SSOJet API Error Codes: A Developer Reference (and What Not to Retry)

SSOJet’s API error model returns a stable error string, human-readable description, and numeric error code for 148 documented conditions spanning general configuration, OIDC, authentication, passwordless, permissions, SCIM directory sync, and tenant management. Integrations should log all three fields and route handling primarily by error_code because shared strings such as invalid_grant represent distinct failures, including expired grants, reused authorization codes, and PKCE verification problems. Automatic retries should be avoided for permanent credential, grant, policy, and registration errors; corrected requests should be resent for validation failures; and transient server, network, provider, and rate-limit failures should use bounded exponential backoff from one to eight seconds with jitter. HTTP status codes cannot reliably determine action because documented anomalies include rate_limit_exceeded returning 401 and internal_server_error returning 403, while duplicate-resource errors use several different statuses. The guidance also recommends refreshing an invalid token once before retrying, mapping numeric codes to user-facing messages rather than exposing backend descriptions, and treating SCIM errors such as invalid tokens, endpoints, and attribute mappings as configuration issues that may require administrative support.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.