Skip to content

Federated Attribute Invalid

URI: https://docs.ankatech.co/errors/federated-attribute-invalid
HTTP Status: 400 Bad Request

When you see this

The just-in-time provisioning request for a federated login was rejected because one of the attributes the end user or their identity provider supplies did not satisfy its contract. This type is raised only when every failing field is one the federated user actually influences — externalSubject, email, displayName, groups or hostedDomain. A rejection that also names a platform-supplied field such as tenantId keeps the generic validation type instead, because it is not something the end user can have caused alone.

Common Causes

  • The asserted email address is not a well-formed address, or exceeds the accepted length.
  • The display name the identity provider asserts is longer than the contract allows.
  • One entry of the asserted groups list violates its size or format constraint — the response names the offending index, for example groups[3].
  • The external subject identifier is blank or over-long.
  • The hosted-domain claim is malformed.
  • A body-level deserialization failure on one of those same five components — a value of the wrong JSON type, for example.

Response Example

{
  "type": "https://docs.ankatech.co/errors/federated-attribute-invalid",
  "title": "Federated Attribute Invalid",
  "status": 400,
  "detail": "'email' must be a well-formed email address",
  "instance": "/api/v3/admin/s2s/auth/idp/provision",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the detail: it names each offending field path and the constraint it failed, and keeps the collection index so a group entry can be located exactly.
  2. Correct the claim at the identity provider — the offending value is asserted by the provider or entered by the user, not by the platform.
  3. If the field named is one the provider cannot change, adjust the claim mapping so the platform receives a value of the expected shape.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.