Nova HTTP API

Blob bytes.

Partial blob bytes (Range request).

The blob belongs to a private collection; provide a valid signed URL or a bearer token for an authorized user.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The CID was deleted; the per-blob encryption key has been shredded and the gateway can no longer decrypt the bytes (which may still exist as ciphertext on volunteer disks).

The Range header could not be satisfied: the first byte position is at or past the end of the object, or the range set is otherwise unsatisfiable. The response carries a Content-Range header naming the true length, so a client can correct itself without a second probe; HEAD on the same path reports the length as well.

A syntactically malformed Range is not an error. Per RFC 9110 it is ignored and the complete object is returned with 200.

The CID is under moderation hold. Reads are suspended pending operator review.

Quarantine is reversible, and deliberately so: the bytes and the per-blob key both still exist, which is what makes a counter-notice meaningful. If the hold is lifted the same URL resolves again, unchanged, because the address is a hash of content that never moved. If it is not lifted, the blob is tombstoned when the window closes and this becomes a 410.

Signed URLs minted for the CID are revoked at the moment of quarantine, so an embedded copy stops rendering without waiting for its own expiry.

Blob exists; metadata returned in headers.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The CID was deleted; the per-blob encryption key has been shredded and the gateway can no longer decrypt the bytes (which may still exist as ciphertext on volunteer disks).

Blob metadata.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The CID was deleted; the per-blob encryption key has been shredded and the gateway can no longer decrypt the bytes (which may still exist as ciphertext on volunteer disks).

Image bytes.

The blob belongs to a private collection; provide a valid signed URL or a bearer token for an authorized user.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The CID was deleted; the per-blob encryption key has been shredded and the gateway can no longer decrypt the bytes (which may still exist as ciphertext on volunteer disks).

The CID resolves, but the stored object is not an image and the image transform pipeline cannot act on it. Fetch it through /blob/{cid} instead, which serves any product type as-is.

The CID is under moderation hold. Reads are suspended pending operator review.

Quarantine is reversible, and deliberately so: the bytes and the per-blob key both still exist, which is what makes a counter-notice meaningful. If the hold is lifted the same URL resolves again, unchanged, because the address is a hash of content that never moved. If it is not lifted, the blob is tombstoned when the window closes and this becomes a 410.

Signed URLs minted for the CID are revoked at the moment of quarantine, so an embedded copy stops rendering without waiting for its own expiry.

Image exists.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Image metadata.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The CID resolves, but the stored object is not an image, so there is no image metadata to return. Use /blob/{cid}.json for the product-agnostic metadata document.

Image bytes.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The extension names a format this operator has not enabled. The enabled set is deployment configuration rather than a property of the stored image; Accept negotiation is not performed, so request one of the enabled extensions explicitly.

The CID was deleted; the per-blob encryption key has been shredded and the gateway can no longer decrypt the bytes (which may still exist as ciphertext on volunteer disks).

Image bytes.

Either no object with that CID is known here, or the named preset is not configured on this deployment. The two are deliberately not distinguished, so that probing preset names cannot be used to enumerate stored CIDs.

The extension names a format this operator has not enabled. The enabled set is deployment configuration rather than a property of the stored image; Accept negotiation is not performed, so request one of the enabled extensions explicitly.

Image bytes.

The requested dimensions are not on this operator's whitelist. Arbitrary sizes are refused deliberately: each distinct size is a distinct derivative to generate, store and replicate, so the whitelist is what stops a crawler minting unbounded work. Use a whitelisted size or a named preset.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The extension names a format this operator has not enabled. The enabled set is deployment configuration rather than a property of the stored image; Accept negotiation is not performed, so request one of the enabled extensions explicitly.

Image bytes.

The requested dimensions are not on this operator's whitelist. Arbitrary sizes are refused deliberately: each distinct size is a distinct derivative to generate, store and replicate, so the whitelist is what stops a crawler minting unbounded work. Use a whitelisted size or a named preset.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The extension names a format this operator has not enabled. The enabled set is deployment configuration rather than a property of the stored image; Accept negotiation is not performed, so request one of the enabled extensions explicitly.

Blob created.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The declared or actual body length exceeds this operator's max_upload_size. The limit is enforced before the bytes are accepted, so nothing was stored and no upload session remains to resume. Split the object or ask the operator to raise the ceiling.

Image created.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The uploaded file's detected media type is not one this coordinator accepts as an image. Detection is by content sniffing rather than by the supplied filename or Content- Type, so renaming the file will not change the outcome. Upload it through POST /api/v1/blobs if you want it stored as a non-image product.

The content hashes to a CID on this operator's blocklist and was refused at ingest. Because the address is derived from the bytes, an identical file will always be refused; nothing was stored.

Upload created.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The declared or actual body length exceeds this operator's max_upload_size. The limit is enforced before the bytes are accepted, so nothing was stored and no upload session remains to resume. Split the object or ask the operator to raise the ceiling.

Chunk accepted.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Upload-Offset does not match the offset the coordinator holds for this session, so the chunk would leave a gap or overwrite bytes already committed. Issue HEAD /api/v1/uploads/{id} to read the authoritative offset and resume from exactly there. This is the normal tus recovery path after a dropped connection, not an error condition in itself.

Upload deleted.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Offset and metadata returned in headers.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Upload finalized.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Finalisation was requested before every byte arrived: the session's offset is short of the declared Upload-Length. The session is untouched and still resumable — continue PATCHing from the current offset and call finalize again once they match.

