> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/error-and-symptom-index.md).

# Error and symptom index

Every error message, log line and observable symptom the guide explains, with the page that explains it.

## What this is, and when you need it

Search this page for the exact text you were given — an error on screen, a line in a log, or the behaviour you observed — and follow the link to the page that explains it. Strings are reproduced as the product emits them, including any misspellings, so search for what you see rather than what it should say.

| You are seeing                                                                                                                                             | What it means                                                                                                                                                                      | Where it is explained                                                                                                                                                      |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `(Default approver)`                                                                                                                                       | Appended to an approver's name on a task: this step's own approver resolved to nobody, so a required step fell back to `org.openiam.idm.activiti.default.approver.user`            | [Approval flows](/administration-guide/requests/approval-flows.md#change-who-approves)                                                                                     |
| `AD user Status: true ====`                                                                                                                                | The PowerShell `enabled` row decided the account should stay enabled, ignoring secondary status                                                                                    | [Policy map reference](/administration-guide/lifecycle/policy-map/policy-map-reference.md#status-changes-and-account-enablement)                                           |
| `AH01144: No protocol handler was valid for the URL /app/ (scheme 'https')`                                                                                | `mod_ssl` is not loaded, so `SSLProxyEngine on` was never applied and Apache cannot reach an HTTPS upstream                                                                        | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#proxying-to-an-https-upstream)                                                 |
| `ANOTHER_SAVE_IN_PROGRESS`                                                                                                                                 | Another thread or node holds the save lock for this user, usually because a script started a nested operation                                                                      | [Provisioning processor reference](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md#nested-provisioning-and-the-user-save-lock) |
| `Ambiguous method overloading for method org.openiam.exception.BasicDataServiceException#<init>`                                                           | A `catch` block passed a `null` second argument, usually `e.getMessage()` on an exception with no message                                                                          | [Provisioning processor reference](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md#constructing-basicdataserviceexception)     |
| `An attempt was made to add an object to the directory with a name that is already in use.`                                                                | Another object holds the same RDN in the target container, and it need not be a user                                                                                               | [Build a policy map](/administration-guide/lifecycle/policy-map.md#when-it-goes-wrong)                                                                                     |
| `Are you sure you want to link the selected items? Existing identities will be overwritten.`                                                               | The link confirmation, warning that the replace branch will overwrite an existing login value                                                                                      | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md#the-screen-strings-worth-searching-a-ticket-for)                                     |
| `Attribute Map is inactive or name is empty!`                                                                                                              | The row was skipped because Status is unchecked or Attribute name is blank                                                                                                         | [Build a policy map](/administration-guide/lifecycle/policy-map.md#when-it-goes-wrong)                                                                                     |
| `CANNOT_INSTANTIATE_GROOVY_CLASS`                                                                                                                          | A validation script failed to compile, failed the cast to the validator interface, or threw something other than `BasicDataServiceException`                                       | [Build a page template](/administration-guide/identities/page-templates-and-custom-fields.md#when-it-goes-wrong)                                                           |
| `CANT_ADD_YOURSELF_AS_CHILD`                                                                                                                               | A role was added as its own child; longer cycles are not detected and will save                                                                                                    | [Manage roles and groups](/administration-guide/access/manage-roles-and-groups.md#nesting)                                                                                 |
| `Can't get SSO Attibutes`                                                                                                                                  | One attribute threw and cleared the entire `AttributeStatement`, so the SP sees an assertion with no attributes (the misspelling is in the source)                                 | [OpenIAM as a SAML identity provider](/administration-guide/federation/saml-identity-provider.md#when-it-goes-wrong)                                                       |
