Sign in: the signed consent

The body is not a JSON object, contains duplicate keys or has trailing data.

Send one valid JSON object with Content-Type application/json.

A path, query or body field is missing, malformed or outside its accepted range.

Correct the field named in error.message before sending again.

The HTTP request signature does not verify.

Sign the exact method, path and body bytes, without changing them afterwards.

The signed timestamp is outside the accepted clock window.

Compare the server Date header with your clock, then generate a fresh nonce, timestamp and signature.

The device signing key is suspended by Veil staff.

Use an authorised active key or ask staff to review the restriction.

The signing key does not have authority over this card or operation.

Use an active device key with the required owner or member role.

The card is suspended by the Veil staff, so it cannot sign in to apps.

Nothing to retry while the suspension lasts.

The requested card, key, alias, code or resource was not found.

Check the identifier. Temporary codes and previews may already have expired or been used.

The card existed and was erased or removed. The response also carries its public erasure receipt.

Stop using this card as current authority. Retain only the public receipt if needed.

The sign-in request was used or is older than 30 minutes.

Go back to the app and start again.

The request body exceeds this endpoint’s byte limit.

Reduce the encoded body. API-key management accepts at most 8 KiB.

The consent text is not the one this request needs: a field differs, is missing or is extra, or the JSON is not canonical.

Build the text from GET /oidc/requests/{id} as it is, then sign it.

The public log cannot currently be read, verified or used for publication.

For reads, keep the result unverified and try later. Before retrying a write, read the card to check whether publication completed.