7 MyID Operator Client error codes

OA10000

Server Error

An internal server error has occurred.

Retry the operation; the cause could be a temporary issue such as a database timeout due to server load.

If the problem persists, check the System Events and Audit Reporting workflows within MyID, then the web.oauth2 logs for more information. For information on configuring logging, see the MyID REST and authentication web services section in the Configuring Logging guide.

OA10001

Unable to communicate with app - ensure that MyID UMC app (MyIdClientService) is running

The web page has been unable to communicate with the MyID Client Service.

Make sure the MyID Client Service is installed and running.

See the Installing the MyID Client Service section in the Installation and Configuration Guide.

Make sure that the browser you are using supports websockets connections to ws://localhost. See the Supported browsers section in the MyID Operator Client guide.

OA10002

Invalid credentials

The credentials you have supplied for authentication are not valid.

Supply valid credentials for logon.

OA10003

You do not have sufficient security questions configured

The person attempting to log on must have sufficient security questions set up on their account. The number of required security phrases is specified by the Number of security questions for self-service authentication configuration option.

Use the Change Security Phrases or Change My Security Phrases workflows to provide the required security phrases. See the Setting security phrases section in the Operator's Guide.

Alternatively, you can set a lower value for the Number of security questions for self-service authentication option. See the Setting the number of security phrases required to authenticate section in the Administration Guide.

OA10004

Your username or security response is incorrect, or you may not have permission to access this client.

The person attempting to log on has mistyped their username or security responses.

Try again.

Note: If the number of failed attempts exceeds the configuring maximum (by default, three) the person may be locked out and will have to have their security phrases unlocked. See the Configuring the number of attempts to enter security phrases section in the Administration Guide.

OA10005

The registration link is invalid

The registration job ID is not a valid job ID.

This can also occur if there is a problem with the request that is being collected, or the request is not at the ‘Awaiting Issue’ status; for example, if it has been canceled.

Carry out the request again.

OA10006

Logoncode OTPs are disabled on the server

The Allow Logon Codes option is not set on the server, or the person's role does not have access to the Password logon mechanism.

Set the Allow Logon Codes option, make sure the person has access to the Password logon mechanism, then try again.

See the Setting the configuration options and the Configuring roles for registering FIDO authenticators sections in the FIDO Authenticator Integration Guide for details.

OA10007

Your OTP has been entered incorrectly, is locked, has expired, or you do not have permission to perform this operation. Please try again.

The registration code was incorrect, has expired, or has been entered incorrectly too many times, or you do not have access to the Register FIDO Security Key operation.

Retry entering the registration code. If it continues to fail, it may be locked. Request another FIDO authenticator.

You can use the automatic job cancellation feature in MyID to remove any old uncollected, locked, or expired jobs; see the Automatic job cancellation section in the Administration Guide.

Check that your have access to the Register FIDO Security Key operation; see the Configuring roles for registering FIDO authenticators section in the FIDO Authenticator Integration Guide for details.

OA10008

Your session has timed out or is invalid, please try again

You may have waited too long to complete the registration process.

Try again.

If you have already used your registration code, you must request the FIDO authenticator again, which will send you a new registration code.

OA10009

Error registering FIDO in browser

The ServerDomain app setting may configured incorrectly. Note that ServerDomain is case sensitive and must be consistent with the casing of the DNS Name in the web server's TLS certificate.

Set the ServerDomain in the app settings file.

See the Setting up the FIDO metadata section in the FIDO Authenticator Integration Guide for details.

OA10010

Error authenticating FIDO in browser.

A cause of this is if the FIDO credential was registered on a website running a different origin to the website that is performing the authentication – at registration, FIDO credentials become locked to the origin on which they were registered.

This may also occur if the web.oauth2 Fido:Config:Origin is configured incorrectly in the authentication service app settings file. Note that Origin is case sensitive and must be consistent with the casing of the DNS Name in the web server's TLS certificate

Set the Origin in the app settings file.

See the Setting up the FIDO metadata section in the FIDO Authenticator Integration Guide for details.

OA10011

FIDO authentication failed, please try again. You may not have permission to access this client.

This may occur when the credential profile for a FIDO authenticator was set up to require user verification, but the FIDO authenticator does not support that feature.

This may also occur when you are attempting to log on with a FIDO authenticator without providing a username, but the credential profile was not set up with the Require Client Side Discoverable Key option, and consequently the FIDO authenticator does not have the key required for logon without a username.

Try a different FIDO authenticator, try a credential profile that has been set up with less stringent requirements, or try a credential profile that sets up the client side discoverable key; see the Setting up credential profiles for FIDO authenticators section in the FIDO Authenticator Integration Guide for details.

OA10012

FIDO registration failed, the FIDO token used to register was not trusted. Try a different FIDO token if you have one. <details>

The FIDO authenticator you have tried to register failed the attestation check.

Try a different FIDO authenticator.

OA10013

FIDO registration failed, user mismatch

The FIDO authenticator cannot be registered as there is a problem matching the user.

Try registering the authenticator to a different user.

OA10014

FIDO registration failed, the credential profile is invalid

The credential profile is not valid, or the person for whom the FIDO authenticator was requested has changed roles, and can no longer receive the originally-requested credential profile.

Request a FIDO authenticator using a different credential profile, and try again.

OA10015

FIDO registration failed, this token is already registered

The FIDO authenticator is already registered.

Try a different FIDO authenticator.

OA10016

FIDO registration failed, the credential profile is set to Enforce Authenticator Attestation Check, but the token registered does not have metadata available on the server. Try registering a different token.

The manufacturer did not register metadata with the FIDO metadata service, and the file-based metadata does not include information about this token. This token cannot be used with this credential profile.

Either register a different token, register this token to a different credential profile using a credential profile that does not have Enforce Authenticator Attestation Check set, get the token manufacturer to publish the metadata for this token to the FIDO metadata service, or obtain the FIDO metadata and configure it manually on the server using the MDSCacheDirPath setting.

See the Setting up credential profiles for FIDO authenticators or Setting up a local metadata repository section in the FIDO Authenticator Integration Guide for details.

OA10017

FIDO registration failed, there was a problem accessing the FIDO Metadata Server

There was a problem trying to get a metadata TOC payload entry from the FIDO metadata service.

Check that the URLs https://*.fidoalliance.org are accessible from the web server and try again.

OA10018

You do not have any FIDO tokens registered

The person has attempted to authenticate to the MyID authentication service using FIDO, but does not have any registered FIDO authenticators.

Request a FIDO authenticator for the person.

OA10019

Username should not be null or empty

The MyID Username claim was missing in the cookie for the call to logon with FIDO.

Restart the browser and try again.

OA10020

FIDO basic and FIDO high logonmechanisms are disabled for this client

No supported FIDO logon mechanisms were found.

This may be the result of an attempt to bypass FIDO logon mechanisms. Make sure you have gone through the correct procedure.

OA10021

Invalid return URL

The return link from a logon authentication call was invalid.

This may be the result of a redirect attack or a malicious link. Make sure you have gone through the correct procedure.

OA10030

MyID:Database:ConnectionStringCore is not configured

A configuration file error has occurred. You must configure a database connection string.

Check the configuration file settings – ConnectionStringCore must be configured.

See the Configuring the standalone authentication service section in the MyID Authentication Guide.

OA10031

MyID:Database:ConnectionStringAuth is not configured

A configuration file error has occurred. You must configure a database connection string.

Check the configuration file settings – ConnectionStringAuth must be configured.

See the Configuring the standalone authentication service section in the MyID Authentication Guide

OA10032

Unable to find configured JWT signing certificate

No JWT signing certificate was found, but JWT signing is configured.

Check the JWT settings. See the Load balancing section in the MyID Operator Client guide.

OA10033

No JWT signing certificate configured and no RSA signing key containername configured

MyID is configured to use a previously configured RSA keyname but no RSA container name was found.

Check the JWT settings. See the Load balancing section in the MyID Operator Client guide.

OA10034

JWT signing key is configured, but has an incorrect algorithm or key size

MyID has found an RSA key with an incorrect algorithm or key size.

Check the JWT settings. See the Load balancing section in the MyID Operator Client guide.

OA10035

Generated JWT signer certificate, but unable to load it

A server error has occurred while attempting to validate the generated signer certificate.

Check the JWT settings. See the Load balancing section in the MyID Operator Client guide.

OA10036

No JWT signing certificate configured and no RSA signing key containername configured, and not configured to generate a JWT signing key

A configuration error has occurred. No authentication method has been set.