| `Can't invoke spring thread`                                                                                                                               | The named Spring bean is not in the batch-task-manager context, or the invocation threw                                                                                            | [Create a batch task](/administration-guide/automation/batch-tasks.md#when-it-goes-wrong)                                                                                  |
| `Can't renew token via restful call`                                                                                                                       | Explicit session renewal failed and answered `500`                                                                                                                                 | [Access Gateway reference](/administration-guide/gateway/access-gateway-reference.md#session-lifetime-and-renewing-the-session-cookie)                                     |
| `Can't save AuthnRequest from SP`                                                                                                                          | Parking an inbound `AuthnRequest` in Redis failed, so it cannot be replayed after authentication                                                                                   | [OpenIAM as a SAML identity provider](/administration-guide/federation/saml-identity-provider.md#how-an-interrupted-authnrequest-survives-authentication)                  |
| `Can't schedule task:`                                                                                                                                     | The sweep threw while materialising one task's next runs                                                                                                                           | [Restart batch tasks that have all stopped](/administration-guide/automation/batch-tasks/diagnose-stalled-batch-tasks.md#when-it-goes-wrong)                               |
| `Cannot execute batch groovy task`                                                                                                                         | The batch script threw, or returned something that is not an `Integer`                                                                                                             | [Create a batch task](/administration-guide/automation/batch-tasks.md#when-it-goes-wrong)                                                                                  |
| `Cannot get identity from cert`                                                                                                                            | The ESB's certificate-to-identity call failed; the specific `ResponseCode` names which configuration step is wrong                                                                 | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#certificate-authentication-fails-and-the-login-page-says-nothing)              |
| `Cannot instantiate <scriptId>. Using default`                                                                                                             | The connector response handler script could not be loaded, so the no-op default ran instead                                                                                        | [Provisioning processor reference](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md#reacting-to-a-connector-reply)              |
| `Cannot instantiate null`                                                                                                                                  | The pre- or post-processor script could not be loaded or cast, so the no-op default ran instead                                                                                    | [Attach a provisioning processor](/administration-guide/lifecycle/provisioning-processors.md#when-it-goes-wrong)                                                           |
| `Cannot invoke "org.openiam.idm.srvc.auth.dto.LoginLockMarkerEnum.toString()" because the return value of "org.openiam.dto.Login.getLockMarker()" is null` | Creating a user from an orphan; the login bean carries no lock marker and the diff dereferences it unguarded                                                                       | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md#when-creating-a-user-from-an-orphan-fails-on-the-lock-marker)                        |
| `Could not determine authentication level grouping for`                                                                                                    | A URI pattern matched but no authentication level grouping resolved for it — a gap on the pattern, not an entitlement decision                                                     | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#diagnosing-a-request-that-fails-through-the-gateway)                           |
| `Could not initiate workflow`                                                                                                                              | The workflow service failed, or returned nothing, when the screen asked it to start a request; the message carries no reason of its own                                            | [Approval flows](/administration-guide/requests/approval-flows.md#when-it-goes-wrong)                                                                                      |
| `Could not parse certificate: java.io.IOException: Empty input`                                                                                            | The gateway posted an empty certificate body to the ESB, so the client certificate never reached the module                                                                        | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#certificate-authentication-fails-and-the-login-page-says-nothing)              |
| `Could not put value for attribute map <name>`                                                                                                             | The row's script threw, or an IDM-value row resolved to blank; the cause follows on the same line                                                                                  | [Build a policy map](/administration-guide/lifecycle/policy-map.md#when-it-goes-wrong)                                                                                     |
| `Current step has been auto approved because requester is an approver or part of approver group`                                                           | The requester was in the candidate list for the next level, so that step was completed without a task                                                                              | [Approval flows](/administration-guide/requests/approval-flows.md#auto-approval-when-the-requester-is-an-approver)                                                         |
