The Agentforce authentication service manages org provisioning and the credentials that allow Agentforce and Einstein AI features to operate. Errors from this service typically indicate that an org couldn’t be provisioned, that authentication credentials couldn’t be validated, or that a platform dependency the service relies on was temporarily unavailable.
ACCESS_DENIED
You don’t have permission to perform this operation. The request was rejected because the required role or scope isn’t granted.
This error occurs when:
The credential doesn’t include the permissions needed for this operation.
Your role was changed and no longer grants access to this resource.
The request targets a resource restricted to a different set of callers.
Required authorization scopes are missing from the credential.
How to Troubleshoot
To resolve this error:
Verify the credential includes the roles or scopes required for this operation.
If your role was changed recently, confirm the updated role still grants the required access.
Contact your Salesforce admin if you believe access should be permitted.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: ACCESS_DENIED
A description of the resource or operation you were trying to access
ACCESS_TOKEN_REQUEST_FAILED
The authentication service couldn’t obtain a required access token from a platform dependency. This is a temporary issue. Wait a moment and try again.
This error occurs when:
A platform dependency is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the service from reaching the token endpoint.
The dependency is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: ACCESS_TOKEN_REQUEST_FAILED
A description of what you were trying to do when the error occurred
API_KEY_AUTHENTICATION_FAILED
The API key you provided was rejected. Agentforce couldn’t authenticate your request because the key is incorrect, has been revoked, or was issued for a different service.
This error occurs when:
The API key is mistyped, truncated, or includes extra whitespace.
The API key has been revoked or rotated.
The key was issued for a different service or environment.
How to Troubleshoot
To resolve this error:
Confirm the API key is correct and copied without modifications.
Rotate or re-issue the API key if it’s been revoked.
Verify the key is valid for the service and environment you’re using.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: API_KEY_AUTHENTICATION_FAILED
A description of what you were trying to do when the error occurred
C2C_GRANT_TRUST_FAILED
The platform couldn’t complete an internal trust operation because a dependency is temporarily unavailable. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
A platform dependency is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the platform from reaching the dependency.
The dependency is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: C2C_GRANT_TRUST_FAILED
A description of what you were trying to do when the error occurred
C2C_JWT_VALIDATION_FAILED
The platform couldn’t validate an internal service credential for this request. This is a platform-level credential issue, not a problem with your request.
This error occurs when:
An internal service credential has expired or is no longer trusted.
A required credential field is missing or contains an invalid value.
An internal signing key was updated but hasn’t propagated across all platform services.
How to Troubleshoot
To resolve this error:
Check trust.salesforce.com for known incidents that might explain a platform-wide credential failure.
If this error started after a recent Agentforce configuration change, contact Salesforce Customer Support.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: C2C_JWT_VALIDATION_FAILED
A description of what you were trying to do when the error occurred
C2C_REVOKE_TRUST_FAILED
The platform couldn’t complete an internal trust operation because a dependency is temporarily unavailable. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
A platform dependency is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the platform from reaching the dependency.
The dependency is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: C2C_REVOKE_TRUST_FAILED
A description of what you were trying to do when the error occurred
C2C_TENANT_CREATE_FAILED
The platform couldn’t complete org provisioning because an internal dependency is temporarily unavailable. This is distinct from a provisioning failure caused by a business rule conflict. It indicates that a platform service the provisioning workflow depends on couldn’t be reached. This is usually a temporary issue.
This error occurs when:
A platform dependency is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the platform from completing the provisioning workflow.
The dependency is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: C2C_TENANT_CREATE_FAILED
A description of what you were trying to do when the error occurred
C2C_TENANT_NOT_FOUND
The cloud integration tenant referenced in this request doesn’t exist. The authentication service can’t complete the request until the correct tenant identifier is used.
This error occurs when:
The tenant identifier is mistyped or refers to a tenant that hasn’t been provisioned.
The tenant was deleted or deprovisioned before the request arrived.
The identifier belongs to a different environment (for example, sandbox versus production).
The tenant hasn’t been set up for internal cloud integration.
How to Troubleshoot
To resolve this error:
Verify the tenant identifier is correct and exists in the target environment.
Confirm the tenant hasn’t been deleted or deprovisioned.
If the tenant should exist, contact your Salesforce admin to verify provisioning.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: C2C_TENANT_NOT_FOUND
A description of what you were trying to do when the error occurred
D360_APP_NAME_MISMATCH
The Data 360 application name in the request doesn’t match the application name in the credential being used. The authentication service can’t process the request because the application context is inconsistent.
This error occurs when:
The request references a different Data 360 application than the credential was issued for.
The credential was issued for the wrong Data 360 app.
A client configuration uses a hard-coded or stale application name.
How to Troubleshoot
To resolve this error:
Confirm the Data 360 application name in the request matches the credential’s app context.
Re-issue or rotate the credential if it was issued for the wrong application.
Review your client configuration for hard-coded or stale application names.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: D360_APP_NAME_MISMATCH
A description of what you were trying to do when the error occurred
D360_GATEWAY_TIMEOUT
The authentication service’s request to Data 360 timed out. This is a temporary issue. Wait a moment and try again.
This error occurs when:
Data 360 is experiencing high load or slow response times.
A temporary network issue is causing latency between the authentication service and Data 360.