Check the JWT settings. See the Load balancing section in the MyID Operator Client guide.

OA10037

You do not have permission to perform this operation. Your permissions could not be verified

A valid access token has not been supplied to authorize this extension grant. The token may be missing, may not contain the required claims.

Check that your system is providing the correct data for the extension grant.

OA10038

You do not have permission to perform this operation

This can happen if the caller does not have scope over the object (request, device or person) in the context of the operation being performed.

Check the roles that the person has and check the permissions these roles give in Edit Roles.

OA10039

You do not have permission to perform this operation on the identified object or the identified object does not exist

This can happen if the caller does not have scope over the object (request, device or person) in the context of the operation being performed.

Check the roles that the person has and check the permissions these roles give in Edit Roles.

OA10040

Your assigned roles do not have permission to collect this request’s credential profile

The credential profile does not include any of your roles in the Can Collect option.

Edit the credential profile to add one of your roles to the Can Collect options for the profile.

OA10041

Authorization failure, missing data

Data required to perform the extension grant is missing. This should not be seen through the MyID Operator Client but may occur if integrating third party systems to perform token operation extension grants if they do not supply the required data.

Check that your system is providing the data required to perform the extension grant.

OA10042

This item is not in the correct state to perform this operation

You have attempted to carry out an operation that requires a particular status; for example, collecting a card requires a job status of Awaiting Issue. If this error occurs, the status is no longer correct for the operation; this may occur when multiple operators attempt to carry out an operation on the same item.

Go back and attempt the operation again from the beginning; if the item is not in the correct status, you should not be offered the opportunity to carry out the operation.

If you are using the self-service menu in the MyID Operator Client, click Check For Updates to refresh the list of available actions before attempting the operation again.

OA10043

Your assigned roles do not have permission to unlock this device

When the configuration flag Constrain Credential Profile Unlock Operator is set, when unlocking devices for other users you require the Can Unlock permission for the credential profile of that device.

Edit the credential profile to add one of your roles to the Can Unlock options for the profile.

OA10044

You cannot perform this operation on yourself

You have attempted to perform and operation that is not allowed for self-service on your own account.

Either perform the operation on another person's account, or get another operator to perform the operation on your account.

OA10045

You cannot perform this operation on others

You have attempted to perform an operation that is allowed for self-service only on another person.

Either perform the operation on your own account, or get the other person to perform the operation on their own account.

OA10046

The OTP has expired

The authentication code has expired.

Request a new authentication code.

The lifetime of authentication codes is controlled by the following configuration options on the Auth Code page of the Security Settings workflow:

• Auth Code Lifetime

• Auth Code Lifetime for Immediate Use (for short-use codes; for examples, authentication codes requested at the logon screen of the MyID Operator Client for immediate use).

OA10047

This item does not meet the requirements to perform this operation

An operation for pass-through authentication has a condition that has not been met. Launching this operation is not allowed.

This operation can be performed only if the subject of the operation meets the criteria configured for the operation. Ensure that the subject of the operation meets the configured criteria, or if these have been customized in MyID Project Designer, ensure that this has been configured correctly.

OA10048

The user does not have the required contact details for this delivery mechanism

A notification cannot be sent, the required contact details (email address or cell phone number) are not known for this user.

Contact an administrator to get the contact details updated.

OA10049

An error occurred capturing the fingerprint. Please try again

MyID failed to capture the fingerprint due to an issue with the fingerprint reader.

Check that the fingerprint reader is connected, and that its drivers are installed correctly.

OA10050

Number of fingerprint attempts has been exceeded

The number of attempts to capture fingerprints has exceeded the configured maximum (the Number of fingerprint validation attempts configuration option on the Biometrics page of the Operation Settings workflow), either through failure to match or verify, or failure to capture.

Close the authentication popup window and try again. If you continue to experience failures, check that your fingerprint reader is connected, and that its drivers are installed correctly.

OA10051

No match was found for the fingerprint

A fingerprint was captured, but no match was found in MyID.

Check that you have fingerprints captured in your MyID user account.

OA10052

Authorization failure, missing data

The request for the secondary authentication extension grant is missing some information.

Check the call to get the secondary authentication extension grant has the required parameters, such as the necessary tokens.

OA10053

You do not have permission to perform this operation

The primary token (the MyID Logon token) is invalid.

Check that the MyID Logon token is valid, and has not expired.

OA10054

You do not have permission to perform this operation

The secondary authentication token (biometric) failed validation against MyID.

Check the secondary authentication token has the required claims and validity.

OA10055

You do not have permission to perform this operation

The tokens were valid, but the user's or token's permission has been denied for the attempted operation.

Check your MyID configuration for operation authentication.

OA10056

Invalid request for Secondary Authentication

Invalid data was found when attempting to verify the Secondary Authentication token.

Check your MyID configuration for operation authentication.

OA10057

A required claim is missing for Secondary Authentication

The secondary authentication token presented was missing required claims.

Check your MyID configuration for operation authentication.

OA10058

There are no fingerprints registered for this person

The user has tried to authenticate with a fingerprint, but no fingers are registered or enrolled in MyID.

The user must enroll fingerprints.

OA10059

There are no update jobs to collect for this device

There are no update jobs available to be collected for this device.

There may not be any jobs or there may be jobs awaiting validation. Check that there are appropriate update jobs available for the device.

OA10060

The credential profile to be collected requires user data approval, but the target user has no such approval

The person for whom you are attempting to collect the card for is not approved, but has a credential profile requiring approval.

Use a different credential profile, or approve the person.

OA10061

The credential profile to be collected requires terms and conditions to be accepted, but assisted collection of updates does not support this

The credential profile being collected requires terms and conditions to be accepted, but this is not supported by Assisted Collect.

Collect this profile using a self service operation, or use a different credential profile.

OA10062

MyID client service is not running

You have attempted to use the Manage My Credentials option on the MyID Authentication screen, but the MyID Client Service application is not running.

Close the MyID Authentication screen, start the MyID Client Service, then click Sign In and Manage My Credentials again.

See the Managing your credentials from the MyID Authentication screen section in the MyID Operator Client guide.

OA10063

You cannot retrieve security questions for this client

You have attempted to use headless passphrase authentication (for example, for PIN unlock for mobile identities) but the client ID specified in the API call is not listed in the application settings file.

Check that the appsettings.Production.json and appsettings.json files for the web.oauth2 web service are correctly configured.

OA10064

The security questions logonmechanism is disabled for this client

You have attempted to use headless passphrase authentication (for example, for PIN unlock for mobile identities) but either the Password Logon mechanism (on the Logon Mechanisms page of the Security Settings workflow) or the EnableHeadlessPassphraseLogin option (in the application settings JSON file for the web.oauth2 web service) is not enabled. Both must be enabled to use this feature.

Check that the Password Logon option and the appsettings.Production.json and appsettings.json files for the web.oauth2 web service are correctly configured.

OA10065

You cannot retrieve a challenge for this client

You have attempted to use headless card authentication (for example, for certificate renewal for mobile identities) but the client ID specified in the API call is not listed in the application settings file.

Check that the appsettings.Production.json and appsettings.json files for the web.oauth2 web service are correctly configured.

OA10066

The smartcard logon logonmechanism is disabled for this client

You have attempted to use headless card authentication (for example, for certificate renewal for mobile identities) but either the Smart Card Logon mechanism (on the Logon Mechanisms page of the Security Settings workflow) or the EnableHeadlessCardLogin option (in the application settings JSON file for the web.oauth2 web service) is not enabled. Both must be enabled to use this feature.

Check that the Smart Card Logon option and the appsettings.Production.json and appsettings.json files for the web.oauth2 web service are correctly configured.

OA10067

Key-pair authentication failed, or you may not have permission to access this client

You have attempted to use headless card authentication (for example, for certificate renewal for mobile identities) but the key pair used is invalid.

Try the operation again.

OA10068

Windows logon failed, your windows account is unknown or untrusted

You have attempted to sign in using Windows authentication, but your Windows account is not suitable.

See the Signing in using Windows authentication section in the MyID Operator Client guide.

OA10069

Windows logon failed, your user account is not permitted to logon

You have attempted to log on to MyID using Windows authentication, but the specified user account does not have permission to do so.

Make sure the logon name provided exists, and has permission to log on with Windows authentication.

See the Signing in using Windows authentication section in the MyID Operator Client guide.

OA10070

Windows Authentication is disabled on the server

You have attempted to log on to MyID using Windows authentication, but your server is not configured to allow it.

Check that the Integrated Windows Logon mechanism is enabled on the Logon Mechanisms page of the Security Settings workflow.