| `Data Key is null. Skipping decryption...`                                                                                                                 | The ESB had no data key for the value it was asked to decrypt — commonly a sign-in attempt for an identity that does not exist                                                     | [A user cannot sign in](/administration-guide/security/cannot-sign-in.md#the-password-is-refused)                                                                          |
| `Entity reindex initiated. This operation may take several minutes if there are many records.`                                                             | A reindex was accepted; an acknowledgement, not a completion                                                                                                                       | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md#when-the-orphan-list-and-the-reconciliation-disagree)                                |
| `Exception Occurred during RabbitMQ Call`                                                                                                                  | The generic MQ listener wrapper; the real cause is the exception logged beneath it                                                                                                 | [Create a batch task](/administration-guide/automation/batch-tasks.md#searching-for-users-from-a-batch-script)                                                             |
| `Exception occurred during batch tasks execution`                                                                                                          | The scheduler caught a `Throwable` and abandoned the rest of the cycle, so no task ran                                                                                             | [Restart batch tasks that have all stopped](/administration-guide/automation/batch-tasks/diagnose-stalled-batch-tasks.md)                                                  |
| `FATAL ERROR. No Authentiation Provider was found for the current HTTP Request. There is also no any default providers in DB also.`                        | This UI instance has no authentication provider cached for the request and no default to fall back on, usually because a sweep ran while the ESB was unreachable                   | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#no-authentiation-provider-was-found-what-actually-broke)                       |
| `File Access exception`                                                                                                                                    | A script tried to write outside `iam.files.location`                                                                                                                               | [Create a batch task](/administration-guide/automation/batch-tasks.md#where-the-file-lands)                                                                                |
| `HELPDESK_SECURITY_ANSWERS_ARE_WRONG`                                                                                                                      | One or more help-desk answers was wrong; the response never says which                                                                                                             | [Verify a help-desk caller](/administration-guide/security/helpdesk-verification.md#what-the-operator-is-actually-asked)                                                   |
| `HELPDESK_TOO_MANY_FAIL`                                                                                                                                   | The caller's `SECRET_FAIL_COUNT` passed `FAIL_ATTEMPTS_HELPDESK`; only a correct answer set or a manual update clears it                                                           | [Verify a help-desk caller](/administration-guide/security/helpdesk-verification.md#when-it-goes-wrong)                                                                    |
| `HHH000443: Dialect [org.hibernate.dialect.SQLServer2016Dialect] limits the number of elements in an IN predicate to 2100 entries.`                        | The Hibernate warning preceding the same failure; the entry count is the size of the backlog                                                                                       | [Restart batch tasks that have all stopped](/administration-guide/automation/batch-tasks/diagnose-stalled-batch-tasks.md)                                                  |
| `Ignoring 'myCustomAttr' attribute for modifying user because no special rule defined for it and isUnknownAttrBindAllowed is not set as well`              | The Active Directory connector dropped an attribute whose name is not on its allow-list                                                                                            | [Policy map reference](/administration-guide/lifecycle/policy-map/policy-map-reference.md#rows-the-active-directory-connector-drops)                                       |
| `Invalid Login and/or Password`                                                                                                                            | The sign-in failed; OpenIAM deliberately never says which half was wrong, so this is not evidence the account exists                                                               | [A user cannot sign in](/administration-guide/security/cannot-sign-in.md#the-password-is-refused)                                                                          |
| `Is proxy request - using cookie from proxy`                                                                                                               | The UI deliberately did not renew the session cookie because the request arrived through the gateway, which owns it                                                                | [Access Gateway reference](/administration-guide/gateway/access-gateway-reference.md#session-lifetime-and-renewing-the-session-cookie)                                     |
| `LdapErr: DSID-0C091211, comment: Error in attribute conversion operation, data 0, v3839`                                                                  | A value reached a binary directory attribute in the wrong form, usually a pre-encoded password                                                                                     | [Policy map reference](/administration-guide/lifecycle/policy-map/policy-map-reference.md#every-value-on-the-wire-is-a-string)                                             |
