devmon-agent (0.6.0)

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The request body did not decode as JSON.

Pairing failed. Deliberately indistinguishable across every cause: unknown, expired, or already-used code, or an unparsable CSR.

The request body exceeded 8 KiB.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The agent itself failed. Details are in the agent's log, never in this body.

The request body did not decode as JSON.

No, unknown, expired, or revoked client certificate — or a malformed CSR, which answers {"error":"renewal failed"}.

The request body exceeded 8 KiB.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The agent itself failed. Details are in the agent's log, never in this body.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The agent itself failed. Details are in the agent's log, never in this body.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

Malformed container reference, or an unparsable since timestamp.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

Malformed container reference, or an unparsable since timestamp.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

All eight live stream slots are in use. Unlike most rejections this one is actionable by the caller — close a log view.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

The host's policy mode does not permit the operation. Every shipped mode permits reads, so on a read route this answer indicates an agent misconfiguration rather than a tier a client could encounter by design — it is documented because the taxonomy keeps 403 distinct from 401 and 502 on every route.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The agent itself failed. Details are in the agent's log, never in this body.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Refused, for one of two unrelated reasons the body distinguishes.

Either the host's policy mode does not permit the operation — kill and delete need full, the rest need default — which no client can widen, since the mode is fixed at agent startup and advertised in /v1/status.

Or the target is the agent's own container. That is a fixed rule rather than a policy tier: stopping or deleting the agent from a client would destroy the operator's only remote access. The agent stays visible in listings with protected: true, so a client can grey the control out rather than discovering this through a failure.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

The container is running. Stop it first.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The agent is running in a container but could not determine which one, so it cannot enforce its own exclusion and every mutating route fails closed. Resolvable on the host by setting DEVMON_SELF_CONTAINER to the agent container's name.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Refused, for one of two unrelated reasons the body distinguishes.

Either the host's policy mode does not permit the operation — kill and delete need full, the rest need default — which no client can widen, since the mode is fixed at agent startup and advertised in /v1/status.

Or the target is the agent's own container. That is a fixed rule rather than a policy tier: stopping or deleting the agent from a client would destroy the operator's only remote access. The agent stays visible in listings with protected: true, so a client can grey the control out rather than discovering this through a failure.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The agent is running in a container but could not determine which one, so it cannot enforce its own exclusion and every mutating route fails closed. Resolvable on the host by setting DEVMON_SELF_CONTAINER to the agent container's name.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Refused, for one of two unrelated reasons the body distinguishes.

Either the host's policy mode does not permit the operation — kill and delete need full, the rest need default — which no client can widen, since the mode is fixed at agent startup and advertised in /v1/status.

Or the target is the agent's own container. That is a fixed rule rather than a policy tier: stopping or deleting the agent from a client would destroy the operator's only remote access. The agent stays visible in listings with protected: true, so a client can grey the control out rather than discovering this through a failure.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The agent is running in a container but could not determine which one, so it cannot enforce its own exclusion and every mutating route fails closed. Resolvable on the host by setting DEVMON_SELF_CONTAINER to the agent container's name.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Refused, for one of two unrelated reasons the body distinguishes.

Either the host's policy mode does not permit the operation — kill and delete need full, the rest need default — which no client can widen, since the mode is fixed at agent startup and advertised in /v1/status.

Or the target is the agent's own container. That is a fixed rule rather than a policy tier: stopping or deleting the agent from a client would destroy the operator's only remote access. The agent stays visible in listings with protected: true, so a client can grey the control out rather than discovering this through a failure.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The agent is running in a container but could not determine which one, so it cannot enforce its own exclusion and every mutating route fails closed. Resolvable on the host by setting DEVMON_SELF_CONTAINER to the agent container's name.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Refused, for one of two unrelated reasons the body distinguishes.

Either the host's policy mode does not permit the operation — kill and delete need full, the rest need default — which no client can widen, since the mode is fixed at agent startup and advertised in /v1/status.

Or the target is the agent's own container. That is a fixed rule rather than a policy tier: stopping or deleting the agent from a client would destroy the operator's only remote access. The agent stays visible in listings with protected: true, so a client can grey the control out rather than discovering this through a failure.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The agent is running in a container but could not determine which one, so it cannot enforce its own exclusion and every mutating route fails closed. Resolvable on the host by setting DEVMON_SELF_CONTAINER to the agent container's name.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.

The object reference failed validation. The request never reached the Engine.

No client certificate, or one that is unknown, expired, or belongs to a revoked device. The four cases are deliberately indistinguishable in the response; the agent's own log records which it was.

No such object. Stated plainly rather than obscured: the caller is already an authenticated device, so the anti-enumeration reasoning behind /v1/pair's uniform rejection does not apply here.

Rate limit exceeded. Three tiers share this response and the body never says which was hit — that is operator information and goes to the log.

The unauthenticated routes are limited per source IP and by a global backstop, because per-IP alone does not stop a distributed scan; authenticated routes are limited per device, so one busy phone cannot exhaust another's budget. X-Forwarded-For is deliberately never consulted: honouring a client-supplied forwarding header would let any caller mint a fresh limiter key per request.

The Docker Engine is unreachable, timed out, or otherwise failing.

502 rather than 500 is deliberate: the Engine is an upstream dependency, so its failures are gateway failures. That keeps 500 meaning "the agent itself broke", which is a different page for whoever is on call.