request. This is a platform-level credential issue, not a problem with your request.

This error occurs when:

• An internal service credential has expired or is no longer trusted.
• A required credential field is missing or contains an invalid value.
• An internal signing key was updated but hasn’t propagated across all platform services.

To resolve this error:

1. Check trust.salesforce.com for known incidents that might explain a platform-wide credential failure.
2. If this error started after a recent Agentforce configuration change, contact Salesforce Customer Support.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: C2C_JWT_VALIDATION_FAILED
• A description of what you were trying to do when the error occurred

The platform couldn’t complete an internal trust operation because a dependency is temporarily unavailable. This is usually a temporary issue — wait a moment and try again.

This error occurs when:

• A platform dependency is temporarily unavailable or undergoing maintenance.
• A temporary network issue is preventing the platform from reaching the dependency.
• The dependency is reducing capacity under high load.

To resolve this error:

1. Wait at least 30 seconds and try again — this is a temporary error that usually clears on its own.
2. If the error persists after several retries, check trust.salesforce.com for known incidents.
3. If you’re sending a high volume of requests, reduce the number of concurrent requests.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: C2C_REVOKE_TRUST_FAILED
• A description of what you were trying to do when the error occurred

The platform couldn’t complete org provisioning because an internal dependency is temporarily unavailable. This is distinct from a provisioning failure caused by a business rule conflict — it indicates that a platform service the provisioning workflow depends on couldn’t be reached. This is usually a temporary issue.

This error occurs when:

• A platform dependency is temporarily unavailable or undergoing maintenance.
• A temporary network issue is preventing the platform from completing the provisioning workflow.
• The dependency is reducing capacity under high load.

To resolve this error:

1. Wait at least 30 seconds and try again — this is a temporary error that usually clears on its own.
2. If the error persists after several retries, check trust.salesforce.com for known incidents.
3. If you’re sending a high volume of requests, reduce the number of concurrent requests.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: C2C_TENANT_CREATE_FAILED
• A description of what you were trying to do when the error occurred

The Data Cloud application name in the request doesn’t match the application name in the credential being used. The authentication service can’t process the request because the application context is inconsistent.

This error occurs when:

• The request references a different Data Cloud application than the credential was issued for.
• The credential was issued for the wrong Data Cloud app.
• A client configuration uses a hard-coded or stale application name.

To resolve this error:

1. Confirm the Data Cloud application name in the request matches the credential’s app context.
2. Re-issue or rotate the credential if it was issued for the wrong application.
3. Review your client configuration for hard-coded or stale application names.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: D360_APP_NAME_MISMATCH
• A description of what you were trying to do when the error occurred

Your org doesn’t exist in Data Cloud. The authentication service can’t complete the request until the org is provisioned in Data Cloud.

This error occurs when:

• The org hasn’t been onboarded to Data Cloud.
• The org identifier is mistyped or refers to a different environment.
• The Data Cloud record was removed or hasn’t yet replicated to this region.

To resolve this error:

1. Verify the org has been provisioned in Data Cloud for this environment.
2. Confirm the org identifier matches the Data Cloud record exactly.
3. If the org should exist but can’t be found, contact your Salesforce admin to verify provisioning.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: D360_TENANT_NOT_FOUND
• A description of what you were trying to do when the error occurred

The platform’s integration layer is temporarily unavailable. The authentication service can’t complete the request until it recovers. This is usually a temporary issue — wait a moment and try again.

This error occurs when:

• The platform’s integration layer is temporarily unavailable or undergoing maintenance.
• A temporary network issue is preventing the authentication service from reaching it.
• The integration layer is reducing capacity under high load.

To resolve this error:

1. Wait at least 30 seconds and try again — this is a temporary error that usually clears on its own.
2. If the error persists after several retries, check trust.salesforce.com for known incidents.
3. If you’re sending a high volume of requests, reduce the number of concurrent requests.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: EAI_SERVICE_UNAVAILABLE
• A description of what you were trying to do when the error occurred

The feature you’re trying to use isn’t recognized by the authentication service. The request can’t proceed until the feature name is correct and the feature is enabled for your org.

This error occurs when:

• The feature name is mistyped or uses an outdated identifier.
• The feature hasn’t been enabled for this environment or org.
• The request was sent to the wrong region or environment.

To resolve this error:

1. Verify the feature name matches the name registered with the authentication service.
2. Confirm the feature is enabled in the target environment.
3. If the feature should be registered, contact your Salesforce admin to verify the configuration.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: FEATURE_NOT_FOUND
• A description of what you were trying to do when the error occurred

The platform’s identity directory is temporarily unavailable. The authentication service can’t resolve the lookup until it recovers. This is usually a temporary issue — wait a moment and try again.