| `Login already exists`                                                                                                                                     | A different user already holds that login on that managed system                                                                                                                   | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md#when-it-goes-wrong)                                                                  |
| `Logins were successfully updated or added to the user`                                                                                                    | The link was queued, not confirmed stored                                                                                                                                          | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md#the-screen-strings-worth-searching-a-ticket-for)                                     |
| `Meta rule '<name>' requires a Content Type`                                                                                                               | A **Form Post Processor** metadata entry was saved with **Content Type** blank; the gateway cannot encode a request body without it                                                | [Form fill](/administration-guide/gateway/inject-identity.md#form-fill)                                                                                                    |
| `Mail not sent, invalid notificationType`                                                                                                                  | No enabled `MAIL_TEMPLATE` carries the name the sending feature asked for, usually because the template was renamed                                                                | [Mail and notifications](/administration-guide/platform/mail-and-notifications.md#notification-templates)                                                                  |
| `Maximum retry count exceeded. Operation interrupted. Message queue is <queue>. RabbitMQ exchange is <exchange>`                                           | The requeue ceiling was reached and the operation was abandoned; the underlying save never succeeded                                                                               | [Diagnose a failed operation](/administration-guide/operations/diagnose-a-failed-operation.md#the-broker-reply-timeout)                                                    |
| `Maximum retry count exceeded. Operation interrupted. Message queue is <queue>. RabbitMQ exchange is <exchange>`                                           | The save was re-queued `org.openiam.rabbitmq.message.max.retry.count` times and never got the lock                                                                                 | [Provisioning processor reference](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md#nested-provisioning-and-the-user-save-lock) |
| `NOT_ENOUGH_DATA_TO_BUILD_HELPDESK_QUESTIONS`                                                                                                              | The caller has none of the built-in candidate values and the attribute property is empty, so no questions could be built                                                           | [Verify a help-desk caller](/administration-guide/security/helpdesk-verification.md#when-it-goes-wrong)                                                                    |
| `NO_ACTIVE_EMAIL_CONFIGS`                                                                                                                                  | No mailbox configuration is active, or the only active one is nominated as another configuration's failover and is therefore excluded from the rotation                            | [Mail and notifications](/administration-guide/platform/mail-and-notifications.md#which-configuration-is-used)                                                             |
| `No attribute named 'lastSAMLMessageId' found for the current session`                                                                                     | The cookie correlating a sent `AuthnRequest` with its response did not come back; its path is a literal `/idp/saml2/...` string                                                    | [OpenIAM as a SAML identity provider](/administration-guide/federation/saml-identity-provider.md#how-an-interrupted-authnrequest-survives-authentication)                  |
| `No such property: getMessage for class: java.lang.Object`                                                                                                 | A Groovy script leaning on `def` where an explicit type is required                                                                                                                | [Create a batch task](/administration-guide/automation/batch-tasks.md#searching-for-users-from-a-batch-script)                                                             |
| `Not allowed to change your own entitlement`                                                                                                               | The signed-in operator tried to change their own entitlements while `org.openiam.ui.webconsole.allow.change.own.entitlements` is `false`                                           | [Manage roles and groups](/administration-guide/access/manage-roles-and-groups.md#stop-an-operator-granting-themselves-access)                                             |
| `PRECONDITION_FAILED - delivery acknowledgement on channel <n> timed out. Timeout value used: 1800000 ms`                                                  | One request held a consumer longer than the broker's delivery-acknowledgement timeout, so the broker closed the channel — the consumer's working time, not OpenIAM's reply timeout | [Diagnose a failed operation](/administration-guide/operations/diagnose-a-failed-operation.md#when-it-goes-wrong)                                                          |
| `Page template was null. Perhaps, this page was rewritten into React.`                                                                                     | Debug-only line behind a screen that renders with no fields                                                                                                                        | [Build a page template](/administration-guide/identities/page-templates-and-custom-fields.md#a-pattern-with-no-template-renders-a-blank-screen-not-an-error)               |
