Error catalog

When: The bearer token is absent, malformed, revoked, or belongs to a deleted account.

What to do: Create a new token on the API Tokens page and update the tool that failed.

When: The account behind the token has been deactivated by an administrator.

What to do: Contact a Janus administrator. Tokens stay valid but every call is refused while the account is disabled.

When: The caller asked for a model that is not enabled, or that they hold no grant for.

What to do: Call GET /v1/models to see what you can use, and ask an administrator for a grant if the model is missing.

When: A policy blocking rule matched the request. The reason field names the rule and the clause that fired.

What to do: Read the reason. If the block is wrong, an administrator can adjust the rule in Admin → Policy rules.

When: A Security Gateway policy refused the request or withheld the response. error.param names the check kind (secrets, pii, terms, shape, prompt_injection); the rule and the matched text are never returned. On a stream this arrives as a final in-band error frame followed by [DONE]. If the message says the policy fails closed, the classifier behind a check was unreachable — nothing matched. Child Safety uses the same code when a model or endpoint is blocked for a child account.

What to do: Remove the flagged material and retry. If you believe this is a mistake, an administrator can look the request up by request_id under Admin → Security → Violations.

When: A tokens, spend, or request quota is used up for the current window.

What to do: Wait until reset_at, or ask an administrator to raise the limit. Retrying earlier will fail the same way.

When: A per-endpoint rate limit was exceeded.

What to do: Back off for the number of seconds in retry_after and try again.

When: A streamed response grew past the gateway's response size cap (JANUS_MAX_RESPONSE_BYTES). The text before this point was delivered and this arrives as a final in-band error frame (the HTTP status was already 200). A non-streamed response over the cap is delivered whole.

What to do: Ask for a shorter answer (lower max_tokens, or split the task). If large responses are expected, an administrator can raise JANUS_MAX_RESPONSE_BYTES.

When: A service token was used outside the /v1 inference API, for example against a dashboard or admin endpoint. Service tokens only authenticate model calls.

What to do: Use the service token only for /v1 requests. For the web API, sign in with a user account.

When: The service token has passed the expiry date set when it was created. This is different from a revocation: nobody turned it off, it aged out.

What to do: Ask a Janus administrator to issue a replacement under Admin → Service tokens and update the integration.

When: The managed model (alias) you called points at a model that is missing or disabled. Your request is correct; the alias needs repairing.

What to do: Contact a Janus administrator. Until it is fixed, call another model from GET /v1/models directly.

When: The managed model's target is unavailable and the fallback configured for exactly that case cannot take over either. The message names both reasons.

What to do: Retry in a few minutes; if it persists, contact a Janus administrator with the request_id so they can fix the target or the fallback.

When: The call used one of your personal provider subscriptions (my/… models) and its stored sign-in no longer works: it expired, was revoked at the provider, or the password changed.

What to do: Open the Subscriptions page and connect that subscription again, then retry.

When: The provider behind the requested model could not be reached, or its credentials could not be decrypted.

What to do: Retry shortly. If it persists, an administrator should check Admin → Settings → System status for that upstream.

When: The provider ended a streaming response early: its connection dropped, or it closed the stream without a [DONE], finish_reason or usage block. The HTTP status was already 200, so this arrives as a final in-band error frame (502 is the status inside that frame) and the text before it is incomplete.

What to do: Retry the request. If it keeps happening, an administrator should check the upstream server (restarts, out-of-memory kills, proxies with short idle timeouts). The request log shows these with this code.

When: The provider throttled the gateway itself.

What to do: Back off and retry. Janus never retries generative calls for you, because a retry is a second charge.

When: The request body was malformed, or a required field such as model was missing. The same code is used, with HTTP 413, when a body is too large for the provider adapter to rewrite, and with HTTP 409 when an admin change conflicts with things that depend on it.

What to do: Read the message and param field, fix the request, and send it again. For 413, send a smaller payload; for 409, deal with the dependents the message names first.

When: The path does not exist on this gateway, or the item it names (a token, model, request, team…) was not found or is not visible to you.

What to do: Check the URL and the id. For model calls the base URL must end in /v1; for model names call GET /v1/models.

When: A browser request reached an API route without a valid session, or the session expired or idled out.

What to do: Sign in again. Sessions last 24 hours, or 4 hours of inactivity, whichever comes first.

When: The signed-in account lacks the role required for an administrative action.

What to do: Ask an administrator to perform the action or to grant you the role.

When: An administrator tried to create something new (an upstream, token, model…) while the gateway has no valid license. Everything already configured keeps working.

What to do: An administrator installs or renews the license key under Administration → Settings → License & updates.

When: An administrator tried to switch on a feature the installed edition does not include (for example load balancing or guardrail enforcement).

What to do: Install a key for an edition that includes the feature under Administration → Settings → License & updates, or leave the feature off.

When: An administrator tried to create a new local account, or turn a disabled account back on, while every licensed seat is in use. A seat is a user active in the last 30 days.

What to do: Add seats to the license under Administration → Settings → License & updates, or wait for an inactive user to free a seat.

When: The gateway runs the STIG profile (JANUS_STIG_PROFILE=true), and an administrative change was refused because its audit record could not be written. The change was not saved.

What to do: Check the database (disk space, permissions, connectivity) and the gateway log, then make the change again. Reads keep working.

When: The gateway hit an unexpected internal failure.

What to do: Retry once. If it recurs, quote the request_id from the response to whoever operates the gateway.