Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# Gateway Exceptions

The following table lists all of the exceptions that can be returned by the Gateway.

#### Members

Member Name | Description
--- | ---
311 | Invalid Expiry Date specified An invalid expiry date was specified (a date in the past or prior to delivery date).
312 | Invalid Delivery Date specified An invalid delivery date was specified.
1000 | Unexpected Internal Error This indicates that there is a problem with the Gateway. The client should try again later.
1001 | Unexpected Internal Error This indicates that there is a problem with the Gateway. The client should try again later.
1500 | Authentication Error The user credentials are not valid for one of a number of reasons: The supplied user name does not exist The supplied password is incorrect The account is locked out due to a third failed login attempt within a one hour period When an account is locked the lock will be released after a two hour period.
1501 | Credential cannot perform Admin action The user credentials are valid but the user does not have permission to perform the requested function, for one of the following reasons: The user is not an Admin user The Admin user is not enrolled for an admin service which manages the target service The Admin user is enrolled in an appropriate admin service, but that admin service does not permit the specific action requested
1502 | Authentication Error The token was compromised for one of a number of reasons: The supplied token is not a GatewayToken The supplied token cannot decrypt the credential identifier The supplied token cannot decrypt the hash The supplied token encrypted hash does not match the token hash
1503 | Authentication Error The token was not current for one of a number of reasons: The supplied token lifetime has expired
1504 | Authentication Error The password has expired but the account has not been disabled.
1505 | Authentication Error An invalid token request has been received.
1506 | SecurityToken Error The SecurityToken can only be used once.
1507 | Invalid Token Count Error One zero or one security tokens can be provided in a Gateway request.
1516 | Invalid Token Types The TokenType presented must be supported by Gateway. E.g. for APACS Cards the token type is http://www.gateway.gov.uk/ids/tokens/apacs-cap#APACS-CAP.
2001 | The supplied Correlation ID does not correspond to an address request When an Address Request is generated by Gateway it is given a unique CorrelationID. This is supplied to the back-end department with the request for the Address. If an Address Response is received with a Correlation ID that does not exist then this exception is raised.
2002 | The address request has been deleted Once an Address Response has been received for a specific Correlation ID the request is archived. If any further Responses are received for the Correlation ID then this exception will be raised.
3001 | The Agent Credential does not have an Enrolment that allows it to Act upon the Principal Service For an agent to be allowed to act upon Enrolments in a Principal Service, the Agent must be Enrolled in an Agent Service that is allowed to act upon it.
3002 | The service specified does not exist The Service supplied to the method does not exist on the Gateway.
3003 | The Service is not in an active state For this method to be executed the Service State has to be active.
3004 | The Service supplied is not of the correct type for this method This exception is thrown when a method is expected a Service of a specific type and has been passed something different. For example, if an Agent Service is supplied when trying to enrol in a Principal Service.
3005 | The service owner specified does not exist The Service Owner name supplied to the method does not exist on the Gateway.
3006 | Too many service Identifiers If a method has a capped limit on the amount of identifiers that can be returned, this method will be returned if the limit is exceeded.
4001 | The combination of AutoActivationMessageOverride and AutoActivationGatewayDefault flags does not allow Auto-Activation Only the following combination of the service flags AutoActivationMessageOverride and AutoActivationGatewayDefault will allow Auto-Activation for a service:
Combinations | Outcome
--- | ---
autoActivate = false AutoActivationMessageOverride = either AutoActivationGatewayDefault = either | AutoActivation not attempted
autoActivate = true AutoActivationMessageOverride = false AutoActivationGatewayDefault = false | AutoActivation not allowed, this exception raised
autoActivate = true AutoActivationMessageOverride = true AutoActivationGatewayDefault = false | AutoActivation allowed
autoActivate = true AutoActivationMessageOverride = false AutoActivationGatewayDefault = true | AutoActivation allowed
autoActivate = true AutoActivationMessageOverride = true AutoActivationGatewayDefault = true | AutoActivation allowed
4002 | The Activated element is set to False The method requires the value of the Activated element to be set to 'true'.
4003 | Invalid enrolment state for action For the action requested the current enrolment state is invalid.
5001 | Bad Input Xml The input document failed schema check. The namespace used may be incorrect for the method called, the document may be badly formed, or violate the schema. Check details of the Message section of this error for the specific failure. Although not specifically identified in the documentation for each method, the exception can be raised by any method.
5002 | Input XML fails business validation Once the input XML has been validated by the method's XML schema, it can still be rejected by the business logic as being incomplete or inconsistent. Although not specifically identified in the documentation for each method, the exception can be raised by any method.