On the MyID web server, in IIS, check the Authentication settings for web.oauth2, and make sure that both Anonymous Authentication and Windows Authentication are enabled.

See the Signing in using Windows authentication section in the MyID Operator Client guide.

OA10071

Refresh Token failed to retrieve token

The refresh token could not be found in the internal store, based on the handle provided.

Check the token handle being sent, or log off and try again.

See the Signing in using Windows authentication section in the MyID Operator Client guide.

OA10072

Authorization failure, missing data for Token Refresh

This error may be caused by the request for the Refresh token missing the token handle value (the value returned with the initial logon token).

Check the token handle being sent, or log off and try again

See the Signing in using Windows authentication section in the MyID Operator Client guide.

OC10001

There are no actions available for your current logon method and the roles that you have been assigned.

You have not been assigned any actions for use in the MyID Operator Client.

Ensure that the roles you have assigned provide MyID Operator Client actions.

See the Roles and groups section in the MyID Operator Client guide.

OC10002

This web browser cannot be used. Please use an alternative web browser.

An unsupported browser has been detected. Due to the browser technology used, you cannot use Internet Explorer to access the MyID Operator Client.

The MyID Operator Client is designed to work on a range of browsers running on Windows 10 or Windows 11, excluding Internet Explorer. You are recommended to use Google Chrome, Microsoft Edge (Chromium version) or Mozilla Firefox.

See the Supported browsers section in the MyID Operator Client guide.

OC10003

There has been a problem on the server and it is not possible to continue.

The API server is unreachable or has been configured incorrectly.

Confirm that the API server is reachable, and has been configured correctly.

Check the URLs in the web service configuration files; they must use https and be valid URLs. See The rest.core web service configuration file and The web.oauth2 web service configuration file sections in the MyID Operator Client guide for details of the web service configuration files.

The REST-based web services require HTTPS, and will not operate if this is not set up. For more information, see the REST-based web services section in the System Interrogation Utility guide.

OC10004

The server could not be contacted. Please try again.

Connection to the server unavailable. Either the client is not connected to the Internet, or the server is offline.

Confirm that the API server is reachable, and try again.

Confirm that you have the correct server address specified; see the Specifying the server for the MyID Client Service section in the MyID Operator Client guide.

OC10005

The file you have uploaded is not an image. Please upload an image.

You can choose from the following file types:

• JPEG (*.jpg, *.jpeg)

• Bitmap (*.bmp)

• Graphics Interchange Format (*.gif)

• Portable Network Graphics (*.png)

If you select a file of the wrong type, MyID displays an error.

See the Uploading an existing image file section in the MyID Operator Client guide.

OC10006

MyID Client Service error

You have attempted to use a feature provided by the MyID Client Service App, but the app is not running, or is configured incorrectly.

This may occur when accessing smart card, editing captured images, or other operations provided by the MyID Client Service App. Make sure the app is running.

See the Installing the MyID Client Service section in the Installation and Configuration Guide for instructions on installing the MyID Client Service.

This may also occur if MyID Desktop or the Self-Service App could not be found at the configured path.

See the Setting the location of MyID Desktop or the Self-Service App section in the MyID Operator Client guide.

OC10007

A problem has occurred when connecting to the camera.

The MyID Image Capture component cannot make a connection to the camera.

The camera might be in use or has a low maximum supported camera resolution.

Confirm that the camera is operating correctly and can support a minimum resolution of 640x480.

Confirm that the camera is not currently in use in another application, then start Image Capture again.

OC10008

Unable to launch the MyID Desktop or Self-Service App. Please check configuration and try again.

MyID Desktop or the Self-Service App could not be found at the configured path. Check the MyID Client Service log in the Windows system tray for further details.

Confirm that the application is installed and available at the configured location.

See the Setting the location of MyID Desktop or the Self-Service App section in the MyID Operator Client guide.

OC10009

Unable to connect to MyID Desktop or the Self-Service App. Please try again.

The MyID Client Service failed to start a client application due to a timeout error. Check the MyID Client Service log in the Windows system tray for further details.

Try again. If this issue persists, confirm that MyID Desktop and the Self-Service App are able to start within the configured timeout setting. This issue has been seen on environments where there is no Internet connection.

See the Troubleshooting MyID Client Service connection issues section in the MyID Operator Client guide.

OC10010

Unable to launch MyID Desktop or the Self-Service App. Please try again.

MyID Desktop or the Self-Service App is running but is already servicing a request. Try again when the current request has been completed. Check the MyID Client Service log in the Windows system tray for further details.

Try again when the current request has been completed.

OC10011

The item is not available. Check the link is valid and you have permission to access this information.

The operation or entity provided in the URL link is not available. Confirm that the link provided is valid and you have permissions for the operation specified.

Confirm that you have permissions to the link provided and try again.

OC10012

The item is not available. Check the link is valid and you have permission to access this information.

The search provided in the URL link is not available. Confirm that the link provided is valid and you have permissions for the search specified.

Confirm that you have permissions to the link provided and try again.

OC10013

Unable to launch MyID Desktop or the Self-Service App. Please check installed version and try again.

An incorrect version of MyID Desktop or the Self-Service App has been detected.

Confirm that the correct version of MyID Desktop or the Self-Service App is installed, and try again. You may have to upgrade your version of MyID Desktop or the Self-Service App to the latest version to support the feature you are trying to use.

If you have more than one version of the client software installed, make sure that the MyID Client Service is configured with the location of the correct version. See the Setting the location of MyID Desktop or the Self-Service App section in the MyID Operator Client guide.

OC10014

This action cannot be performed. Please check the installed version of MyID Client Service, and try again.

The version of MyID Client Service that is currently installed does not support performing this action.

Install a later version of MyID Client Service, and try again.

OC10015

At least one record must be selected in order to perform this operation.

You have attempted to run a batch operation with no items selected. This may occur if you attempt to return to an intermediate URL in the batch process.

Return to the main screen and try the operation again.

OC10016

Your login has expired. Please re-authenticate to the MyID Operator Client.

Due to inactivity, you have been logged out of the MyID Operator Client.

Re-authenticate to the MyID Operator Client using the same user and logon mechanism.

See the Timeouts and re-authentication section in the MyID Operator Client guide.

OC10017

You have re-authenticated to the MyID Operator Client with a different user. For security reasons, the operation has been canceled.

A different user was used to re-authenticate to the MyID Operator Client. You have returned to the home page, and the previous operation has been canceled.

Use the same user and logon mechanism that was previously used to complete the intended operation.

See the Timeouts and re-authentication section in the MyID Operator Client guide.

OC10018

You have re-authenticated to the MyID Operator Client with a different logon mechanism. For security reasons, the operation has been canceled.

A different logon mechanism was used to re-authenticate to the MyID Operator Client. You have returned to the home page, and the previous operation has been canceled.

Use the same logon mechanism that was previously used to complete the intended operation.

See the Timeouts and re-authentication section in the MyID Operator Client guide.

OC10019

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using the MyID Client Service. This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.

If this issue can be reproduced, examine logs from the MyID Client Service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support.

OC10020

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using MyID client services. This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.

If this issue can be reproduced, examine logs from the MyID client service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support.

OC10021

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using MyID client services. UMC threw an exception when we called AcceptPkcs7Ex2. This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.

This error may be caused by the certificate policy for a soft certificate not having the Private Key Exportable option set.

See the Setting up a credential profile for soft certificates section in the Administration Guide for details.

This issue may also occur if the certificate file name generated from the certificate policy name contains invalid characters.

As a workaround, you can customize the file names; see the Customizing certificate file names section in the MyID Operator Client guide.

If this issue can be reproduced, examine logs from the MyID client service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support.

OC10022

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using MyID client services. Failed to load an archived certificate into a .NET x509 object. This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.

If this issue can be reproduced, examine logs from the MyID client service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support.

OC10023

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using MyID client services. Failed to add an archived certificate to the user store. This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.

If this issue can be reproduced, examine logs from the MyID client service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support.

OC10024

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using MyID client services. Request included an extension that is not explicitly permitted. Default allowed extensions are .pfx and .cer. This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.

This issue may occur if the certificate file name generated from the certificate policy name contains invalid characters.

As a workaround, you can customize the file names; see the Customizing certificate file names section in the MyID Operator Client guide.

If this issue can be reproduced, examine logs from the MyID client service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support.

OC10025

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using MyID client services. Auto-save has been disabled in the client configuration file. This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.

If this issue can be reproduced, examine logs from the MyID client service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support.