| `Parameter value [INTERNAL_EMPLOYEE] did not match expected type [org.openiam.idm.srvc.meta.domain.MetadataTypeEntity (n/a)]`                              | A user search filtered on employee type against the database path, which cannot bind that field                                                                                    | [Create a batch task](/administration-guide/automation/batch-tasks.md#searching-for-users-from-a-batch-script)                                                             |
| `Pattern <patternId> mapped to multiple templates - can't fetch template.`                                                                                 | The service-side log line for the same ambiguous binding                                                                                                                           | [Build a page template](/administration-guide/identities/page-templates-and-custom-fields.md#how-the-product-picks-the-template-for-a-request)                             |
| `Pattern <patternId> with MetadataType <typeId> mapped to multiple templates - can't fetch template.`                                                      | Same ambiguity, hit on the pattern-plus-metadata-type lookup                                                                                                                       | [Build a page template](/administration-guide/identities/page-templates-and-custom-fields.md#how-the-product-picks-the-template-for-a-request)                             |
| `Please select both orphan accounts and a user before proceeding`                                                                                          | **Update Identities** pressed with only one side of the link selected                                                                                                              | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md#the-screen-strings-worth-searching-a-ticket-for)                                     |
| `RESOURCE_TYPE_NOT_SUPPORTS_HIERARCHY`                                                                                                                     | The resource type named in the message ships `SUPPORTS_HIERARCHY='N'` and cannot take a parent or child                                                                            | [Manage roles and groups](/administration-guide/access/manage-roles-and-groups.md#nesting)                                                                                 |
| `SAML_USER_NOT_AUTHORIZED_TO_SSO`                                                                                                                          | The user is not entitled to the authentication provider's resource; creating the provider grants nothing                                                                           | [OpenIAM as a SAML identity provider](/administration-guide/federation/saml-identity-provider.md#when-it-goes-wrong)                                                       |
| `Save is in progress. Send message back to <queue> queue. RabbitMQ exchange is <exchange>`                                                                 | A directly submitted save was re-queued to wait for the user's lock                                                                                                                | [Provisioning processor reference](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md#nested-provisioning-and-the-user-save-lock) |
| `Save is in progress. Send message back to <queue> queue. RabbitMQ exchange is <exchange>`                                                                 | On the operation's audit event: another save of the same user was running, so this message was requeued and will be retried                                                        | [Diagnose a failed operation](/administration-guide/operations/diagnose-a-failed-operation.md#the-broker-reply-timeout)                                                    |
| `The incoming request has too many parameters. The server supports a maximum of 2100 parameters. Reduce the number of parameters and resend the request.`  | SQL Server's parameter cap, hit by the scheduler marking every due schedule row for one task                                                                                       | [Restart batch tasks that have all stopped](/administration-guide/automation/batch-tasks/diagnose-stalled-batch-tasks.md)                                                  |
| `This page is linked to more than one template. Each page must be linked to exactly one template.`                                                         | Two page templates resolve for one URI pattern and metadata type                                                                                                                   | [Build a page template](/administration-guide/identities/page-templates-and-custom-fields.md#how-the-product-picks-the-template-for-a-request)                             |
| `Trigger returned null next execution time for task`                                                                                                       | The cron expression has no future fire time, so no schedule row is created                                                                                                         | [Restart batch tasks that have all stopped](/administration-guide/automation/batch-tasks/diagnose-stalled-batch-tasks.md#when-it-goes-wrong)                               |
| `URI Fedration. Proxy URI:`                                                                                                                                | The ESB's per-request authorization decision, carrying the matched pattern, the error code, the upstream and the time it took (the typo is in the source)                          | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#diagnosing-a-request-that-fails-through-the-gateway)                           |
| `URI Pattern ID: <patternId>, Content Provider ID: <cpId>, is From Proxy: true.`                                                                           | The UI recording which pattern and content provider the gateway resolved for this request                                                                                          | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#diagnosing-a-request-that-fails-through-the-gateway)                           |
| `URI Syntax Exception:`                                                                                                                                    | The proxied URL is not a legal URI, so the authorization call failed with `INVALID_URI` before any pattern was evaluated                                                           | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#diagnosing-a-request-that-fails-through-the-gateway)                           |
