MOBILE-ID · TRUSTED LTANS
Layered error diagnosis
Separate TLS, OAuth, gateway, business and Core failures; retry without duplicating commands.
Diagnose the correct layer
The ADSS codes below reference chapter 11.8; the adapter must define public HTTP/codes for Core errors. This is not a claim that the current Mobile-ID Core returns these exact codes. Do not expose stack traces or internal storage/key details.
| Layer/source | Response scope | Diagnosis | Recovery |
|---|---|---|---|
| TLS handshake | Before HTTP | Server/client certificate, hostname, truststore and clock. | TLS may have no Problem JSON; never disable validation. |
| OAuth / IAM | 401 / 403 | Issuer, audience, exp/nbf, scopes, key rotation and organization mapping. | A new token grants no extra rights; no token logging. |
| Gateway | 429 / 503 under contract | Quota/rate or unavailable upstream; follow published wait guidance. | Retain idempotency key; reconcile before POST retry. |
| Core 48011 / 48031 / 48032 | Invalid/unassigned profile | Reconcile profile name, state and backend grant. | Adapter defines public code/HTTP; do not expose internal configuration. |
| Core 48012 / 48013 | Missing token / evidence generation failure | Check Job, TSA, source revision and internal correlated logs. | No EvidenceGenerated/EVIDENCE_READY before a valid result. |
| Core 48024 / 48025 | Operation blocked by profile | Check deletion policy, retention, holds and authority. | Not a network retry; authorized condition change required. |
| Core 48049 / 48051 / 48056 | Binding/integrity mismatch | Retain failure sample and exact bytes/evidence; inspect failed check. | Never relabel mismatch as VALID or missing data to hide it. |
| Transfer mismatch | 409 or agreed code | transfer/export/recipient/digest/scope and recipient report. | No acknowledgement or automatic source deletion; reconcile scope. |
Support handoff
Provide time/zone, endpoint, permitted correlationId/requestId/archiveId/jobId, impact and attempted steps. No tokens, private keys or real records in general discovery channels. Retain transaction keys for reconciliation; query uncertain commits before resubmission.