OC10026

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using MyID client services. An exception was thrown when we tried to write a certificate to a file. This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.

If this issue can be reproduced, examine logs from the MyID client service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support.

OC10028

The printer is unavailable. Please check the printer is operational and not in use.

There has been a problem with the printer.

Check the printer for any messages.

OC10029

The printer reported the print operation has failed. Please see the printer for further details.

There has been a problem with the printer.

Check the printer for any messages.

OC10030

The MyID Client Service was unable to read the document.

The MyID Client Service requires the WebView2 Runtime component to be installed on the client PC to allow it to read and print HTML document templates.

Check that all pre-requisites are installed before attempting to print the document.

See the Client workstation section in the Installation and Configuration Guide for details.

OC10031

The MyID Client Service was unable to read the document.

The MyID Client Service could not read the mailing document due to a permissions error.

Check that the MyID Client Service is not running with elevated permissions.

OC10032

A problem occurred when collecting the certificates. Please retry the operation.

A technical problem occurred when processing the certificate using MyID client services.This issue requires detailed troubleshooting by a system administrator. Please consult MyID documentation for more information.",

If this issue can be reproduced, examine logs from the MyID client service at the time the problem occurred. To access the MyID client service log information, right click on the MyID icon in the Windows system tray on the computer affected and select 'Show'. This information may need to be analyzed by Intercede support."

WS10000

Server error

An internal server error has occurred.

Retry the operation; the cause could be a temporary issue such as a database timeout due to server load.

This error may also occur if you have configured your system to use the web server to store images and have attempted to upload an image using the MyID Operator Client; this is not a supported configuration; see the Displaying images stored on the web server section in the MyID Operator Client guide for details.

If the problem persists, check the System Events and Audit Reporting workflows within MyID, then the rest.core logs for more information. For information on configuring logging, see the MyID REST and authentication web services section in the Configuring Logging guide.

WS10001

Unable to convert WSQ image to 378 biometric format

The supplied WSQ image is either corrupt or invalid or the Aware components are not installed on the server.

Check that the WSQ image is valid.

Check that the Aware components are installed on the server.

See the Aware Fingerprint Capture guide provided with the Aware Fingerprint Capture module.

WS10002

Unable to retrieve the values for the specified selection box.

A problem has occurred with a dynamic drop-down list, where the contents of one list depend on another; MyID was unable to call the stored procedure specified for the dependent list. This feature may have been implemented on a custom system using Project Designer.

Check that your linked picklists are configured correctly in Project Designer; if your custom system was provided by Intercede, contact customer support, quoting the error reference WS10002.

WS10003

Unable to retrieve the requested session information.

There is an API method that allows you to retrieve information about the currently authenticated session. This error appears when there is a problem determining the session.

Re-authenticate and try again.

WS10004

Unable to generate the requested report file.

There is no report matching the specified operation id in the database.

Check the ID of the report and try again.

WS10005

Unable to generate the requested EFT export file.

When you export EFT files, MyID attempts to write them to the location specified in the EFT export directory configuration option (on the Import & Export tab of the Operation Settings workflow), or to the FileExport folder under the MyID installation folder if this is not set. The MyID COM user must have write access to this folder.

Make sure the MyID COM user has write access to the export folder and try again.

WS10006

Unable to substitute values, entity name invalid.

You have attempted to use a substitution code for the Additional Identity LDAP Self-Service User Filter configuration but have specified an entity other than People. You must use People in the substitution code; for example;

[[People.LogonName]]

See the Setting up additional identities section in the Administration Guide for details of valid substitution codes.

WS10007

Unable to substitute values, field name invalid.

You have attempted to use a substitution code for the Additional Identity LDAP Self-Service User Filter configuration but have specified a field that is not in the vPeopleUserAccounts view.

See the Setting up additional identities section in the Administration Guide for details of valid substitution codes.

WS20000

Server configuration error

There is a problem with the server configuration.

Check the System Events, Audit Reporting workflows within MyID, then the rest.core logs for more information. For information on configuring logging, see the MyID REST and authentication web services section in the Configuring Logging guide.

WS20001

Server configuration error - DataDictionary is inconsistent

The MyID Project Designer configuration is incorrect, preventing the server from starting correctly.

If you are using MyID Project Designer to develop your own custom configuration, use Project Designer to correct the configuration and reapply the project configuration.

Check the logs for information about the faulty data. For information on configuring logging, see the MyID REST and authentication web services section in the Configuring Logging guide.

WS20002

Server configuration error - SearchCriteria is inconsistent

The definition of the search criteria is incorrect.

This requires a database fix.

You must contact customer support quoting reference SUP-327 and provide details of which search operation is experiencing this error.

You will also be asked to provide log files; for information on configuring logging, see the MyID REST and authentication web services section in the Configuring Logging guide.

WS30000

Minimum data not supplied

There has been a problem with the processing of information entered on the form.

Check the data you have entered and try again.

WS30001

Invalid data supplied

There has been a problem with the processing of information entered on the form.

Check the data you have entered and try again.

WS30002

Validation problem, the value for <field name>, <details>

This error occurs when the <field name> field contains a value that is not allowed. This is a generic error; you are more likely to see a more specific error that gives a reason for the validation problem.

Check the values you have entered for the specified field and try again.

WS30003

Invalid person id specified

The person you have specified does not exist; for example, the person may have been removed by another operator. Alternatively, you have specified a person over whom you do not have permission.

Check the data you have entered and try again.

WS30004

Validation problem, the value for <field name>, invalid role specified

You have selected a role that is not allowed.

Check the roles you have selected and try again.

WS30005

Validation problem, the value for <field name>, must be no more than <number> characters

The value you have entered for the specified field is too long.

Provide a shorter value for the field and try again.

WS30006

Validation problem, the value for <field name>, invalid value for search criteria

The value you have entered for the specified field is not allowed as part of the search criteria.

Check the search criteria you have entered and try again.

WS30007

Validation problem, the value for <field name>, must contain a value

You have not entered a value for the specified field.

Enter a value for the specified field and try again.

WS30008

Validation problem, the value for <field name>, is not a selectable value

You have provided a value for the specified field that is not available in the drop-down list.

Check the value you have entered for the specified field and try again.

WS30009

Validation problem, the value for <field name>, <details>

You have entered a value for the specified field that contains a value that is not allowed. The <details> provide more information about why this value was not allowed; for example, "must be a date in the past" or "must be alphanumeric".

Check the value you have entered for the specified field and try again.

WS30010

Validation problem, the value for <field name>, fails Validation rule <rule>

You have entered a value for the specified field that contains a value that is not allowed. There is no description for this validation rule; it may be a custom validation rule.

Check the values you have entered for the specified field and try again.

WS30011

Validation problem, the value for <field name>, can only be 0 or 1

You have entered a value for the specified field other than 0 or 1, and this field only allows those values.

Enter a value of 0 or 1 in the specified field and try again.

WS30012

Validation problem, the value for <field name>, must be a number

You have entered a value for the specified field that is not a number.

Enter a number in the specified field and try again.

WS30013

Validation problem, the value for <field name>, must be a valid uuid

A field has been supplied to the server that is not a valid UUID (universally unique identifier).

If you are using the MyID Operator Client, retry the operation. If the problem persists, contact customer support, quoting reference SUP-328.

You will be asked to provide log files; for information on configuring logging, see the MyID REST and authentication web services section in the Configuring Logging guide.

WS30014

Validation problem, the value for <field name>, must be a date or datetime

You have entered a value for the specified field that is not a valid date or time and date value.

Check the value you have entered and try again.

WS30015

Validation problem, the value for <field name>, is mandatory

You have not entered a value for the specified field; this field is mandatory.

Enter a value for the specified field and try again.

WS30016

Validation problem, the value for <field name>, is not a valid StatusMapping

The value you have entered for the specified field is not a valid certificate reason (StatusMapping).

Check the value you have entered and try again.

WS30017

Validation problem, the value for 'First Name', and 'Last Name' must be provided.

You have attempted to save a person's record with neither a first name nor a last name. You must include one or both of these values.

Ensure that you have specified one or both of the First Name and Last Name fields, then attempt to save the person's record again.

WS30018

Validation problem, the value for <field name>, is not an allowed value

The value you have entered for the specified field is not permitted.

Check the value you have entered and try again.

WS30019

Validation problem, the value for <field name>, is not correctly encoded binary data

You have attempted to submit a file (for example, an image file) but the binary data file is not encoded correctly.

Check the file you are submitting and try again.

WS30020

The value provided contains one or more characters which are disallowed.

