Player identity
Player-access error codes
Stable failures for session creation and bearer-authenticated Player APIs.
Player access fails closed and never falls back to another tenant, Player or anonymous identity.
| Code | Status | Meaning | Action |
|---|---|---|---|
PLAYER_INPUT_INVALID | 400 | The request does not match its contract. | Correct the request. |
PLAYER_SESSION_CREDENTIAL_INVALID | 401 | The backend credential is unknown, expired, revoked or belongs to an inactive account. | Use an active credential or replace it through the credential-management workflow. |
PLAYER_CONTEXT_INVALID | 401 | The Player bearer is missing, expired, forged, wrong-audience or contains legacy claims. | Assert the Player again from your backend. |
PLAYER_SESSION_RATE_LIMITED | 429 | The credential's distributed limit is exhausted. | Back off; do not create a session per API call. |
ACCESS_RATE_LIMITED | 429 | A Player-bearer route exhausted the tenant plan's distributed read or mutation window for this Player. | Back off and retry after the applicable plan window. |
PLAYER_SESSION_UNAVAILABLE | 503 | Credential resolution or a distributed session counter is unavailable. | Retry later; there is no local or cached fallback. |
PLAYER_SESSION_PROVISIONING_UNAVAILABLE | 503 | Tanitar could not complete tenant-scoped Player mapping or provisioning. | Retry the same assertion later; do not substitute another identity. |
PLAYER_CONTEXT_KEYS_UNAVAILABLE | 503 | A service cannot load Tanitar signing keys. | Retry without changing identity. |
ACCESS_STATE_UNAVAILABLE | 503 | Plan limits, control plane or distributed counters are unavailable. | Retry; there is no local fallback. |
The notification socket requests reauthentication before expiry and refuses a replacement token for a different account or Player. Treat codes as stable; messages are explanatory only.