6001 | Certificate already in use A Certificate can only be used by Credential on the Gateway. If an attempt to create a new Credential is made using a Certificate that is already being used by another Credential then this exception is raised.
6002 | The Certificate does not exist This exception is raised when a certificate is supplied that does not exist in Gateway.
6003 | The Certificate supplied was invalid For a Certificate to be used on the Gateway it must be valid and its Issuer Trusted. If for any reason the Gateway cannot or will not accept a Certificate then this exception will be raised.
6004 | User has already allocated certificate The credential has previously added a certificate. Through the SOAP Portal Interface a credential can add (associate) only a single certificate to itself. Note however that multiple certificates can be added to a credential by an Admin credential through the SOAP Admin Interface.
6005 | Unable to allocate certificate to credential The authentication level associated with the new certificate would allow the credential to access enrolments that they should not have access to.
7002 | The Principal has already allocated the enrolment to the Agent Group The Gateway only permits a Principal Enrolment to be allocated once to a specific Agent Group. If another Allocation to the same Group is attempted then this exception is raised Note: The service flag ExclusiveAgent allows a Principal Enrolment to be allocated to more that one Agent Group, but even with this flag off it is not possible to Allocate multiple times to the same Agent Group.
7003 | Principals cannot allocate enrolments to in-active Agents For a Principal Enrolment to be Allocated to an Agent, that Agent must be in an Active State. If they are not then this exception will be raised.
7004 | The principal enrolments service does not allow allocations to more than one agent The service flag ExclusiveAgent allows a Principal Enrolment to be allocated to more than one Agent Group, if this is attempted and the service flag is set on then this exception will be thrown. Note: Even with this service flag off, a Principal Enrolment cannot be allocated to the same Agent Group twice. This will cause the ClientAllocationAlreadyExistsException to be raised.
7005 | Client Allocations can only be created for an enrolment in a Principal Service The Service specified for the enrolment is not a Principal Service. Only a Principal Enrolment can be Allocated to an Agent.
7006 | The assignment of a Client Allocation may only be changed The assignment of a client allocation may not be updated unless the setting is actually being changed (from true to false or false to true).
7007 | ClientAllocationStartRecord exceeds total records The GetClientAllocationList start record specified may not exceed the total records identified by the call.
8002 | The specified Credential does not exist If a method is given the details of a Credential that does not exist then this exception will be raised.
8003 | The Agent Group Code does not exist The Agent Group Code is the Gateway generated unique identifier for an Agent Group (e.g. SACAEA2755). If supplied Agent Group Code does not exist then this exception will be raised.
8004 | Either the credential’s current authentication level is not high enough to perform this action OR the authentication level requested by the credential is inappropriate (i.e. too high) 1. The credential does not have a high enough authentication level to perform the requested action. 2. The authentication level requested by the credential gives it access to enrolments they are not entitled to. The rules (in order) that determine if a specific authentication level is allowed for a credential are: IF the level of the authentication type to be added <= current authentication level THEN add authentication type irrespective of enrolments. IF the level of the authentication type to be added > current authentication level AND the credential has an available authentication type with a level > authentication type to be added THEN do not add the authentication type irrespective of enrolments. IF the level of the authentication type to be added > current authentication level AND the level of the authentication type to be added >= min Gateway authentication level of any of the credential’s enrolments AND min Gateway authentication level of any of those enrolments > current authentication level THEN do not add authentication type.
8005 | The Credential has an invalid state for this action Each Credential has a number of states (e.g. Registered, Suspended), and specific methods require the Credential to be in a certain state. If the Credential is in the wrong state then this exception will be raised.
8006 | The Credential type specified is invalid Specific methods can only be performed for certain types of Credential (e.g. Principal, Agent, Admin etc.), if the supplied Credential is of the wrong type for the method then this exception will be raised.
8009 | The rules for creating a Credential password were failed A Registration Category will have rules for the strength of the password that has to be met. If the password fails these test then this exception will be raised. The text of the password will contain the rule failed.
8010 | The incorrect Credential type for the Registration Category has been supplied Registration Categories have to specify a Credential Type, if an Agent specific method is asked to create a Registration Category that is a Principal Credential type then this exception will be thrown.
8011 | The action you have attempted to perform is not valid for your authentication type Specific actions on the Gateway are only valid if you are an existing UserID Password user (e.g. Set Password) or Certificate user (e.g. UpdateCertificate). This exception will be raised if you attempt this action and you do not have the correct Authentication type.
