Errors
Errors you may meet, their cause and the expected reaction.
Authorization redirect
When the transaction fails, A3BC redirects to your redirect_uri with error and error_description (standard OIDC format).
| Situation | Likely cause | What to do |
|---|---|---|
redirect_uri error before even reaching the app |
The URL differs by a single character from the registered URI. | Compare byte by byte (scheme, host, path, trailing slash). |
| Error after the user journey | Consent refused, authentication failed, ACR not satisfied, mandatory claim unavailable, technical incident. | Show a clear message and offer to retry. |
Different state |
Callback not initiated by your session. | Reject. |
| Claim missing although the scope is requested | The user did not provide it to their IdP. | Not an error: plan for it. |
| Code rejected at the token endpoint | Code already used, expired, different redirect_uri. |
The code is single-use: restart the journey. |
| Information not found | More than 30 minutes after consent. | Store it on receipt. |
Document API
| HTTP | Body | Cause |
|---|---|---|
401 |
{"code":"004013","message":"ingress auth: authentication failed"} |
Wrong or missing bearer token. |
500 |
code, message |
Internal error. |
Delayed sharing API
See the code table. Retry only on 00001 and 00010.
Webhook
| Observation | Cause | What to do |
|---|---|---|
| Notifications resent in a loop | Your endpoint does not answer 200, 201 or 204. |
Answer quickly and process in the background. |
| Invalid signature | HMAC computed on a modified body, key not base64-decoded, comparison case. | See Signature. |
Same id received several times |
Normal retry. | Deduplicate on id. |