# Machine identity v1 stable errors

| Code | Meaning | Retry |
|---|---|---|
| `machine_token_missing` | Authorization bearer token is absent or malformed | No, fix request |
| `machine_token_invalid` | Header, claims, signature, request binding or key is invalid | No |
| `machine_token_expired` | Token is outside its accepted time window | Mint a new token |
| `machine_audience_denied` | Exact audience does not match | No |
| `machine_scope_denied` | Required scope is absent or not granted to the key | No |
| `machine_identity_revoked` | Principal or key is disabled/revoked | No; operator action |
| `machine_token_replayed` | The same principal/jti was already accepted | Retry with a new token and the same business idempotency key |
| `machine_transport_required` | HTTPS policy is not satisfied | No; fix deployment |

Responses and audit facts never include the token, signature, key material or Authorization header.