8016 | The supplied existing password does not match the current password Some Gateway operations require the user to provide their existing password. If the supplied password does not match their current password on the Gateway this exception will be raised.
8018 | The credential cannot be identified Based on the information provided, the Gateway is unable to identify the credential. Check the supplied parameters.
8019 | Only a single UserID resend or Password Reset is allowed within a specified time period The Gateway does not allow a Credential to resend their UserID or Reset their password within a specified time period. If a Credential attempts to perform either of these actions within this time period then this exception will be thrown.
8020 | A Credential cannot be deleted if they have Direct Enrolments For a Credential to be deleted there can be no Direct Enrolments. It is valid to leave Client Allocations as the Credential may still want an Agent to act on their behalf. This exception will be thrown if any Direct Enrolments are found.
8022 | The credential must be an orphan The credential must be an assistant without a parent.
8023 | The credential must be within the same group The credential must be within the same group as the compared credential.
8024 | The credential has the wrong relationship The credential has the wrong relationship with the compared credential.
8025 | The credential is already assigned or deassigned to this enrolment or client allocation The credential has an invalid assignment with the enrolment.
8026 | The credential has the wrong type of role The credential has the wrong type of role to be used with this function. e.g. The credential is an assistant where a peer is required.
8028 | The Password cannot be used as it exists in the History A Registration Category can choose to use a Password History to stop users from using old passwords again. If a User attempts to use a Password that has previously been used this Exception is raised.
8029 | The Credential is not a member of an Organisation If the credential's registration category allows either peers or assistants then they are deemed to belong to an Organisation. This exception is raised when a Credential who does not belong to an Organisation attempts to call a method that controls Organisation specific functionality.
8031 | Unable to uniquely identify Credential as there are Peers and/or Assistants within the same group Due to the Credential being in a Group that contains other Peers or Assistants they cannot be uniquely identified. The action that is being performed requires the Gateway to be able to match a single Credential, and therefore for Security reasons cannot continue.
8033 | Unable to delete credential as there would be assistants but no peers within the group You cannot delete a peer if there are no other peers in the group but there are still assistants.
8034 | [CredentialType] credentials are denied access Specific methods may not be called by certain types of Credential (e.g. Admin), if the supplied Credential is of the wrong type for the method then this exception will be raised.
8035 | The Credential does not have an email address.
8045 | User ID already exists for the credential A credential can only have one User ID/password.
8046 | The Credential does not have a User ID The Credential must have a User ID/password.
8048 | The rules for creating a security phrase were failed The security phrase must satisfy all the rules before it is acceptable.
8055 | Invalid To reset Security Phrase inside three day period Through the GsoResetSecurityPhrase method the security phrase cannot be changed more frequently than every three days. This prevents multiple redundant security phrase letter being issued.
9001 | The service [servicename] requires unique identifiers The service flag UniqueIdentifier controls whether a service will allow the same Identifiers to be used for an Enrolment more than once. For the majority of services this flag is set. When creating a new identifier group for a service this flag is checked, if the flag is set and the supplied identifiers already exist then this error will be thrown.
9005 | The enrolment is not allocated to the Agent Group The Identifiers supplied did not have an existing Allocation to the Agent Group Code that was supplied. This could be because either the wrong Agent Group Code was supplied or that the Agent Group Code does not exist.
9006 | Invalid Identifiers supplied The supplied identifiers are invalid.
10002 | The enrolment or client allocation does not exist If a method cannot locate the enrolment or client allocation using the supplied information then this exception will be raised.
10004 | Multiple Enrolments are not valid for this service The service flag MultipleEnrolment determines if a Credential is allowed to have more than one enrolment in a Service, using different Identifiers. If a Credential attempts to Enrol more than once in a Service that does not allow Multiple Enrolments then this exception will be thrown.
10005 | The Credential is already using these identifiers for an existing enrolment in the service. The service flag MultipleEnrolments allows a Credential to enrol more than once in a service, and the service flag UniqueIdentifiers allows a service to accept existing identifiers for a new enrolment. However even with both these service flags a Credential is not allowed to enrol more than once in a service using the same identifiers.
10006 | AutoEnrolment is not allowed for this service The service flag AutoEnrolment determines whether AutoEnrolment is allowed to be performed for a Service. If this is false then this exception will be raised.
10009 | Too many activation attempts have been made. No more attempts left The maximum number of activation attempts has been exceeded. The Enrolment will now be deleted so any further attempts to activate the enrolment will return an EnrolmentDoesNotExistException.