This error occurs when:

• The platform’s identity directory is temporarily unavailable or undergoing maintenance.
• A temporary network issue is preventing the authentication service from reaching it.
• The identity directory is reducing capacity under high load.

To resolve this error:

1. Wait at least 30 seconds and try again — this is a temporary error that usually clears on its own.
2. If the error persists after several retries, check trust.salesforce.com for known incidents.
3. If you’re sending a high volume of requests, reduce the number of concurrent requests.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: GDOT_SERVICE_UNAVAILABLE
• A description of what you were trying to do when the error occurred

The access token you provided isn’t valid. It may have expired, been revoked by an administrator, or been issued for a different service.

This error occurs when:

• The token has expired.
• The token was revoked or invalidated by an administrator.
• The token was issued for a different audience or environment.

To resolve this error:

1. Refresh the access token using your refresh credential.
2. Confirm the token’s audience matches the service you’re calling.
3. Re-authenticate if refresh fails or the token has been revoked.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_ACCESS_TOKEN
• A description of what you were trying to do when the error occurred

The authentication context attached to the request isn’t valid for this operation. The platform can’t authorize the call without a correct authentication context.

This error occurs when:

• The context is missing required fields.
• The context references an org, identity, or scope that doesn’t match the credential.
• The context was built from stale data after an org or identity change.

To resolve this error:

1. Refresh the authentication context from the source of truth.
2. Confirm the context’s org, identity, and scope match the credential being used.
3. Verify all required context fields are populated.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_AUTH_CONTEXT
• A description of what you were trying to do when the error occurred

The platform couldn’t establish a trusted identity for this request. The internal service context is invalid or incomplete. This is a platform configuration issue, not a problem with your request.

This error occurs when:

• An internal service identity is missing required fields.
• The service identity isn’t configured for internal platform communication.
• The service context didn’t originate from a trusted source.

To resolve this error:

1. Check trust.salesforce.com for known incidents.
2. If this error started after a recent configuration change, contact Salesforce Customer Support.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_C2C_SERVICE_CONTEXT
• A description of what you were trying to do when the error occurred

A required credential claim is missing or contains an invalid value. The authentication service can’t process the request until the credential is corrected.

This error occurs when:

• A required claim was omitted from the credential.
• A claim value doesn’t match the expected format — for example, a malformed timestamp or audience.
• The claim is set to a value the authentication service doesn’t recognize.

To resolve this error:

1. Inspect the credential to identify the missing or invalid claim.
2. Configure the issuer to populate the required claim correctly.
3. Re-issue the credential after the issuer is updated.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_CLAIM
• The name of the claim that’s missing or invalid, if shown in the error detail

The platform couldn’t complete an internal service handshake because a credential key is invalid or expired. The key needs to be rotated or refreshed before the request can succeed.

This error occurs when:

• The credential key has expired and needs to be rotated.
• The key value was truncated or copied incorrectly.
• The key was issued for a different environment or service.

To resolve this error:

1. If you manage the credential key, rotate or refresh it.
2. Confirm the key value is transmitted exactly as issued.
3. Verify the key was issued for the correct environment and service.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_CLOUD_KEY
• A description of what you were trying to do when the error occurred

The platform’s integration layer rejected the credential assertion for this request. The authentication service couldn’t verify it against the configured trust chain.

This error occurs when:

• The assertion’s signature doesn’t verify against the issuer’s keys.
• A required claim is missing or contains an invalid value.
• The assertion has expired or hasn’t yet become valid.

To resolve this error:

1. Confirm all required claims are present and correctly populated in the assertion.
2. Verify the issuer’s signing keys are current in the authentication service’s configuration.
3. If the assertion consistently fails, contact Salesforce Customer Support.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_EAI_JWT_ASSERTION
• A description of what you were trying to do when the error occurred

The authentication grant type in the request isn’t valid or isn’t supported for this client. The request can’t proceed until the correct grant type is used.

This error occurs when:

• The grant_type value is mistyped — for example, client_creds instead of client_credentials.
• The client isn’t configured to use the requested grant type.
• The grant type was deprecated and is no longer accepted.

To resolve this error:

1. Verify the grant_type value matches a supported grant type.
2. Confirm the client is configured to use the requested grant type.
3. If the grant type you’re using is deprecated, update to a supported one.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_GRANT_TYPE
• The grant_type value in the request

The request failed validation because one or more parameters are missing, malformed, or out of range. Correct the parameters and try again.