The provided password is not valid.

Provide a password that contains allowed characters and try again.

WS30021

Biometric samples of the required type cannot be found for the user.

Adjudication requires fingerprint samples captured using a 10-Slap enrollment device. Check that you have captured new fingerprints before submitting for adjudication.

This error may also occur if the Fingerprints identification check enabled configuration option (on the Biometrics page of the Operation Settings workflow) is not set.

See the Adjudication Integration Guide provided with the Adjudication module and the Aware Fingerprint Capture guide provided with the Aware Fingerprint Capture module for details.

WS30022

must be a date in the future

The field failed validation as the provided value can only be a date in the future.

Provide a date in the future and try again.

WS30023

must be a date in the past

The field failed validation as the provided value can only be a date in the past.

Provide a date in the past and try again.

WS30024

Serial number range information must be supplied.

You have attempted to import devices without providing a serial number range.

Provide a range of serial numbers to import and try again.

WS40000

Validation problem, the value for 'Distinguished Name', already exists

You have specified a Distinguished Name for the person that is already used for a different person, and your system is configured to require unique DNs.

Enter a unique DN for the person and try again. Alternatively, you can configure your system to allow duplicate DNs; the Allow duplicate DN configuration option determines whether unique DN values are required; see the LDAP page (Operation Settings) section in the Administration Guide for details.

WS40001

Validation problem, the value for ‘Logon’, already exists

You have specified a Logon name for the person that is already used for another person. Logon names must be unique.

Enter a unique logon name and try again.

WS40002

The specified Credential Profile could not be found

The credential profile you selected is no longer available.

Select a different credential profile and try again.

WS40003

Duplicate group name is not allowed (a group with this name already exists for this parent)

You have specified a group name that already exists. Groups that are located under the same parent group must have unique names.

Enter a new group name and try again.

WS40004

Unable to get default roles for group

When adding a person, default roles are retrieved from that person's group – this operation has failed.

Retry the operation. Make sure that the group you have selected is valid.

WS40005

The item referenced was not found

You have selected an item (for example, a person, device, or request) that does not exist, has been removed by another operator, or over which you do not have permission.

Retry the operation. If the problem persists, check that you have sufficient privilege to access the item.

You may have attempted to carry out an operation on a request that has been canceled. Make sure the item is in the correct status.

Check the MyID System Events workflow and the rest.core logs for more information. For information on configuring logging, see the MyID REST and authentication web services section in the Configuring Logging guide.

WS40006

The required group, <group name>, is not available

You have specified a group that is not available.

Check the group name and try again.

WS40007

The user location in the directory could not be matched to an existing group

When importing a person to the MyID database from a directory, the person could not be matched to a group in MyID.

Try one of the following:

• Manually pick a MyID group for the user to be imported into and save the record again.

• Use the Edit Groups workflow in MyID Desktop and import the LDAP groups into MyID.

  See the Importing an LDAP directory branch section in the Operator's Guide for details.

• If you want groups to be automatically imported from LDAP, set the Automatically create MyID groups from the Organizational Unit of imported users configuration option on the LDAP page of the Operation Settings workflow.

WS40008

Directory synchronization is not available with this API due to configuration or role limitations

An attempt has been made to synchronize a person with the directory manually; however, this operation is disabled due to system configuration.

Directory synchronization is controlled by the following configuration:

• If the Background Update configuration option is turned on, people are automatically updated in the MyID database when they are retrieved. In this situation it does not make sense to synchronize the person from LDAP manually. An attempt to trigger a manual synchronization would produce this error; however, the button does not appear.
• If the Background Update configuration option is turned off, if the caller has roles to enable manual directory sync, the operator can request a directory synchronization by clicking the button. In this situation, this error code will not occur.

As the button appears only when it is allowed by system configuration, this error is unlikely to appear. However, if it does appear, it means that a client is out of step with the server configuration. Shut down the client, clear the browser cache, and try the operation again.

WS40009

You must provide a reason for rejecting the specified request.

You have attempted to reject a request without specifying a reason. A reason is mandatory when rejecting a request.

Specify a reason for rejecting the request and try again.

WS40010

You must provide a reason for canceling the specified request.

You have attempted to cancel a request without specifying a reason. A reason is mandatory when canceling a request.

Specify a reason for canceling the request and try again.

WS40011

When creating or approving a request, the job expiry date must be in the future. Either the newly selected request maximum expiry date, or the user maximum expiry date of the request target is in the past.

Either the selected maximum expiry date for the request, or the user maximum expiry date is in the past.

Specify a date for the request that is in the future and try again.

WS40012

The device cannot be replaced because it is not issued

You have specified a device to be replaced, but MyID does not recognize it as an issued device.

Specify a valid issued device and try again.

This error may occur if you attempt to update a key recovery card; key recovery cards are not fully-featured MyID cards and can only be used for key recovery.

WS40013

The device cannot be replaced because it is has already expired

You have specified a device to be replaced, but it has already expired.

Specify a currently-issued device to be replaced, or request a new device to replace the original expired device.

WS40014

The device cannot be replaced because it is too close to its expiry date

You have attempted to replace a device, but it will expire soon. You must renew the device instead.

By default, the renewal window is 42 days; this is configured by the Card Renewal Period option on the Devices page of the Operation Settings workflow. You can renew a card if its expiry date is within this window.

Renew the device.

WS40015

The device cannot be replaced because it does not have a credential profile

You have attempted to replace a device, but the credential profile used to issue the device has been removed.

Cancel the device and issue a new one.

WS40016

The device cannot be renewed because its remaining lifetime does not fall within the configured window for renewals

By default, the renewal window is 42 days; this is configured by the Card Renewal Period option on the Devices page of the Operation Settings workflow. You can renew a card if its expiry date is within this window.

Wait for the device to fall within the window for renewals before trying again.

WS40017

You must provide at least one resource name.

When requesting translations a resource name must be specified.

Ensure that the resource name is specified; see the Swagger documentation for the MyID Core API for more details.

WS40018

You must provide a language.

The language value was not specified in the body in call to set the language.

Ensure that the language is specified; see the Swagger documentation for the MyID Core API for more details.

WS40019

The specified language has not been configured for use.

There is no resource file on the server for the language specified.

Create a new resource file for the specified language. For information about translating the MyID interface, contact customer support quoting reference SUP-138.

WS40020

No languages have been configured for use.

There are no resource files installed on the server.

Your installation appears to have become corrupt. Check your backups.

WS40021

The specified entity does not exist.

A report is attempting to reference an unsupported entity.

The report is incorrectly defined. Redefine it to reference one of the following:

• adjudications

• audits

• authCodes

• binaries

• bioSamples

• cardProfiles

• controls

• devices

• directories

• directoryGroups

• directoryPeople

• groups

• installs

• logEvents

• notifications

• people

• reportDefinitions

• reports

• requests

• sessions

• settings

WS40022

The specified operation id is not a valid search operation.

There is no report matching the specified operation id in the database.

Check the ID of the report and try again.

WS40023

The specified search operation id cannot be used for this endpoint.

Each operation id is linked to a specific entity; for example, device, people, request.

Check the operation ID and try again.

WS40024

The delivery mechanism specified does not exist or is not allowed for this operation.

Only specific delivery mechanisms are allowed based on the specific operation.

Get a list of suitable delivery mechanisms by making a call to:

GET /api/Devices/{id}/codes/deliveryMechanisms

See the Swagger documentation for the MyID Core API for more details.

WS40025

The user does not have the required contact details for this delivery mechanism.

A request to send the user an email notification when the user does not have an email address or an SMS notification when the user does not have a cell phone number was attempted. The audit of the attempt will detail which property is required.

Update the person to specify their email address or mobile number.

WS40026

The specified delivery mechanism is not enabled for this operation.

A request to send the user a notification was attempted when the email template is not enabled. The audit of the attempt will detail which email template was selected.

Use the Email Templates workflow to enable the required email template or select an alternative email template.

WS40027

An auth code action must be supplied.

When requesting a list of delivery mechanisms an action must be specified.

See the Swagger documentation for the MyID Core API for more details.

WS40028

The specified auth code action: {0}, is not supported.

The specified action is not supported.

The action specified must be one of the following

• Activate

• Collect

• Logon

• Unlock

WS40029

The specified auth code action: {0}, is not supported for this item.

Each action is linked to a specific entity.

Ensure you only select an action appropriate to the entity:

WS40030

Email notifications have not been configured. Please contact your administrator.

An attempt to send a notification was made when notifications are not configured.

See the Setting up email section in the Advanced Configuration Guide for details.