Data 360 is undergoing maintenance.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: D360_GATEWAY_TIMEOUT
A description of what you were trying to do when the error occurred
D360_SERVICE_UNAVAILABLE
Data 360 is temporarily unavailable. The authentication service can’t complete the request until it recovers. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
Data 360 is experiencing an outage or degraded performance.
A temporary network issue is preventing the authentication service from reaching Data 360.
Data 360 is undergoing maintenance.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: D360_SERVICE_UNAVAILABLE
A description of what you were trying to do when the error occurred
D360_TENANT_NOT_FOUND
Your org doesn’t exist in Data 360. The authentication service can’t complete the request until the org is provisioned in Data 360.
This error occurs when:
The org hasn’t been onboarded to Data 360.
The org identifier is mistyped or refers to a different environment.
The Data 360 record was removed or hasn’t yet replicated to this region.
How to Troubleshoot
To resolve this error:
Verify the org has been provisioned in Data 360 for this environment.
Confirm the org identifier matches the Data 360 record exactly.
If the org should exist but can’t be found, contact your Salesforce admin to verify provisioning.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: D360_TENANT_NOT_FOUND
A description of what you were trying to do when the error occurred
DATA_INTEGRITY_VIOLATION
The request would violate a data integrity constraint (for example, a uniqueness rule or a reference to a related record that doesn’t exist). The authentication service can’t complete the operation as submitted.
This error occurs when:
You’re trying to create a record with an identifier that already exists.
The request references a related record that doesn’t exist.
You’re trying to delete a record that still has dependent records attached.
How to Troubleshoot
To resolve this error:
Check whether a record with the same identifier already exists before retrying.
Confirm all referenced records exist before creating relationships between them.
Remove or reassign dependent records before attempting to delete a parent record.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: DATA_INTEGRITY_VIOLATION
A description of the operation you were attempting when the error occurred
DB_CONNECTION_FAILURE
The authentication service couldn’t connect to its database. This is a temporary infrastructure issue. Wait a moment and try again.
This error occurs when:
The database is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the service from reaching the database.
The database is recovering from a failover.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: DB_CONNECTION_FAILURE
A description of what you were trying to do when the error occurred
DB_QUERY_TIMEOUT
A database query took too long to complete. This is a temporary issue. Wait a moment and try again.
This error occurs when:
The database is under high load.
A query is taking longer than usual due to temporary resource contention.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: DB_QUERY_TIMEOUT
A description of what you were trying to do when the error occurred
EAI_SERVICE_UNAVAILABLE
The platform’s integration layer is temporarily unavailable. The authentication service can’t complete the request until it recovers. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
The platform’s integration layer is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the authentication service from reaching it.
The integration layer is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: EAI_SERVICE_UNAVAILABLE
A description of what you were trying to do when the error occurred
EAI_TOKEN_NOT_FOUND
The integration token referenced in this request doesn’t exist. It may have been deleted, expired, or the identifier may be incorrect.
This error occurs when:
The token identifier is mistyped or refers to a token that was already deleted.
The token has expired and was automatically removed.
You’re working in the wrong org or environment.
How to Troubleshoot
To resolve this error:
Verify the token identifier is correct.
Check whether the token has already been deleted or expired.
Confirm you’re working in the correct org and environment.
If the token is no longer available, create a new one.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: EAI_TOKEN_NOT_FOUND
A description of what you were trying to do when the error occurred
FEATURE_NOT_FOUND
The feature you’re trying to use isn’t recognized by the authentication service. The request can’t proceed until the feature name is correct and the feature is enabled for your org.
This error occurs when:
The feature name is mistyped or uses an outdated identifier.
The feature hasn’t been enabled for this environment or org.
The request was sent to the wrong region or environment.
How to Troubleshoot
To resolve this error:
Verify the feature name matches the name registered with the authentication service.
Confirm the feature is enabled in the target environment.
If the feature should be registered, contact your Salesforce admin to verify the configuration.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: FEATURE_NOT_FOUND
A description of what you were trying to do when the error occurred
GDOT_GATEWAY_TIMEOUT
The authentication service’s request to the platform’s identity directory timed out. This is a temporary issue. Wait a moment and try again.
This error occurs when:
The platform’s identity directory is experiencing high load or slow response times.
A temporary network issue is causing latency.
The identity directory is undergoing maintenance.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: GDOT_GATEWAY_TIMEOUT
A description of what you were trying to do when the error occurred
GDOT_SERVICE_UNAVAILABLE
The platform’s identity directory is temporarily unavailable. The authentication service can’t resolve the lookup until it recovers. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
The platform’s identity directory is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the authentication service from reaching it.
The identity directory is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: GDOT_SERVICE_UNAVAILABLE
A description of what you were trying to do when the error occurred
GRANT_TRUST_FAILED
The platform couldn’t establish a required trust relationship because a dependency is temporarily unavailable. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
A platform dependency is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the platform from reaching the dependency.
The dependency is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: GRANT_TRUST_FAILED
A description of what you were trying to do when the error occurred
INVALID_ACCESS_TOKEN
The access token you provided isn’t valid. It may have expired, been revoked by an administrator, or been issued for a different service.
This error occurs when:
The token has expired.
The token was revoked or invalidated by an administrator.
The token was issued for a different audience or environment.
How to Troubleshoot
To resolve this error:
Refresh the access token using your refresh credential.
Confirm the token’s audience matches the service you’re calling.