10010 | The operation could not be run as the enrolment is in the wrong state Operations cannot be executed if the enrolment is not in the desired state.
10011 | The activation failed but you still have attempts left The activation failed but you have not exceeded the maximum number of attempts possible.
10012 | Credential not enrolled in service The service provided is not one that the credential has an enrolment in.
10013 | Invalid enrolment to reset Security Phrase The credential has an authentication level 1.5 enrolment but did not provide it
11001 | The Known Facts caused a Constraint Violation The Known Facts supplied could not be used as this would cause a Constraint Violation to occur in the database. As the Known Fact database is not under control of Gateway, we cannot determine the exact cause of the error, however the most common reason is because they already exist. Please contact Live Services for further assistance.
11002 | Empty Known Facts List Supplied No known facts were supplied for the method.
11003 | The name of the Known Fact fact was not known The name of the known fact that has been supplied did not exist in the known fact table. It is therefore invalid data.
11004 | Known Facts list contains duplicates The Known Facts supplied contained duplicates, this is not valid.
11005 | Invalid Known Fact CSV Row A syntax check is performed on Known Fact CSV data supplied to the SOAP bulk upload Interface before the known fact upload is scheduled. This error is returned when a row of known fact data fails the syntax check.
11006 | Invalid Known Facts supplied The Known Facts are translated by the Service Specific stored procedure. If the stored procedure does not return any Identifiers from the known facts then this exception is thrown.
11101 | Admin message queue entry does not exist The supplied Correlation ID does not correspond to a queue entry.
11103 | Admin message queue entry response already received A response has already been received for this queue item.
12001 | The Portal supplied does not exist The Portal supplied does not exist in the database.
13002 | The registration profile does not allow that type of role to be created by the credential The registration profile does not allow that type of role to be created by the credential.
13003 | The registration profile does not allow this method The registration profile can restrict access to specific methods. This exception will be raised if an attempt is made to call a restricted method.
13005 | The service is not valid for the registration category The registration profile can only be used for specific services. If a service is chosen that does not support this registration category then this exception will be thrown.
13006 | The Registration Profile does not exist The Registration Profile that has been supplied does not exist.
15001 | Self Service Unavailable The GsoSetPasswordOnlineVerification or GsoResendUserIDOnlineVerification method is temporarily locked out for this credential. This exception can also be returned from GsoSetPasswordOnline or GsoResendUserIDOnline; in this case the credential has supplied the correct information to the method but, since the corresponding "verification" operation is locked, the questions are not returned.
15005 | SecureInfoRequestDoesNotExist The Verification ID supplied is invalid.
15006 | The incorrect answers were supplied The answers provided to the know fact questions were incorrect.
15007 | Enrolment state changed since questions generated The state of an enrolment that was included for known fact question generation has changed since the known fact questions were generated.
16001 | The target resource does not exist The resource specified does not exist.
17001 | Unable to retrieve message with specified Id The MessageId supplied does not correspond to a mail message.
17002 | Message with specified Id has not reached delivery date For a mail message to be retrieved it must have reached its delivery date (this date is specified when a mail message is sent).
17003 | Unable to deliver message to the specified credential The mail message cannot be deposited in the specified credential’s mail message box.
17004 | Method is not available This method has not yet been made available and therefore cannot be called.
22001 | Document type doe not exist The service document class is invalid.
22002 | No average response time data for document class There is no average response time data samples for the service document class.
23001 | The supplied number of DirectEnrolment blocks exceeds the configured maximum Too many Direct Enrolments have been supplied by the method.
23002 | The supplied number of ClientAllocation blocks exceeds the configured maximum Too many Client Allocations have been supplied by the method.
23003 | No DRM matches found No enrolments could be assigned to the DRM session. All the supplied direct/client enrolments failed validation.
23005 | The supplied expiry time exceeds the configured maximum Currently the limit is set to 4 hour.
23006 | Non existing service(s) in delegation request [ServiceName] One (or more) of the services supplied is not a valid service.
23009 | No DRM enromnents specified No enrolments were provided.
24000 | Card Issuer does not exist The specified Card Issuer does not exist.
24001 | Card does not exist The specified card does not exist.
24002 | Card already exists The specified card already exists.
24104 | Unable to contact Card Issuer The Gateway is unable to connect to the specified Card Issuer.
24105 | Unhandled Card exception Unexpected error encountered during activation/deactivation call to Card Service.
24106 | Card activation failed Activation of the card failed.
24107 | Card deactivation failed Deactivation of the card failed.

© Crown Copyright 2008. All rights reserved