WS40031

This device is already assigned, and must be canceled before it can be reassigned to a different person. The system is not configured to allow unrestricted cancellation.

The Unrestricted Cancellation option in the credential profile is not set, and the operator has selected a device that is already issued or assigned to another request.

Cancel the device before attempting to assign it.

Alternatively, if you want to assign a device without first canceling it, you must set the Unrestricted Cancellation option in the credential profile. This option appears only if the Enable unrestricted cancellation option on the Issuance Processes tab of the Operation Settings workflow is set to Yes

WS40032

This device has a disposal status that prevents it being issued again.

The selected device has a disposal status of 'Lost', 'Disposed' or 'Collected'.

Either select a different device, or change the disposal status of the selected device.

WS40033

This device cannot be issued or updated by MyID.

The selected device is 'Unmanaged', does not have GlobalPlatform or 9B keys, or cannot be issued due to secure by default configuration.

Either select a different device, or ensure the correct keys have been entered into MyID to make the selected device issuable.

WS40034

The request already has an assigned device.

The request already has a device assigned.

Either select a different device, or unassign the selected device from its current request.

WS40035

The request type does not permit device assignment.

The selected request is not an issuance or replacement issuance request.

This request cannot be used to assign a device; select a different request.

WS40036

The request is not awaiting issuance or awaiting validation.

The selected request is not at status 'Awaiting Issue' or 'Awaiting Validation'.

Adjust the selected request to be an appropriate status before assigning a device to it.

WS40037

The request is for a person that is not within the authenticated operators scope

The target user for the request is outside the scope of the authenticated operator.

Either adjust your MyID group and role settings to ensure the target for the request is in scope of the authenticated operator, or assign the device to the request using a different operator who has scope over the target for the request.

WS40038

This device is not known to MyID and the credential profile can only be used with known serial numbers.

The selected device is not known to the MyID database, and the credential profile for the request has Only Issue to Known Serial Numbers configured.

Use a different device that is known to the MyID database.

Alternatively, import the device to the MyID database using the Import Serial Numbers workflow, or change the credential profile to deselect the Only Issue to Known Serial Numbers option.

WS40039

This device does not meet the requirements of the credential profile.

The device selected is not a 'Contact' or 'Contactless' card or the credential profile is not of encoding type 'Contact' or 'Contactless'. 'Contact' cards can only be selected for 'Contact' encoding type credential profiles, and 'Contactless' cards can only be selected for 'Contactless' encoding type credential profiles.

Select a device that is compatible with the credential profile assigned to the request.

WS40040

The request does not have an assigned device.

The selected request does not have a device assigned to it.

Ensure the request has a device assigned to it, or select a different request.

WS40041

This device is already assigned, and must be canceled before it can be reassigned to a different person.

The Unrestricted Cancellation option in the credential profile is not set, and the operator has selected a device that is already issued or assigned to another request.

Cancel the device before attempting to assign it.

Alternatively, if you want to assign a device without first canceling it, you must set the Unrestricted Cancellation option in the credential profile. This option appears only if the Enable unrestricted cancellation option on the Issuance Processes tab of the Operation Settings workflow is set to Yes

WS40042

This device is assigned to the current operator.

The selected device is already assigned to the current operator.

Select a different device.

WS40044

There are no status mappings available for the selected operation.

The attempted operation requires a status mapping to be selected, but there are no status mappings available for that operation ID.

You can check the vAllowedStatuses view in the database, which shows the operations that have corresponding status mappings.

WS40045

The device cannot be updated because it has already expired.

To perform this operation, the selected device must not have expired.

Either renew the device, or issue a new device.

WS40046

The device cannot be updated because the issuance process has not been completed.

The device must have a process status of Active and be assigned to a person.

Ensure that the device has an owner, and that it is issued.

This error may occur if you attempt to update a key recovery card; key recovery cards are not fully-featured MyID cards and can only be used for key recovery.

WS40047

The device cannot be updated because it does not have a credential profile.

The selected device must have a credential profile.

Ensure that the device has not been canceled or erased. Reissue the device if necessary.

WS40048

The location cannot be updated because an existing location has the requested name.

You have attempted to create or edit a location but have specified the name of an existing location. Location names must be unique.

Type a different name and try again.

WS40049

The device cannot be transferred because it is in an invalid state.

You have attempted to transfer a device, but it is currently assigned to a person or is already allocated to a stock transfer.

Select a different device and try again.

WS40050

The device cannot be canceled and have its disposal status set to <Status>.

You have attempted to cancel a device and set its disposal status to an invalid value.

Select an appropriate disposal status for the device.

WS40051

The device is still active and has not expired, so cannot have its disposal status changed.

You have attempted to set the disposal status for a device that is still active.

Cancel the device first then set the disposal status.

WS40052

The device has expired but the system is configured to not allow expired devices to have their disposal status changed.

You have attempted to set the disposal status for a device that has expired, but the Allow disposal of expired devices configuration option is set to No.

Set the Allow disposal of expired devices configuration option to Yes and try again.

WS40053

The device selected cannot be disposed. Please refer to product documentation for further guidance.

You have specified a device of type ServerCredential for disposal using the API; you cannot set the disposal status of these devices.

Select a different device and try again.

WS40054

The additional identity specified already exists.

You have attempted to add an additional identity to a person who already has that user and certificate policy selected as an additional identity.

Select a different user or certificate policy and try again.

WS40055

The request doesn't have an assigned device

A server document has been attempted to be generated for a request that does not have an assigned device.

Select a different request and try again.

WS40056

The credential profile does not have a document for the requested doctype

You have attempted to print a document, but there is no document template selected in the credential profile.

Edit the credential profile to select a document template and try again.

WS40057

Unable to generate a server document, the request type is invalid.

You have attempted to print a document for a type of request that does not support printing documents.

This may also occur if you have attempted to print a document for a request that has been canceled.

Select a different request and try again.

WS40058

Unable to generate a server document, the status of the request is invalid.

You have attempted to print a document for a request that has not been completed.

Complete the request and try to print the document again.

WS40059

Unable to generate a server document, the collection period is over.

Your system has been customized with a time limit for printing mailing documents, and it has been too long since the job was completed.

You cannot print a document for this device. If you want to print a document, you must issue a new device.

WS40060

Unable to generate a server document, PIN Mailer request not found.

You have attempted to print a PIN mailer, but there is no request for the PIN mailer.

Select a different request and try again. Alternatively, ensure that the original request has been collected, and a PIN mailer request has been generated.

WS40061

Unable to generate a server document, unknown document type.

You have attempted to print a document, but the specified document type in not correct.

Check the document type and try again.

WS50000

Your current authentication level cannot access this information. The logon credential used, roles that logon credential can access and scope available to those roles may limit your access

You do not have permission to perform the requested operation.

Check the roles and scope for the operator who is attempting to carry out this operation. It is possible to have different scopes for different operations; for example, you may be allowed to view all people in the system, but only be allowed to edit people from a particular group.

Check the MyID System Events and Audit Reporting workflows for more information about the operation being attempted.

WS50001

Licence Limit Reached

You have attempted to add a person or request a device but have reached the maximum number of people or devices.

Either remove some people or devices that are no longer required, or request extra licenses from Intercede. See the Requesting licenses section in the Administration Guide for details.

WS50002

You do not have permission to update your own device

The system is configured using the Self-service option (on the Self-Service page of the Security Settings workflow) to prevent you from performing updates to devices that belong to you; for example, you are not allowed to enable a disabled device that belongs to you.

Ask another operator to update the device for you.

WS50003

You do not have permission to update the device you authenticated with

You have attempted to perform an update on the device that you logged on with. This is not allowed.

Ask another operator to update the device for you.

WS50004

The system is not configured to allow you to edit your own information

The system is configured to prevent you from updating your own details.

Ask another operator to edit your information.

WS50005

Searching for people in the database is disabled

You have attempted to search for a person in the MyID database, but MyID is not configured to do so.

You can search the MyID database only if you have configured MyID to do so; you must set the Search a directory configuration option to No or Ask. See the LDAP page (Operation Settings) section in the Administration Guide for details.

WS50006

Searching for people in the directory is disabled

You have attempted to search for a person in an attached directory, but MyID is not configured to do so.

You can search a directory only if you have configured MyID to do so; you must set the Search a directory configuration option to Yes or Ask. See the LDAP page (Operation Settings) section in the Administration Guide for details.

WS50007

Invalid job status change

You have attempted to update a request job to a status that is not permitted.