Re-authenticate if refresh fails or the token has been revoked.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_ACCESS_TOKEN
A description of what you were trying to do when the error occurred
INVALID_ALLOW_TO_USE
The credential contains an invalid allowToUse claim. The authentication service can’t verify which resources you’re permitted to access with this credential.
This error occurs when:
The allowToUse claim is present but contains an invalid value or format.
The claim references a service or resource that doesn’t exist or isn’t permitted.
The token was issued with an incorrect or outdated allow-list.
How to Troubleshoot
To resolve this error:
Inspect the credential for the allowToUse claim and verify the values are valid.
Confirm the values in the claim correspond to permitted services or resources.
Re-issue the credential with a correct allowToUse claim.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_ALLOW_TO_USE
A description of what you were trying to do when the error occurred
INVALID_ASSUME_ROLE_ARN
The role ARN provided for the assume-role operation is invalid or incorrectly formatted. The authentication service can’t process the request until the ARN is corrected.
This error occurs when:
The ARN format doesn’t match the expected pattern.
The ARN contains invalid characters, typos, or extra whitespace.
The ARN refers to a resource type other than a role.
How to Troubleshoot
To resolve this error:
Verify the ARN follows the correct format for a role ARN.
Check for any typos, extra characters, or leading and trailing spaces.
Confirm the ARN refers to a role, not another resource type.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_ASSUME_ROLE_ARN
A description of what you were trying to do when the error occurred
INVALID_AUTH_CONTEXT
The authentication context attached to the request isn’t valid for this operation. The platform can’t authorize the call without a correct authentication context.
This error occurs when:
The context is missing required fields.
The context references an org, identity, or scope that doesn’t match the credential.
The context was built from stale data after an org or identity change.
How to Troubleshoot
To resolve this error:
Refresh the authentication context from the source of truth.
Confirm the context’s org, identity, and scope match the credential being used.
Verify all required context fields are populated.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_AUTH_CONTEXT
A description of what you were trying to do when the error occurred
INVALID_C2C_AUDIENCE_TYPE
The audience type in the internal service credential is invalid or not recognized. The authentication service can’t process the request until the credential is corrected.
This error occurs when:
The aud claim in the credential is missing, null, or contains an unrecognized value.
The credential was issued with an audience that doesn’t match any supported type.
The credential was malformed during signing.
How to Troubleshoot
To resolve this error:
Inspect the credential for the aud claim and verify the value is a recognized audience type.
Re-issue the credential with a valid audience value.
If the credential is generated automatically, review the generation logic for audience claim population.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_C2C_AUDIENCE_TYPE
A description of what you were trying to do when the error occurred
INVALID_C2C_ISSUER_TYPE
The issuer type in the internal service credential is invalid or not recognized. The authentication service can’t process the request until the credential is corrected.
This error occurs when:
The iss claim in the credential is missing, null, or empty.
The issuer value doesn’t correspond to a recognized service type.
The credential was malformed during signing.
How to Troubleshoot
To resolve this error:
Inspect the credential for the iss claim and verify it contains a valid, non-null value.
Re-issue the credential with a recognized issuer value.
If the credential is generated automatically, review the generation logic for issuer claim population.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_C2C_ISSUER_TYPE
A description of what you were trying to do when the error occurred
INVALID_C2C_SERVICE_CONTEXT
The platform couldn’t establish a trusted identity for this request. The internal service context is invalid or incomplete. This is a platform configuration issue, not a problem with your request.
This error occurs when:
An internal service identity is missing required fields.
The service identity isn’t configured for internal platform communication.
The service context didn’t originate from a trusted source.
If this error started after a recent configuration change, contact Salesforce Customer Support.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_C2C_SERVICE_CONTEXT
A description of what you were trying to do when the error occurred
INVALID_CLAIM
A required credential claim is missing or contains an invalid value. The authentication service can’t process the request until the credential is corrected.
This error occurs when:
A required claim was omitted from the credential.
A claim value doesn’t match the expected format (for example, a malformed timestamp or audience).
The claim is set to a value the authentication service doesn’t recognize.
How to Troubleshoot
To resolve this error:
Inspect the credential to identify the missing or invalid claim.
Configure the issuer to populate the required claim correctly.
Re-issue the credential after the issuer is updated.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_CLAIM
The name of the claim that’s missing or invalid, if shown in the error detail
INVALID_CLOUD_KEY
The platform couldn’t complete an internal service handshake because a credential key is invalid or expired. The key needs to be rotated or refreshed before the request can succeed.
This error occurs when:
The credential key has expired and needs to be rotated.
The key value was truncated or copied incorrectly.
The key was issued for a different environment or service.
How to Troubleshoot
To resolve this error:
If you manage the credential key, rotate or refresh it.
Confirm the key value is transmitted exactly as issued.
Verify the key was issued for the correct environment and service.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_CLOUD_KEY
A description of what you were trying to do when the error occurred
INVALID_EAI_JWT_ASSERTION
The platform’s integration layer rejected the credential assertion for this request. The authentication service couldn’t verify it against the configured trust chain.
This error occurs when:
The assertion’s signature doesn’t verify against the issuer’s keys.
A required claim is missing or contains an invalid value.
The assertion has expired or hasn’t yet become valid.
How to Troubleshoot
To resolve this error:
Confirm all required claims are present and correctly populated in the assertion.
Verify the issuer’s signing keys are current in the authentication service’s configuration.