This error occurs when:

• A required parameter was omitted.
• A parameter value doesn’t match the expected type or format.
• A parameter is outside its permitted range or set of allowed values.

To resolve this error:

1. Review the API documentation for the endpoint to confirm parameter requirements.
2. Validate parameter values before sending the request.
3. Re-send the request with corrected parameter values.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_PARAMETER
• The parameter name and value that caused the failure, if shown in the error detail

The identity supplied with the request didn’t pass validation. It may be missing required attributes or be in an incompatible format for this operation.

This error occurs when:

• A required identity attribute is missing.
• The identity identifier doesn’t match the expected format.
• The identity is incompatible with the operation being requested.

To resolve this error:

1. Verify all required identity attributes are populated.
2. Confirm the identity identifier matches the expected format.
3. Re-resolve the identity from the source of truth before retrying.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_PRINCIPAL
• A description of what you were trying to do when the error occurred

The credential or token doesn’t include permission to access the requested resource. The request was rejected because the required scope isn’t granted.

This error occurs when:

• The token was issued without the scope needed for the resource.
• The caller’s role no longer grants the required scope.
• The resource was moved into a more restricted scope.

To resolve this error:

1. Re-issue the token with the required scope grant.
2. Confirm the caller’s role still grants access to the resource.
3. If access should be permitted, ask your Salesforce admin to update the scope.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_RESOURCE_SCOPE_ACCESS
• The resource or scope the request was targeting

The service identity doesn’t have permission to access the requested resource. The request was rejected because the identity isn’t registered for access.

This error occurs when:

• The service identity isn’t registered for access to the resource.
• The identity in the credential doesn’t match what the resource expects.
• The resource’s allowed identities don’t include the calling service.

To resolve this error:

1. Confirm the service identity is registered for access to the requested resource.
2. Verify the credential’s identity value matches what this request expects.
3. If access should be permitted, ask your Salesforce admin to grant it.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_SERVICE_OU
• A description of what you were trying to do when the error occurred

The subject in the credential doesn’t refer to a valid identity. The authentication service rejected the request because the subject is missing, malformed, or incompatible with the operation.

This error occurs when:

• The subject doesn’t refer to a known identity.
• The subject identifier is malformed.
• The subject is incompatible with the requested operation.

To resolve this error:

1. Verify the subject identifier resolves to an active identity.
2. Confirm the subject identifier matches the expected format.
3. If the original subject was wrong, re-issue the credential with the correct one.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_SUBJECT
• A description of what you were trying to do when the error occurred

The subject type in the credential isn’t recognized or isn’t supported for this operation. Re-issue the credential with a supported subject type.

This error occurs when:

• The subject type value is mistyped or uses a deprecated identifier.
• The subject type isn’t supported by the authentication service for the requested operation.
• The credential’s subject type doesn’t match what the operation expects.

To resolve this error:

1. Confirm the subject type matches a value supported by the authentication service.
2. If the current subject type is deprecated, update the issuer to emit a supported one.
3. Re-issue the credential with the correct subject type.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_SUBJECT_TYPE
• A description of what you were trying to do when the error occurred

The credential key for your org is invalid or expired. The authentication service can’t complete the request until a valid key is in place.

This error occurs when:

• The credential key has expired and needs to be rotated.
• The key value was truncated or copied incorrectly.
• The key was issued for a different org or environment.

To resolve this error:

1. Rotate or refresh the credential key for your org.
2. Confirm the key value matches the issuer’s record exactly.
3. Verify the key was issued for the correct org and environment.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_TENANT_KEY
• A description of what you were trying to do when the error occurred

Your org is in a state that doesn’t allow this operation. It may still be provisioning, suspended, or deactivated.

This error occurs when:

• The org is still being provisioned and isn’t yet active.
• The org has been suspended or deactivated.
• The org is in a recovery or migration window.

To resolve this error:

1. Wait until the org reaches an active state and try again.
2. If the org should be active but isn’t, contact your Salesforce admin.
3. If the org is deactivated, the operation can’t be completed without reactivation.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: INVALID_TENANT_STATUS
• A description of what you were trying to do when the error occurred

This error code indicates an unexpected system error and not an issue with your configuration. If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: JWT_KEY_MANAGEMENT_FAILED
• Any context that might help with the investigation, such as when the error occurred, what you or your end user were doing at the time, and whether you’re able to reproduce it

The credential presented with the request didn’t pass validation. It may be expired, malformed, or signed by an issuer the authentication service doesn’t recognize.