| `Unable to reindex the selected entity`                                                                                                                    | The reindex request failed                                                                                                                                                         | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md#when-the-orphan-list-and-the-reconciliation-disagree)                                |
| `User already has an identity for this managed system`                                                                                                     | The user you are linking to already has an identity there                                                                                                                          | [Resolve orphan accounts](/administration-guide/identities/resolve-orphan-accounts.md#when-it-goes-wrong)                                                                  |
| `User with id <userId> is saving in another thread. Current request will be sent back to the queue to be retried.`                                         | The error token behind `ANOTHER_SAVE_IN_PROGRESS`; a save from provisioning is not actually retried                                                                                | [Provisioning processor reference](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md#nested-provisioning-and-the-user-save-lock) |
| `[userAccountControl]: 514`                                                                                                                                | The enablement row computed "normal account, disabled" from the user's two statuses                                                                                                | [Policy map reference](/administration-guide/lifecycle/policy-map/policy-map-reference.md#status-changes-and-account-enablement)                                           |
| `[userGroups]:`                                                                                                                                            | One line per group the membership script did send, carrying that group's distinguished name                                                                                        | [Manage roles and groups](/administration-guide/access/manage-roles-and-groups.md#what-nesting-does-not-reach)                                                             |
| `can't allocate 105 tokens`                                                                                                                                | Reported in the field during certificate authentication as the module failing to parse the ESB's JSON response; the count varies and the cause is not established in source        | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#certificate-authentication-fails-and-the-login-page-says-nothing)              |
| `errorCode=UNAUTHORIZED`                                                                                                                                   | Within that line: a pattern matched but entitlement or an authentication level refused the request                                                                                 | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#diagnosing-a-request-that-fails-through-the-gateway)                           |
| `is Entitled. Time: <ms>. User ID: <id>. Resource ID: <id>`                                                                                                | In the auth-manager log at debug: one entitlement check, with the time it took and the user and resource it was for                                                                | [Which log answers which question](/administration-guide/operations/which-log-to-read.md#raising-the-detail-level)                                                         |
| `isUnknownAttrBindAllowed flag is set - appending 'myCustomAttr' attribute with 'somevalue' value to additional object attributes`                         | The connector is binding an unrecognised attribute because the managed-system flag is on                                                                                           | [Policy map reference](/administration-guide/lifecycle/policy-map/policy-map-reference.md#rows-the-active-directory-connector-drops)                                       |
| `not valid - doesn't start with a '/' - XSS detected. Returning 401`                                                                                       | The postback URL failed validation, so the login page returned `401` instead of redirecting                                                                                        | [Advanced request and response transformations](/administration-guide/gateway/request-and-response-transformations.md#where-the-user-lands-after-authenticating)           |
| `there is no DN for group`                                                                                                                                 | A group was skipped because it carries no `dn` attribute, so it could not be named to the directory                                                                                | [Manage roles and groups](/administration-guide/access/manage-roles-and-groups.md#what-nesting-does-not-reach)                                                             |
| `there is no DN for group`                                                                                                                                 | `memberOf_1.0.groovy` walked a group attribute that is not named `dn`; it is logged even for groups that do have one                                                               | [Policy map reference](/administration-guide/lifecycle/policy-map/policy-map-reference.md#groups-memberof-and-membershipdiff)                                              |
| `there is no groups`                                                                                                                                       | The membership script had no direct group memberships to send, so the account's group attribute went out empty                                                                     | [Manage roles and groups](/administration-guide/access/manage-roles-and-groups.md#what-nesting-does-not-reach)                                                             |

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/error-and-symptom-index.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.