If the assertion consistently fails, contact Salesforce Customer Support.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_EAI_JWT_ASSERTION
A description of what you were trying to do when the error occurred
INVALID_GRANT_TYPE
The authentication grant type in the request isn’t valid or isn’t supported for this client. The request can’t proceed until the correct grant type is used.
This error occurs when:
The grant_type value is mistyped (for example, client_creds instead of client_credentials).
The client isn’t configured to use the requested grant type.
The grant type was deprecated and is no longer accepted.
How to Troubleshoot
To resolve this error:
Verify the grant_type value matches a supported grant type.
Confirm the client is configured to use the requested grant type.
If the grant type you’re using is deprecated, update to a supported one.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_GRANT_TYPE
The grant_type value in the request
INVALID_PARAMETER
The request failed validation because one or more parameters are missing, malformed, or out of range. Correct the parameters and try again.
This error occurs when:
A required parameter was omitted.
A parameter value doesn’t match the expected type or format.
A parameter is outside its permitted range or set of allowed values.
How to Troubleshoot
To resolve this error:
Review the API documentation for the endpoint to confirm parameter requirements.
Validate parameter values before sending the request.
Re-send the request with corrected parameter values.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_PARAMETER
The parameter name and value that caused the failure, if shown in the error detail
INVALID_PRINCIPAL
The identity supplied with the request didn’t pass validation. It may be missing required attributes or be in an incompatible format for this operation.
This error occurs when:
A required identity attribute is missing.
The identity identifier doesn’t match the expected format.
The identity is incompatible with the operation being requested.
How to Troubleshoot
To resolve this error:
Verify all required identity attributes are populated.
Confirm the identity identifier matches the expected format.
Re-resolve the identity from the source of truth before retrying.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_PRINCIPAL
A description of what you were trying to do when the error occurred
INVALID_RESOURCE_SCOPE_ACCESS
The credential or token doesn’t include permission to access the requested resource. The request was rejected because the required scope isn’t granted.
This error occurs when:
The token was issued without the scope needed for the resource.
The caller’s role no longer grants the required scope.
The resource was moved into a more restricted scope.
How to Troubleshoot
To resolve this error:
Re-issue the token with the required scope grant.
Confirm the caller’s role still grants access to the resource.
If access should be permitted, ask your Salesforce admin to update the scope.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_RESOURCE_SCOPE_ACCESS
The resource or scope the request was targeting
INVALID_SERVICE_OU
The service identity doesn’t have permission to access the requested resource. The request was rejected because the identity isn’t registered for access.
This error occurs when:
The service identity isn’t registered for access to the resource.
The identity in the credential doesn’t match what the resource expects.
The resource’s allowed identities don’t include the calling service.
How to Troubleshoot
To resolve this error:
Confirm the service identity is registered for access to the requested resource.
Verify the credential’s identity value matches what this request expects.
If access should be permitted, ask your Salesforce admin to grant it.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_SERVICE_OU
A description of what you were trying to do when the error occurred
INVALID_SF0_CORE_GUID
The Salesforce core org identifier provided is invalid or incorrectly formatted. The authentication service can’t process the request until a valid identifier is used.
This error occurs when:
The identifier format doesn’t match the expected UUID format.
The identifier contains invalid characters, typos, or extra whitespace.
You’re using a different type of identifier instead of the Salesforce core org identifier.
How to Troubleshoot
To resolve this error:
Verify the identifier follows standard UUID format (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).
Check for typos, extra characters, or leading and trailing spaces.
Confirm you’re using the correct type of identifier. Use the Salesforce core org identifier, not a different ID type.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_SF0_CORE_GUID
A description of what you were trying to do when the error occurred
INVALID_SUBJECT
The subject in the credential doesn’t refer to a valid identity. The authentication service rejected the request because the subject is missing, malformed, or incompatible with the operation.
This error occurs when:
The subject doesn’t refer to a known identity.
The subject identifier is malformed.
The subject is incompatible with the requested operation.
How to Troubleshoot
To resolve this error:
Verify the subject identifier resolves to an active identity.
Confirm the subject identifier matches the expected format.
If the original subject was wrong, re-issue the credential with the correct one.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_SUBJECT
A description of what you were trying to do when the error occurred
INVALID_SUBJECT_TYPE
The subject type in the credential isn’t recognized or isn’t supported for this operation. Re-issue the credential with a supported subject type.
This error occurs when:
The subject type value is mistyped or uses a deprecated identifier.
The subject type isn’t supported by the authentication service for the requested operation.
The credential’s subject type doesn’t match what the operation expects.
How to Troubleshoot
To resolve this error:
Confirm the subject type matches a value supported by the authentication service.
If the current subject type is deprecated, update the issuer to emit a supported one.
Re-issue the credential with the correct subject type.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_SUBJECT_TYPE
A description of what you were trying to do when the error occurred
INVALID_TENANT_KEY
The credential key for your org is invalid or expired. The authentication service can’t complete the request until a valid key is in place.
This error occurs when:
The credential key has expired and needs to be rotated.
The key value was truncated or copied incorrectly.
The key was issued for a different org or environment.
How to Troubleshoot
To resolve this error:
Rotate or refresh the credential key for your org.
Confirm the key value matches the issuer’s record exactly.
