Properties
The Authorization Server refused the authorization: the holder declined, say.
The call was cancelled.
The offer's Authorization Server takes no client authentication the wallet can give: a Wallet Attestation needs a WalletProvider and a clientId.
The issuer refused a deferred credential.
Sending a presentation failed in a way that leaves it unknown whether the Verifier received it: it's not sent again.
A bug.
An argument, a link or the configuration is malformed.
A presentation's selection doesn't answer the request as it asks: an unknown query or credential, one that doesn't answer its query, more than one for a query that takes one, or a required credential set left unanswered.
A request couldn't be made, got no answer, or timed out. Retryable.
Nothing held answers the Verifier's request.
No key, credential, deferred credential or authorization in progress with that ID.
A key store, credential store or Wallet Provider call failed; its message follows.
Under the haip issuance profile, the issuer doesn't follow HAIP 1.0: it's refused.
The wallet can't hold an offered credential — it's bound to no key, or by a method other than jwk or cose_key — or the issuer takes no proof it can give: a key attestation needs a WalletProvider.
An issuer, Authorization Server or Verifier answered with an error, or with something the wallet refuses: WalletException.protocolError carries its OAuth error code, when it gave one.
A credential can't be refreshed: no refresh token was kept, or the Authorization Server no longer accepts it. Receive it again from a new offer.
The wallet refused a Verifier's request it must not answer — transaction_data it doesn't support, or a parameter OpenID4VP forbids — and told the Verifier: WalletException.protocolError is the error code it sent.
A pinned host's certificate matched none of its tlsPins: an interception, or a server whose keys changed beyond its pins. Nothing was sent to it.
The service answered with HTTP 5xx or 429. Retryable later.
The Verifier's request is signed with a certificate that doesn't chain to verifierRoots: it's refused unread.
A session method was called out of turn, or after the session ended.