This error occurs when:

• The credential has expired.
• The signature doesn’t verify against the issuer’s published keys.
• A required claim — such as issuer, audience, or subject — is missing or incorrect.
• The credential was tampered with in transit.

To resolve this error:

1. Re-issue the credential from the trusted issuer.
2. Confirm the signing key is published to the authentication service’s trust configuration.
3. Verify required claims are present and correctly populated.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: JWT_VALIDATION_FAILED
• A description of what you were trying to do when the error occurred

One or more required Data Cloud headers are missing from the request. The authentication service can’t determine the correct routing context without them.

This error occurs when:

• The request didn’t include all required Data Cloud headers.
• A proxy or gateway stripped headers in transit.
• The client is an older version that doesn’t send Data Cloud routing headers.

To resolve this error:

1. Confirm all required Data Cloud headers are included in the request.
2. Check any intermediaries — such as load balancers or proxies — for header stripping.
3. Update the client to a version that supports Data Cloud routing.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: MISSING_D360_HEADERS
• A description of what you were trying to do when the error occurred

The identity referenced in the request doesn’t exist in the authentication service. It may have been deleted, or the identifier may be incorrect.

This error occurs when:

• The identity identifier is mistyped or refers to a deleted record.
• The identity exists in a different org or environment.
• A directory sync delay is preventing the identity from being visible.

To resolve this error:

1. Verify the identity identifier is correct and resolves to an active record.
2. Confirm you’re using the correct org and environment.
3. Wait briefly and try again if a directory sync delay is suspected.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: PRINCIPAL_NOT_FOUND
• A description of what you were trying to do when the error occurred

The authentication service couldn’t reach its session management layer. This is a temporary platform-side issue — wait a moment and try again.

This error occurs when:

• The session management layer is undergoing maintenance or failover.
• A temporary network issue is preventing the authentication service from reaching it.
• The session management layer is reducing capacity under high load.

To resolve this error:

1. Wait at least 30 seconds and try again — this is a temporary error that usually clears on its own.
2. If the error persists after several retries, check trust.salesforce.com for known incidents.
3. If you’re sending a high volume of requests, reduce the number of concurrent requests.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: REDIS_CONNECTION_FAILURE
• A description of what you were trying to do when the error occurred

The authentication service couldn’t find a required session entry. The session may have expired, been cleared, or was never created.

This error occurs when:

• The session entry has expired and hasn’t been repopulated.
• The session was cleared under memory pressure.
• The session entry was never created for this org or user.

To resolve this error:

1. Re-authenticate or restart the workflow to re-establish the session.
2. If the session entry should always exist, contact your Salesforce admin to verify the configuration.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: REDIS_KEY_NOT_FOUND
• A description of what you were trying to do when the error occurred

Your identity was confirmed, but you don’t have permission to perform this operation. The request was rejected because the required role or scope isn’t granted.

This error occurs when:

• The caller’s role doesn’t grant permission for the operation.
• The credential is missing a required scope or claim.
• The targeted resource is restricted to a different set of callers.

To resolve this error:

1. Verify the caller has the role or scope required for the operation.
2. Re-issue the credential with the required permissions.
3. Contact your Salesforce admin if you believe access should be granted.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: REQUEST_UNAUTHORIZED
• A description of what you were trying to do when the error occurred

Service-level authentication failed. The platform couldn’t verify the calling service’s credential. The credential needs to be refreshed or re-issued before the request can succeed.

This error occurs when:

• The service credential has expired or been revoked.
• The credential was issued for a different service identity.
• A credential rotation hasn’t been applied to all instances of the calling service.

To resolve this error:

1. Refresh or re-issue the calling service’s credential.
2. Confirm the credential identifies the correct service.
3. Verify the credential rotation has been deployed to all instances of the caller.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: SERVICE_AUTHENTICATION_FAILED
• A description of what you were trying to do when the error occurred

The authentication token service policy for this request is invalid. It may contain duplicate entries or reference an action or resource that doesn’t exist. The authentication service can’t evaluate the policy as supplied.

This error occurs when:

• The policy contains duplicate statements or identity entries.
• A policy statement references an unknown action or resource.
• The policy structure doesn’t match the expected format.

To resolve this error:

1. Remove any duplicate entries from the policy.
2. Review the policy structure for errors and correct them.
3. Confirm all referenced actions and resources exist and are valid.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: STS_POLICY_INVALID
• A description of what you were trying to do when the error occurred

An org with this identifier already exists. The authentication service rejected the request to prevent creating a duplicate.