Verify the key was issued for the correct org and environment.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_TENANT_KEY
A description of what you were trying to do when the error occurred
INVALID_TENANT_STATUS
Your org is in a state that doesn’t allow this operation. It may still be provisioning, suspended, or deactivated.
This error occurs when:
The org is still being provisioned and isn’t yet active.
The org has been suspended or deactivated.
The org is in a recovery or migration window.
How to Troubleshoot
To resolve this error:
Wait until the org reaches an active state and try again.
If the org should be active but isn’t, contact your Salesforce admin.
If the org is deactivated, the operation can’t be completed without reactivation.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_TENANT_STATUS
A description of what you were trying to do when the error occurred
INVALID_TOKEN_EXPIRY
The token expiry value in the request is invalid. The authentication service can’t issue a token until a valid expiry is provided.
This error occurs when:
The expiry time is in the past.
The expiry time exceeds the maximum allowed token lifetime.
The expiry time is below the minimum allowed token lifetime.
The expiry value is missing or incorrectly formatted.
How to Troubleshoot
To resolve this error:
Confirm the expiry time is in the future.
Verify the expiry value is within the allowed range. Check the API documentation for minimum and maximum token lifetime constraints.
Confirm the expiry value is in the expected format.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_TOKEN_EXPIRY
A description of what you were trying to do when the error occurred
INVALID_XFCC_HEADER
The certificate header in the request is invalid and couldn’t be validated. The authentication service can’t authenticate the request until the header is corrected.
This error occurs when:
The header value is malformed or doesn’t conform to the expected format.
A required field within the header is missing or invalid.
The certificate information was truncated or corrupted in transit.
A proxy or service mesh isn’t correctly forwarding the certificate header.
How to Troubleshoot
To resolve this error:
Verify the header is correctly formatted and all required certificate fields are present.
Check your ingress or service mesh configuration to confirm it’s correctly populating and forwarding the certificate header.
If using mutual TLS, verify the client certificate chain is valid.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: INVALID_XFCC_HEADER
A description of what you were trying to do when the error occurred
JWT_INITIALIZATION_FAILED
This error code indicates an unexpected system error and not an issue with your configuration. If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: JWT_INITIALIZATION_FAILED
Any context that might help with the investigation, such as when the error occurred, what you or your end user were doing at the time, and whether you’re able to reproduce it
JWT_KEY_MANAGEMENT_FAILED
This error code indicates an unexpected system error and not an issue with your configuration. If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: JWT_KEY_MANAGEMENT_FAILED
Any context that might help with the investigation, such as when the error occurred, what you or your end user were doing at the time, and whether you’re able to reproduce it
JWT_VALIDATION_FAILED
The credential presented with the request didn’t pass validation. It may be expired, malformed, or signed by an issuer the authentication service doesn’t recognize.
This error occurs when:
The credential has expired.
The signature doesn’t verify against the issuer’s published keys.
A required claim (such as issuer, audience, or subject) is missing or incorrect.
The credential was tampered with in transit.
How to Troubleshoot
To resolve this error:
Re-issue the credential from the trusted issuer.
Confirm the signing key is published to the authentication service’s trust configuration.
Verify required claims are present and correctly populated.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: JWT_VALIDATION_FAILED
A description of what you were trying to do when the error occurred
KEY_ROTATION_FAILED
The platform couldn’t complete a key rotation operation because a dependency is temporarily unavailable. Existing keys remain valid. This is usually a temporary issue. Try again later.
This error occurs when:
A platform dependency required for key rotation is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the operation from completing.
The dependency is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
Existing keys should remain functional even if rotation fails.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: KEY_ROTATION_FAILED
A description of what you were trying to do when the error occurred
MISSING_CLAIM
A required claim is missing from the credential. The authentication service can’t process the request until the credential includes all required fields.
This error occurs when:
The credential was generated without including all required claims.
A required claim was accidentally omitted during token construction.
The token was generated for a different use case that doesn’t include all needed claims.
How to Troubleshoot
To resolve this error:
Check the error response for details about which claim is absent.
Update the credential generation logic to include all required claims.
Re-issue the credential with the complete set of required claims.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: MISSING_CLAIM
The name of the missing claim, if shown in the error detail
MISSING_D360_HEADERS
One or more required Data 360 headers are missing from the request. The authentication service can’t determine the correct routing context without them.
This error occurs when:
The request didn’t include all required Data 360 headers.
A proxy or gateway stripped headers in transit.
The client is an older version that doesn’t send Data 360 routing headers.
How to Troubleshoot
To resolve this error:
Confirm all required Data 360 headers are included in the request.
Check any intermediaries (such as load balancers or proxies) for header stripping.
Update the client to a version that supports Data 360 routing.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: MISSING_D360_HEADERS
A description of what you were trying to do when the error occurred
MISSING_DELETION_PATTERN
The deletion request is missing a required pattern parameter. The authentication service can’t process the request without it.
This error occurs when:
The deletion pattern parameter was omitted from the request.
The pattern parameter is empty or null.
The parameter name is misspelled.
How to Troubleshoot
To resolve this error:
Include a valid deletion pattern in the request.
Verify you’re using the correct parameter name.
Confirm the pattern value is not empty or null.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: MISSING_DELETION_PATTERN
A description of what you were trying to do when the error occurred
MISSING_JWT_SUBJECT_OR_AUDIENCE
The credential is missing one or both required identity claims (the subject or the audience). The authentication service can’t process the request until both are present.