The MyID Operator Client prevents you from making changes that are not permitted; however, it is possible that another operator has made a change to the status of the request job at the same time.

Retry the operation; if the problem persists, close the Operator Client, clear the browser cache, and try again. If the problem persists further, check the MyID System Events and Audit Reporting workflows.

WS50008

Your assigned roles do not have permission to request the credential profile specified

You have specified a credential profile to which you do not have access.

The credential profiles available depend on the role of the operator and the role of the person for whom you are requesting the device; see the details of the Can Request option in the Constrain credential profile issuer section in the Administration Guide.

WS50009

It is not possible to create requests for yourself or your devices.

This message occurs when an attempt is made by an operator to request their own credentials. It could occur when:

• Attempting to request a replacement for one of their devices.

• Attempting to request a renewal for one of their devices.

• Attempting to request a device for themselves (Note: The button for this is not available in MyID Operator Client).

• Attempting to request an update for one of their devices.

Ask another operator to carry out the operation.

WS50010

Your assigned roles do not have permission to approve or reject requests for this credential profile

You have attempted to approve or reject a request that uses a credential profile that you are not allowed to validate.

The credential profiles you can validate depend on your role; see the details of the Can Validate option in the Constrain credential profile validator section in the Administration Guide.

WS50011

The person selected does not have a role assigned that can hold the requested credential profile

You have attempted to request a device using a credential profile to which the person does not have access.

The credential profiles available depend on the role of the operator and the role of the person for whom you are requesting the device; see the details of the Can Receive option in the Linking credential profiles to roles section in the Administration Guide.

WS50012

The person selected does not have user data approved. The credential profile requires user data to be approved before it can be requested

You have attempted to request a device using a credential profile that requires the person to have the User Data Approved flag set on their account, but the person does not have this flag set.

Either set the User Data Approved flag, or edit the credential profile so that it does not require this flag; see the details of the Require user data to be approved option in the Issuance Settings section in the Administration Guide.

WS50013

The account selected is not compatible with this request (kind is mismatched)

Requests cannot be made for the selected person. This could be due to this account being a special kind of record that represents a non-person entity (for example, for device identities).

If you are trying to request a credential for a non-person, such as a device identity, use MyID Desktop instead; the MyID Operator Client does not currently support requests of this kind.

If you continue to have problems, check the configuration of the credential profile you are using. You can also check the MyID System Events and Audit Reporting workflows.

WS50014

You are not permitted to approve or reject requests that you have made

You have attempted to approve or reject a request that you initiated. You cannot validate these requests.

Ask another operator to validate the request.

WS50015

You are not permitted to approve or reject requests that you will receive

You have attempted to approve or reject a request for your own device. You cannot validate these requests.

Ask another operator to validate the request.

WS50016

The person selected does not have all required information for this credential profile. Check the Person History audit details to identify the missing requisite user data.

You have specified a credential profile that has specific requisite user data requirements; the person you have specified does not meet those requirements.

Carry out one of the following:

• Update the person's user account to meet the requisite data requirements.

• Update the credential profile to allow the configured user data.

• Select a different credential profile for which the user meets the requisite data requirements.

See the Requisite User Data section in the Administration Guide for details.

WS50017

The person selected does not have a Distinguished Name. This profile requires a Distinguished Name for credential issuance.

You have specified a credential profile that requires a Distinguished Name for issuing its certificates.

Update the person's user account to provide a Distinguished Name.

WS50018

This credential profile can only be requested using a Derived Credential process

You have specified a credential profile that is used for Derived Credentials.

Specify a different credential profile, or request the device using the appropriate process for derived credentials; for example, see the Requesting a Derived Credential section in the Derived Credentials Self-Service Request Portal guide.

WS50019

Requests created using this API must include an appropriate encoding type

The MyID Operator Client supports credential profiles with a restricted list of Card Encoding options.

Check the credential profile you are trying to use. Either select a credential profile that is supported by the MyID Operator Client, or, if you need to use a credential profile that is not supported, use MyID Desktop instead.

See the Requesting a device for a person section in the MyID Operator Client guide.

WS50020

A requested role has been excluded through the application of group role restrictions

You have requested a role for a person that is not available because the person's group does not allow this role.

Either select a different role or amend the group so that it has access to the required role. See the Changing a group section in the Operator's Guide for details.

WS50021

The scope requested for a role is greater than the maximum scope assignable by the current operator

You have requested a scope level that is higher than your own scope. An operator cannot assign a scope higher than their own level.

Request a lower scope level that is at your own level or lower.

WS50022

A requested role is manager controlled and the operator does not hold the role that would permit them to assign it

You have requested a role that is restricted by the Managed By option.

Either select a different role, or update the Managed By option for the required role to contain one of your own roles; this will allow you to assign the role.

See the Controlling the assigning of roles section in the Administration Guide.

WS50023

This type of request is not allowed to be updated

You have attempted to update a request that is not allowed to be updated.

Retry the operation. Further information is available in the MyID System Events and Audit Reporting workflows.

WS50024

Enabling/Disabling a directory person is not allowed

You have attempted to enable or disable a person whose details are stored in a directory. You can enable or disable user accounts for people only if they are stored in the MyID database.

Select a person in the MyID database and try again.

WS50025

You do not have permissions to edit PIV applicants

You have attempted to edit a PIV applicant; this is not possible as you do not have permission to use the Edit PIV Applicant feature.

Check the role and permission assignments of the operator.

WS50026

You do not have permission to add or remove the specified administrator groups

You have attempted to add or remove administration groups but you do not have permission to those groups.

Request permission from an administrator; see the Administrative groups section in the Administration Guide for details.

WS50027

The operator does not have sufficient scope to create a request for this account

You have attempted to create a request for a person, but that person does not sit within your scope.

Check your scope; see the Scope and security section in the Administration Guide for details.

WS50028

You cannot validate or reject a request which does not have an Awaiting Validation status

You have attempted to validate or reject a request, but the request is not awaiting validation, so does not need to be validated or rejected.

Check the status of the request.

WS50029

You cannot cancel a request which has a Completed, Canceled or Failed status

You have attempted to cancel a request, but the request's status is Completed, Canceled or Failed; requests at those statuses do not need to be canceled.

Check the status of the request.

WS50030

The person selected does not have a photo. The credential profile requires the user to have a photo before it can be requested

The Enforce Photo at Issuance option in the credential profile is set to Request and Issuance, which means that you cannot request or issue a card if the cardholder does not have a photo.

Capture a photo for the person and try again.

Alternatively, edit the credential profile to set the Enforce Photo at Issuance option to No.

WS50031

Operation ID <operation> is not a permitted clone of operation <operation>

An API call has been made which violates the cloned operation configuration.

If this occurs when using the MyID Operator Client, contact customer support.

If this occurs when calling the REST API directly, check the op parameter references an allowed cloned operation.

WS50032

The conditions on the Operation with ID <operation ID> prohibit use of the operation for the target entity

An operation has been attempted that is not permitted for the entity that would be affected by the operation. For example, the device type may be incompatible with the requested operation, or the person may be not be at an appropriate status

If this occurs when using the MyID Operator Client, contact customer support.

If calling the API directly, make sure the operation that is being used is permitted for the entity that would be affected by the operation. For example, this error will occur when using the Edit Person operation to attempt to edit a person who holds the PIV Applicant role.

WS50033

The person selected does not have fingerprint biometrics. The credential profile requires that the recipient has fingerprint biometrics enrolled.

You have attempted to request a device for a person who does not have fingerprints stored in the MyID database, the credential profile for the device has the Require Fingerprints at Issuance option set, and the Enforce biometrics at request configuration option (on the Biometrics page of the Operation Settings workflow) is set.

Enroll fingerprints for the person, select a different credential profile that does not have the Require Fingerprints at Issuance option set, or set the Enforce biometrics at request configuration option to No.

WS50034

The person selected does not have facial biometrics. The credential profile requires that the recipient has facial biometrics enrolled.

You have attempted to request a device for a person who does not have fingerprints stored in the MyID database, the credential profile for the device has the Require Facial Biometrics option set, and the Enforce biometrics at request configuration option (on the Biometrics page of the Operation Settings workflow) is set.

Enroll facial biometrics for the person, select a different credential profile that does not have the Require Facial Biometrics option set, or set the Enforce biometrics at request configuration option to No.

WS50035

An existing request has been found that prevents this action. Check requests that are already created and if necessary cancel them.

You have attempted to request a device for a person using a credential profile that has the Block Multiple Requests for Credential Group set, and the person already has an existing request for a device from the same credential group.