Blob metadata.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Blob metadata updated.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Soft-delete accepted (owner or operator).

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The blob is not active (already soft-deleted, quarantined, or tombstoned).

Image metadata.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Image metadata updated.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Deletion accepted.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Current user.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

Collection list.

Collection created.

Collection.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Updated collection.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Collection deleted.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Item added.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Item removed.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Near-duplicate matches.

Audit log entries.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

Integrity audit log entries.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

Pin audit log entries.

Blob listing.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

DMCA cases.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

DMCA case detail.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The census.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

Job listing.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

Rotation accepted. The total_deks and total_signing_keys counts are the initial totals (returned once here); the CLI derives progress from initial − remaining by polling GET /api/v1/admin/keys/rotation-status.

Validation failure. code is one of: - to_not_active: to_version is not the current active label (restart required). - invalid_from_version: from_version is not loaded, unknown, already retired, or equals to_version.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

A master-key rotation is already in progress. Only one may run at a time, because two concurrent rewrap passes over the same key material could leave envelopes wrapped under a version neither pass completes. Poll GET /api/v1/admin/keys/rotation-status and start the next rotation once this one settles.

Key rotated; previous key remains valid until grace_expires_at.

Current rotation status.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

Blocklist entries.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

CID added to blocklist.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

CID removed from blocklist.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Legal hold cleared; tombstone scheduled.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Counter-notice recorded; tombstone schedule cleared.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

CID quarantined.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Moderation queue.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

CID restored to active.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Restore applies only to a blob currently in quarantined. The target is in some other state — already active, or tombstoned, which is terminal because the key is gone. GET /api/v1/admin/blobs/{cid} reports the current state.

CID tombstoned and DEK shredded.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

No usable credential was presented. Either the Authorization header was absent, or the bearer token was malformed, expired, or signed by a key this coordinator no longer trusts. Obtain a new access token from POST /api/v1/auth/refresh and retry once; a second 401 means the refresh token is also spent and the client must log in again.

Note the difference from 403: a 401 says the coordinator does not know who you are, not that you may not do this.

The caller was identified but is not permitted to perform this action. Three distinct situations produce it, distinguishable by code:

• the account's role does not carry the required permission (management routes are operator- or moderator-only);
• the object belongs to another owner and the caller is not an operator;
• a signed URL was presented and failed verification — expired, bound to a different aud, signed by a revoked kid, or tampered with. Those return a signature_* code.

Re-authenticating does not help. The credential is valid; the action is not permitted for it.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

The blob's data encryption key carries a legal hold, and the database refuses to shred a held key. This is the intended interlock: it stops a takedown destroying evidence that a live matter requires. Clear the hold with POST /api/v1/admin/moderation/clear-legal-hold first, then retry.

Node list.

Node detail.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Revocation accepted; healing dispatched asynchronously.

No object with that identifier is known to this coordinator. For content routes this means the CID has never been ingested here — content addressing makes it a statement about this federation, not about the bytes, so the same CID may well resolve on another one.

Distinguish from 410, which means the object was here and has been deleted, and from 403, which means it exists but is not yours to read.

Pin assignments.

Revocation recorded (idempotent on the (kind, value) pair).

Unknown kind (must be cid, aud, kid, or path_prefix) or empty value.

Signed URL minted.

The signing request was rejected before a URL was minted. One of: path is not a content route (only /blob/{cid} and /i/{cid}/... may be signed); aud is not a bare origin of the form scheme://host[:port] — a path or a wildcard will be refused; or ttl_seconds is zero or negative. No signing key was touched.

Auth discovery document.

JWKS (OKP/Ed25519 signing key).

This coordinator is configured to delegate authentication to an external OIDC provider, so its own token issuer is switched off and the route does not exist. Obtain a token from the configured provider instead; GET /api/v1/auth/config reports which mode is active.

Token pair.

Authentication failed. The response is deliberately identical for an unknown username and a wrong password so the endpoint cannot be used to enumerate accounts, and it is rate-limited per address. Repeated failures will begin returning 503 before they return anything more informative.

This coordinator is configured to delegate authentication to an external OIDC provider, so its own token issuer is switched off and the route does not exist. Obtain a token from the configured provider instead; GET /api/v1/auth/config reports which mode is active.

The login path is shedding load: either the per-address rate limit tripped or the bounded password-hashing pool is saturated. This is back-pressure rather than a failure — honour Retry-After where it is present and retry with backoff. Credentials were not evaluated.

Logged out (idempotent).

This coordinator is configured to delegate authentication to an external OIDC provider, so its own token issuer is switched off and the route does not exist. Obtain a token from the configured provider instead; GET /api/v1/auth/config reports which mode is active.

New token pair.

The refresh token was rejected. It was expired, already revoked, or — the case worth knowing about — presented a second time. Refresh tokens are single-use, and replay is treated as evidence of theft: the whole token family is revoked, which logs out every session descended from that login. Authenticate again with credentials.

This coordinator is configured to delegate authentication to an external OIDC provider, so its own token issuer is switched off and the route does not exist. Obtain a token from the configured provider instead; GET /api/v1/auth/config reports which mode is active.

Notice recorded; no action taken automatically.

The request could not be parsed or failed validation before any work was attempted: a malformed CID, a body that is not valid JSON, a missing required field, or a parameter outside its permitted range. The code field names the specific failure and details carries the offending field where one can be identified. Retrying the identical request will fail identically; fix the request first.

DSAR information.

Healthy.