This error occurs when:
The credential doesn’t include a sub (subject) claim.
The credential doesn’t include an aud (audience) claim.
One or both claims are present but empty or null.
How to Troubleshoot
To resolve this error:
Inspect the credential to verify which claims are present and which are missing.
Update the credential generation logic to include both the sub and aud claims with non-empty values.
Re-issue the credential with the complete set of required claims.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: MISSING_JWT_SUBJECT_OR_AUDIENCE
A description of what you were trying to do when the error occurred
MISSING_TOKEN_FOR_MINTING
The token minting request is missing a required credential. The authentication service can’t issue a new token without one to validate.
This error occurs when:
The request doesn’t include the authentication credential required for validation.
The credential parameter is empty or null.
The credential wasn’t included in the expected location (header, query parameter, or request body).
How to Troubleshoot
To resolve this error:
Include a valid credential in your token minting request.
Verify you’re using the correct parameter name and placement.
Confirm the credential value is not empty or null.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: MISSING_TOKEN_FOR_MINTING
A description of what you were trying to do when the error occurred
ORCHESTRATION_SERVICE_UNAVAILABLE
The platform’s orchestration layer is temporarily unavailable. The authentication service can’t complete multi-step authentication workflows until it recovers. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
The orchestration layer is experiencing an outage or degraded performance.
A temporary network issue is preventing the authentication service from reaching it.
The orchestration layer is undergoing maintenance.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: ORCHESTRATION_SERVICE_UNAVAILABLE
A description of what you were trying to do when the error occurred
PRINCIPAL_NOT_FOUND
The identity referenced in the request doesn’t exist in the authentication service. It may have been deleted, or the identifier may be incorrect.
This error occurs when:
The identity identifier is mistyped or refers to a deleted record.
The identity exists in a different org or environment.
A directory sync delay is preventing the identity from being visible.
How to Troubleshoot
To resolve this error:
Verify the identity identifier is correct and resolves to an active record.
Confirm you’re using the correct org and environment.
Wait briefly and try again if a directory sync delay is suspected.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: PRINCIPAL_NOT_FOUND
A description of what you were trying to do when the error occurred
PROD_ORG_ID_NOT_AVAILABLE
The production org ID isn’t available for this sandbox org. The authentication service can’t complete the request until the sandbox is correctly linked to a production org.
This error occurs when:
The sandbox hasn’t been linked to a production org.
The sandbox was created without being associated with a production org.
The production org ID mapping is missing or wasn’t set up correctly.
How to Troubleshoot
To resolve this error:
Confirm the sandbox is properly linked to a production org.
If the sandbox should be linked to a production org, contact your Salesforce admin to verify the configuration.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: PROD_ORG_ID_NOT_AVAILABLE
A description of what you were trying to do when the error occurred
PUBLIC_KEY_NOT_FOUND
The authentication service couldn’t find the public key for this identity. The key may not have been provisioned, or it may have been replaced during key rotation.
This error occurs when:
The key identifier is incorrect or refers to a key that was deleted.
Keys haven’t been generated yet for this identity.
A recent key rotation replaced the key and the identifier is now stale.
You’re working in the wrong org or environment.
How to Troubleshoot
To resolve this error:
Verify the key identifier is correct.
Confirm keys have been generated for this identity.
If keys were recently rotated, ensure you’re using the current key identifier.
Confirm you’re working in the correct org and environment.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: PUBLIC_KEY_NOT_FOUND
A description of what you were trying to do when the error occurred
RATE_LIMIT_EXCEEDED
You’ve sent too many requests in a short period. The authentication service rejected the request to protect service availability. Wait before trying again.
This error occurs when:
You’re making too many requests in a short time period.
Multiple clients or processes are using the same credentials simultaneously.
Bursts of traffic are exceeding the allowed threshold.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds before retrying.
Reduce the frequency of requests from your application.
If multiple clients share the same credentials, consolidate or stagger their requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: RATE_LIMIT_EXCEEDED
A description of your use case and expected request volume
REDIS_CONNECTION_FAILURE
The authentication service couldn’t reach its session management layer. This is a temporary platform-side issue. Wait a moment and try again.
This error occurs when:
The session management layer is undergoing maintenance or failover.
A temporary network issue is preventing the authentication service from reaching it.
The session management layer is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If you’re sending a high volume of requests, reduce the number of concurrent requests.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: REDIS_CONNECTION_FAILURE
A description of what you were trying to do when the error occurred
REDIS_KEY_NOT_FOUND
The authentication service couldn’t find a required session entry. The session may have expired, been cleared, or was never created.
This error occurs when:
The session entry has expired and hasn’t been repopulated.
The session was cleared under memory pressure.
The session entry was never created for this org or user.
How to Troubleshoot
To resolve this error:
Re-authenticate or restart the workflow to re-establish the session.
If the session entry should always exist, contact your Salesforce admin to verify the configuration.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: REDIS_KEY_NOT_FOUND
A description of what you were trying to do when the error occurred
REQUEST_UNAUTHORIZED
Your identity was confirmed, but you don’t have permission to perform this operation. The request was rejected because the required role or scope isn’t granted.
This error occurs when:
The caller’s role doesn’t grant permission for the operation.
The credential is missing a required scope or claim.
The targeted resource is restricted to a different set of callers.