Request a device from a different credential profile that is not subject to the same credential group restrictions, or cancel the existing request, if necessary.

See the Block Multiple Requests for Credential Group section in the Administration Guide.

WS50036

The person selected has a maximum credential expiry date that is before the date requested.

You have requested an expiry date for a device that is after the person's maximum credential expiry date.

Choose an expiry date for the device that is before the person's maximum credential expiry date, and try again.

See the Editing a PIV applicant and Requesting a device for a person sections in the MyID Operator Client guide for details.

WS50037

Creating a request is not allowed. <details>

You have attempted to create a request, but it does not meet the criteria set by a customized system. The <details> may provide more information.

Check the requirements of the customized system, adjust the request to meet those requirements, then try again.

WS50038

The selected credential profile is not allowed because the person that requested the job was not allowed to request this credential profile.

The system has checked the permissions on the job (for example, the device request) and the issuer does not have the required permissions to request the credential profile selected.

Select a different credential profile, or cancel the request and create a new device request.

WS50039

You cannot action your own adjudications.

The operator has attempted to generate or update an adjudication request for themselves.

Ask another operator to carry out the adjudication.

WS50040

You do not have permission to perform this operation against the selected item.

You have attempted to perform an action on an item, but your scope does not permit the action. For example, if you have scope that allows you to view a user, and permission to validate requests, but your validate request scope does not allow you to validate requests for that user, you can attempt to validate a request for the user, but the action will not succeed, and this error appears.

Make sure that your scope permits you to carry out the appropriate actions for the target user, then try again.

WS50041

This action cannot be performed because the user has outstanding adjudications.

A person can only have one adjudication that is being processed at once. This error appears when an adjudication request is attempted for a person who has an outstanding unfinished request.

Complete or cancel the existing adjudication.

WS50042

The request task type is not supported by the credential profile.

The system can restrict certain credential profiles being used for certain types of jobs. For example, you cannot issue a VSC to a FIDO authenticator.

Select the correct device type for the credential profile.

WS50043

This credential profile can only be requested from Request Device.

Request Card has been used for to generate a request for a FIDO device. There is a different workflow used to request FIDO device jobs.

Use the correct process for requesting FIDO authenticators.

WS50044

This device requires secondary authorization to cancel it. Please use the MyID Desktop Cancel Credentials workflow.

You have attempted to cancel a device that was issued with a credential profile that had the Validate Cancellation option selected. Validating cancellations is not supported in the MyID Operator Client.

Use the Cancel Credential workflow in MyID Desktop to cancel the device.

WS50045

The device selected cannot be canceled. Please refer to product documentation for further guidance.

You have attempted to cancel a server credential. You cannot cancel server credentials.

Choose a different device and try again.

WS50046

The specified resource is not accessible, or does not exist.

The resource requested needs to be one of the allowed resources.

The resource should be one of the following

• Base

• CoreForms

• CustomerTerms

• ErrorCodes

• MobileClient

• OperatorClient

• OtherClient

• ProductTerms

• ProjectDesigner

WS50047

Requests for Software Certificate Packages are not permitted for this operation.

The credential profile specified does not allow issuance of software certificates.

Select a different credential profile or update the current credential profile to allow for software certificates.

WS50048

You do not have permission to download reports.

The user requires permission to each specific report.

Grant the user additional roles or use the Edit Roles workflow to ensure the user has the required permissions.

See the Granting access to reports section in the MyID Operator Client guide for details.

WS50049

Additional authorization is required to perform this operation.

Some workflows require additional authorization, such as a biometric check to perform.

You need to perform the secondaryAuth as specified in the link returned.

WS50050

The request is not at a valid status for this operation.

You have attempted to carry out an operation on a request, but the request is at the wrong status.

Select a different request and try again.

WS50051

There are no available reports to perform a secondary search.

The operator does not have permission to any reports to perform a secondary search within the MyID Operator Client.

Check the MyID permissions are correct using the Edit Roles workflow.

WS50052

The device owner has a maximum expiry date that is earlier than the expiry date of the device. The update cannot be requested because the credential profile does not have Ignore User Expiry Date set.

If the credential profile does not have the Ignore User Expiry Date option set, MyID checks the Maximum credential expiry date set for the device owner.. This value must not be before the expiry date of the device.

Increase the maximum credential expiry date for the device owner, change the credential profile of the device to set the Ignore User Expiry Date option, or issue a device to the user which does not exceed their maximum credential expiry date.

WS50053

The capabilities of the selected credential profile are not supported by this operation.

Certain operations may allow only certain card capabilities for a device. For example, Request Update allows only Contact, Microsoft Virtual Smart Card, Identity Agent, or Windows Hello for Business devices.

This error may occur if you attempt to select a credential profile configured for derived credentials. Derived credentials must follow a different request process; for example, see the Requesting a Derived Credential section in the Derived Credentials Self-Service Request Portal guide.

Select a credential profile that has one of the capabilities specified for the operation.

You can check the JSON conditions in the Operations table of the MyID database for that operation ID.

WS50054

The selected credential profile has different capabilities to the current device credential profile.

Certain operations allow you to change the credential profile of a device. This error means that when changing the credential profile, you must select a profile which has exactly the same card capabilities as the previous credential profile.

Examine the previous profile in the Credential Profiles workflow, and create the new credential profile for the device to have the same card capabilities.

WS50055

The user has an existing request or device that exists with a different exclusive group, the request cannot be added.

You have attempted to request a device that has an exclusive group specified in its credential profile, but the target of the request already has a device, or a request for a device, that has a different exclusive group. You cannot have devices from different exclusive groups.

See the Exclusive Group section in the Administration Guide for details.

WS50056

The user has an existing request or device that exists with a different exclusive group, the request cannot be validated.

You have attempted to validate a request for a device that has an exclusive group specified in its credential profile, but the target of the request already has a device, or a request for a device, that has a different exclusive group. You cannot have devices from different exclusive groups.

See the Exclusive Group section in the Administration Guide for details.

WS50057

The user has an existing request or device that exists with a different exclusive group, the request cannot be collected.

You have attempted to collect a request for a device that has an exclusive group specified in its credential profile, but the target of the request already has a device, or a request for a device, that has a different exclusive group. You cannot have devices from different exclusive groups.

See the Exclusive Group section in the Administration Guide for details.

WS50058

The selected user has no suitable biometric samples for EFT export.

You have selected a person who does not have suitable biometric samples enrolled, and therefore cannot have their biometric samples exported as EFT.

The person must either have an existing EFT stored, or suitable WSQ or WSQ roll image stored, from which an EFT can be generated then exported.

Ensure the selected person has the appropriate biometrics enrolled, or select a different person.

WS50059

The selected user has no fingerprint rolls available for EFT export.

You have selected a person who does not have suitable fingerprint rolls captured, and therefore cannot have their biometric samples exported as EFT.

The person must either have an existing EFT stored, or suitable WSQ or WSQ roll image stored, from which an EFT can be generated then exported.

Ensure the selected person has the appropriate biometrics enrolled, or select a different person.

WS50060

Maximum number of generated sequential serial numbers exceeded.

You can import a maximum of 10,000 devices at one time.

Provide a different range of serial numbers that totals 10,000 devices or fewer.

WS50061

The attempt to assign a device has been rejected. The device assignment end date for the group that this person is associated with has passed.

The issuance of the device would place it in a group that has expired.

Update the group to expire in the future and repeat the operation.

See the Controlling device assignments for groups section in the Administration Guide for details.

WS50062

The attempt to assign a device has been rejected. The maximum number of assigned devices for the group that this person is associated with has been exceeded.

The issuance of the device would cause the device limit for the group to be exceeded and so has been prevented.

Increase the group device limit and repeat the operation.

See the Controlling device assignments for groups section in the Administration Guide for details.

WS50063

The selected directory person is already in the MyID database.

You have attempted to import a person from a directory, but the person is already in the MyID database.

Select a different person to import, or edit the existing person record in the MyID database.

WS50064

You are not allowed to deliver this device

You have attempted to set the delivery status on your own device.

Select a different device, or ask another operator to set the delivery status for your device.

See the Accepting delivery for a device section in the MyID Operator Client guide for details.

WS50065

The device already has an active request

You have attempted to request a cancellation for a device that already has an active cancellation request.

Approve, reject, or cancel the original cancellation request for the device.

WS50067

The selected certificate policy does not allow identity mapping.

You have selected a certificate policy for an additional identity that does not have the Allow Identity Mapping option selected.

Select a different certificate policy and try again, or edit the certificate policy to have the Allow Identity Mapping option.