This error occurs when:

• A previous provisioning request succeeded but the client retried after a timeout.
• A different process already provisioned the org.
• The org identifier is being reused for a new org.

To resolve this error:

1. Check whether the org already exists before retrying provisioning.
2. If a duplicate request is suspected, treat the earlier provisioning as successful.
3. If you need a new org, use a unique identifier.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: TENANT_ALREADY_EXISTS
• A description of what you were trying to do when the error occurred

The authentication service couldn’t authenticate the request against your org. The credential may be expired, revoked, or issued for a different org.

This error occurs when:

• The credential is expired, revoked, or was issued for a different org.
• A required org-specific claim is missing or has the wrong value.
• The credential signing key is no longer trusted by the org.

To resolve this error:

1. Refresh or re-issue the credential for the target org.
2. Confirm the credential’s claims match the org’s expected issuer and audience.
3. Verify the signing key is current in the org’s trust configuration.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: TENANT_AUTHENTICATION_FAILED
• A description of what you were trying to do when the error occurred

The authentication service couldn’t complete org provisioning. A validation check or uniqueness rule rejected the request.

This error occurs when:

• An org with the same identifier already exists.
• Required org attributes are missing or fail validation.
• The org configuration violates a business rule — for example, conflicting environment or feature settings.

To resolve this error:

1. Confirm the org doesn’t already exist before retrying provisioning.
2. Verify all required org attributes are supplied and valid.
3. If validation continues to fail, contact your Salesforce admin to review configuration constraints.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: TENANT_CREATE_FAILED
• A description of what you were trying to do when the error occurred

The authentication service couldn’t complete org deletion. The org may still have active resources attached, or it may be in a state that doesn’t allow deletion.

This error occurs when:

• The org still has active feature registrations, identities, or keys attached.
• The org is in a state — such as provisioning — that doesn’t allow deletion.
• A downstream system rejected the delete request.

To resolve this error:

1. Remove or deprovision any attached resources before retrying deletion.
2. Confirm the org is in a state that allows deletion — not in provisioning or recovery.
3. If the org appears clean but deletion is still failing, contact Salesforce Customer Support.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: TENANT_DELETE_FAILED
• A description of what you were trying to do when the error occurred

The authentication service couldn’t find a required credential key for your org. The key may not have been provisioned, or it may have been rotated without a replacement being registered.

This error occurs when:

• The org was provisioned without its credential keys being installed.
• The key was rotated or deleted without a replacement being registered.
• A key store sync delay is preventing the key from being visible.

To resolve this error:

1. Confirm the org has its credential keys provisioned in the authentication service.
2. Re-register the key if it was recently rotated.
3. Wait briefly and try again if a sync delay is suspected.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: TENANT_KEY_NOT_FOUND
• A description of what you were trying to do when the error occurred

The org identifier in the request doesn’t match a known org. It may be mistyped, not yet provisioned, or the request may have been sent to the wrong environment.

This error occurs when:

• The org ID is mistyped or refers to an org that hasn’t been provisioned.
• The org was deleted or isn’t yet active.
• The request was sent to the wrong environment — for example, a sandbox org ID against a production endpoint.

To resolve this error:

1. Verify the org identifier matches a provisioned org in the target environment.
2. Confirm the org has been onboarded and is in an active state.
3. If the org should exist, contact your Salesforce admin to verify provisioning.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: TENANT_NOT_FOUND
• A description of what you were trying to do when the error occurred

Your org exists but hasn’t finished provisioning. The operation can’t complete until provisioning is done.

This error occurs when:

• Provisioning is still in progress and not all setup steps have completed.
• A provisioning step failed and wasn’t retried.
• The org requires manual approval that hasn’t occurred yet.

To resolve this error:

1. Wait for provisioning to complete and try again.
2. Check the provisioning workflow status with your Salesforce admin.
3. If provisioning has stalled, contact your Salesforce admin to re-run the failed step.

If the issue persists, contact Salesforce Customer Support with the following information.

• The trace ID from the error response (instance field, format urn:trace:...)
• The error code: TENANT_NOT_PROVISIONED
• A description of what you were trying to do when the error occurred

j

Get Started

Agentforce Examples

Agent Script

Agentforce DX

Agentforce APIs and SDKs

Agentforce Actions

Agentforce Service Errors

Language Detection Service Errors

Agent Service Reasoner Errors

Authentication Service Errors

Model Builder Errors

Interactive Data Science Service Errors

ML Lake Service Errors

Models and Prompts

Headless Agentforce Development