How to Troubleshoot
To resolve this error:
Verify the caller has the role or scope required for the operation.
Re-issue the credential with the required permissions.
Contact your Salesforce admin if you believe access should be granted.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: REQUEST_UNAUTHORIZED
A description of what you were trying to do when the error occurred
REQUEST_VALIDATION_FAILED
The request failed validation. One or more fields are missing, incorrectly formatted, or out of range. Correct the request and try again.
This error occurs when:
A required field is missing from the request.
A field value doesn’t match the expected type or format.
A field value exceeds maximum length or contains invalid characters.
How to Troubleshoot
To resolve this error:
Review the error response for details about which fields failed validation.
Confirm all required fields are included and values match the expected format.
Re-send the request with corrected values.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: REQUEST_VALIDATION_FAILED
A description of what you were trying to do when the error occurred
REVOKE_TRUST_FAILED
The platform couldn’t revoke an existing trust relationship because a dependency is temporarily unavailable. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
A platform dependency is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the platform from completing the operation.
The trust relationship doesn’t exist or was already revoked.
How to Troubleshoot
To resolve this error:
Verify the trust relationship currently exists before retrying.
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: REVOKE_TRUST_FAILED
A description of what you were trying to do when the error occurred
SERVICE_AUTHENTICATION_FAILED
Service-level authentication failed. The platform couldn’t verify the calling service’s credential. The credential needs to be refreshed or re-issued before the request can succeed.
This error occurs when:
The service credential has expired or been revoked.
The credential was issued for a different service identity.
A credential rotation hasn’t been applied to all instances of the calling service.
How to Troubleshoot
To resolve this error:
Refresh or re-issue the calling service’s credential.
Confirm the credential identifies the correct service.
Verify the credential rotation has been deployed to all instances of the caller.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: SERVICE_AUTHENTICATION_FAILED
A description of what you were trying to do when the error occurred
STS_POLICY_INVALID
The authentication token service policy for this request is invalid. It may contain duplicate entries or reference an action or resource that doesn’t exist. The authentication service can’t evaluate the policy as supplied.
This error occurs when:
The policy contains duplicate statements or identity entries.
A policy statement references an unknown action or resource.
The policy structure doesn’t match the expected format.
How to Troubleshoot
To resolve this error:
Remove any duplicate entries from the policy.
Review the policy structure for errors and correct them.
Confirm all referenced actions and resources exist and are valid.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: STS_POLICY_INVALID
A description of what you were trying to do when the error occurred
STS_POLICY_NOT_FOUND
The authentication token service policy referenced in this request doesn’t exist. The authentication service can’t evaluate the policy until a valid one is specified.
This error occurs when:
The policy name or identifier is incorrect or mistyped.
The policy hasn’t been created yet.
The policy was deleted.
How to Troubleshoot
To resolve this error:
Verify the policy name or identifier is correct.
Confirm the policy exists. List available policies if needed.
If the policy should exist but doesn’t, create it before retrying.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: STS_POLICY_NOT_FOUND
A description of what you were trying to do when the error occurred
STS_ROLE_OPERATION_FAILED
The authentication service couldn’t complete a role operation because a platform dependency is temporarily unavailable. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
A platform dependency is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the operation from completing.
The role’s trust configuration is misconfigured.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If the error started after a recent configuration change, verify the role’s trust configuration is correct.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: STS_ROLE_OPERATION_FAILED
A description of what you were trying to do when the error occurred
STS_TOKEN_GENERATION_FAILED
The authentication token service couldn’t generate the requested token because a platform dependency is temporarily unavailable. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
A platform dependency is temporarily unavailable or undergoing maintenance.
A temporary network issue is preventing the service from reaching the token endpoint.
The dependency is reducing capacity under high load.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: STS_TOKEN_GENERATION_FAILED
A description of what you were trying to do when the error occurred
TENANT_ALREADY_EXISTS
An org with this identifier already exists. The authentication service rejected the request to prevent creating a duplicate.
This error occurs when:
A previous provisioning request succeeded but the client retried after a timeout.
A different process already provisioned the org.
The org identifier is being reused for a new org.
How to Troubleshoot
To resolve this error:
Check whether the org already exists before retrying provisioning.
If a duplicate request is suspected, treat the earlier provisioning as successful.
If you need a new org, use a unique identifier.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: TENANT_ALREADY_EXISTS
A description of what you were trying to do when the error occurred
TENANT_AUTHENTICATION_FAILED
The authentication service couldn’t authenticate the request against your org. The credential may be expired, revoked, or issued for a different org.
This error occurs when:
The credential is expired, revoked, or was issued for a different org.
A required org-specific claim is missing or has the wrong value.
The credential signing key is no longer trusted by the org.
How to Troubleshoot
To resolve this error:
Refresh or re-issue the credential for the target org.
Confirm the credential’s claims match the org’s expected issuer and audience.
Verify the signing key is current in the org’s trust configuration.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: TENANT_AUTHENTICATION_FAILED
A description of what you were trying to do when the error occurred
TENANT_CREATE_FAILED
The authentication service couldn’t complete org provisioning. A validation check or uniqueness rule rejected the request.
This error occurs when:
An org with the same identifier already exists.
Required org attributes are missing or fail validation.
The org configuration violates a business rule (for example, conflicting environment or feature settings).
How to Troubleshoot
To resolve this error:
Confirm the org doesn’t already exist before retrying provisioning.
Verify all required org attributes are supplied and valid.
If validation continues to fail, contact your Salesforce admin to review configuration constraints.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: TENANT_CREATE_FAILED
A description of what you were trying to do when the error occurred
TENANT_DELETE_FAILED
The authentication service couldn’t complete org deletion. The org may still have active resources attached, or it may be in a state that doesn’t allow deletion.
This error occurs when:
The org still has active feature registrations, identities, or keys attached.
The org is in a state that doesn’t allow deletion (such as provisioning).
A downstream system rejected the delete request.
How to Troubleshoot
To resolve this error:
Remove or deprovision any attached resources before retrying deletion.
Confirm the org is in a state that allows deletion. It can’t be in provisioning or recovery.
If the org appears clean but deletion is still failing, contact Salesforce Customer Support.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: TENANT_DELETE_FAILED
A description of what you were trying to do when the error occurred
TENANT_KEY_NOT_FOUND
The authentication service couldn’t find a required credential key for your org. The key may not have been provisioned, or it may have been rotated without a replacement being registered.
This error occurs when:
The org was provisioned without its credential keys being installed.
The key was rotated or deleted without a replacement being registered.
A key store sync delay is preventing the key from being visible.
How to Troubleshoot
To resolve this error:
Confirm the org has its credential keys provisioned in the authentication service.
Re-register the key if it was recently rotated.
Wait briefly and try again if a sync delay is suspected.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: TENANT_KEY_NOT_FOUND
A description of what you were trying to do when the error occurred
TENANT_NOT_FOUND
The org identifier in the request doesn’t match a known org. It may be mistyped, not yet provisioned, or the request may have been sent to the wrong environment.
This error occurs when:
The org ID is mistyped or refers to an org that hasn’t been provisioned.
The org was deleted or isn’t yet active.
The request was sent to the wrong environment (for example, a sandbox org ID against a production endpoint).
How to Troubleshoot
To resolve this error:
Verify the org identifier matches a provisioned org in the target environment.
Confirm the org has been onboarded and is in an active state.
If the org should exist, contact your Salesforce admin to verify provisioning.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: TENANT_NOT_FOUND
A description of what you were trying to do when the error occurred
TENANT_NOT_PROVISIONED
Your org exists but hasn’t finished provisioning. The operation can’t complete until provisioning is done.
This error occurs when:
Provisioning is still in progress and not all setup steps have completed.
A provisioning step failed and wasn’t retried.
The org requires manual approval that hasn’t occurred yet.
How to Troubleshoot
To resolve this error:
Wait for provisioning to complete and try again.
Check the provisioning workflow status with your Salesforce admin.
If provisioning has stalled, contact your Salesforce admin to re-run the failed step.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: TENANT_NOT_PROVISIONED
A description of what you were trying to do when the error occurred
UNEXPECTED_ERROR
This error code indicates an unexpected system error and not an issue with your configuration. If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: UNEXPECTED_ERROR
Any context that might help with the investigation, such as when the error occurred, what you or your end user were doing at the time, and whether you’re able to reproduce it
UNREGISTERED_CLOUD
The cloud instance referenced in this request isn’t registered in the platform’s trust framework. The authentication service can’t authenticate the request until the cloud is registered.
This error occurs when:
The cloud instance hasn’t been registered in the system.
The cloud identifier is incorrect or mistyped.
The cloud registration process wasn’t completed.
The cloud was deregistered or removed from the trust framework.
How to Troubleshoot
To resolve this error:
Verify the cloud identifier is correct.
Confirm the cloud registration process has been completed.
If the cloud should be registered, contact your Salesforce admin to verify the configuration.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: UNREGISTERED_CLOUD
A description of what you were trying to do when the error occurred
UNSUPPORTED_C2C_USE_CASE
The internal communication scenario you’re attempting isn’t supported. The authentication service can’t process this type of request.
This error occurs when:
The combination of source and target services isn’t supported for internal communication.
The feature or capability required for this scenario isn’t available in your environment.
The scenario requires additional configuration or enablement.
How to Troubleshoot
To resolve this error:
Confirm the scenario you’re attempting is supported in your environment.
Contact your Salesforce admin to verify the required features are enabled for your org.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: UNSUPPORTED_C2C_USE_CASE
A description of the authentication scenario you were attempting
VAULT_SERVICE_UNAVAILABLE
The platform’s secrets management layer is temporarily unavailable. The authentication service can’t complete the request until it recovers. This is usually a temporary issue. Wait a moment and try again.
This error occurs when:
The platform’s secrets management layer is experiencing an outage or degraded performance.
A temporary network issue is preventing the authentication service from reaching it.
The service is undergoing maintenance.
How to Troubleshoot
To resolve this error:
Wait at least 30 seconds and try again. This is a temporary error that usually clears on its own.
If the error persists after several retries, check trust.salesforce.com for known incidents.
If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: VAULT_SERVICE_UNAVAILABLE
A description of what you were trying to do when the error occurred
XFCC_PARSE_ERROR
This error code indicates an unexpected system error and not an issue with your configuration. If the issue persists, contact Salesforce Customer Support with the following information.
The trace ID from the error response (instance field, format urn:trace:...)
The error code: XFCC_PARSE_ERROR
Any context that might help with the investigation, such as when the error occurred, what you or your end user were doing at the time, and whether you’re able to reproduce it
j