The outbox: every message with its status, from queued to accepted by the provider

Troubleshooting

When SecureThread refuses or holds something, it shows a message and a code. AI assistants get the same message but a simpler code. The codes they see are listed under AI assistant refusals. Find the code in the tables below to learn what it means and what to do. A message can include details, such as the addresses that were refused. The details change from case to case. The meaning and the fix do not.

The tables list common refusals. The product can return other codes too. For any code that is not listed here, contact support with the code and the message.

If you call the API, each error response includes a requestId. Give it to support.

Sending refusals#

Before anything is sent: the workspace and the platform#

Code	What you see	What to do
`WORKSPACE_UNAVAILABLE`	This workspace isn't open, so it can't send. Contact SecureThread support.	The workspace is waiting for approval, paused or closing. Contact SecureThread support.
`WORKSPACE_SENDING_PAUSED`	SecureThread paused sending for this workspace, with the reason shown.	SecureThread paused sending automatically because too many messages were refused or complained about. Contact SecureThread support to resume.
`PLATFORM_SENDING_STOPPED`	SecureThread has paused all sending for a moment. Nothing was sent.	Wait, then try again.
`PROVIDER_PAUSED`	SecureThread has paused sending through this kind of mailbox for a moment. Nothing was sent.	Wait, or choose a mailbox of another kind.
`SENDING_DISABLED`	Sending is paused by an administrator. Your draft is safe.	Ask an administrator when sending will resume.
`MAINTENANCE`	The platform is in maintenance. Workspaces can read but not change anything.	Wait for maintenance to end. See the status page.
`SENDER_DOMAIN_NOT_VERIFIED`	Mail from `<domain>` can't be sent until the domain is verified.	An administrator verifies the domain under Administration › Sending domains. See Sending domains and DNS.
`SANDBOX_RECIPIENT_NOT_ALLOWED`	While this workspace is in the sandbox, it can send only to its own people and to its verified domains. The message lists the addresses refused.	Remove those recipients, or verify their domain. Starting a paid plan lifts the sandbox.
`SANDBOX_LIMIT_REACHED`	A workspace in the sandbox can send 50 messages to 100 recipients a day, and this one has reached that.	Wait for the rolling 24 hours to pass, or start a paid plan.
`SANDBOX_CAMPAIGNS_UNAVAILABLE`	Campaigns are available once SecureThread lifts this workspace's sandbox.	Send individual messages until then.
`CAMPAIGNS_NOT_VETTED`	Bulk campaigns open once SecureThread has reviewed this workspace for them. Individual messages are not affected.	Contact SecureThread support to ask for a review.
`FEATURE_DISABLED`	SecureThread has switched this feature off for the workspace.	Contact SecureThread support.

WORKSPACE_UNAVAILABLE

What you see

This workspace isn't open, so it can't send. Contact SecureThread support.

What to do

The workspace is waiting for approval, paused or closing. Contact SecureThread support.

WORKSPACE_SENDING_PAUSED

What you see

SecureThread paused sending for this workspace, with the reason shown.

What to do

SecureThread paused sending automatically because too many messages were refused or complained about. Contact SecureThread support to resume.

PLATFORM_SENDING_STOPPED

What you see

SecureThread has paused all sending for a moment. Nothing was sent.

What to do

Wait, then try again.

PROVIDER_PAUSED

What you see

SecureThread has paused sending through this kind of mailbox for a moment. Nothing was sent.

What to do

Wait, or choose a mailbox of another kind.

SENDING_DISABLED

What you see

Sending is paused by an administrator. Your draft is safe.

What to do

Ask an administrator when sending will resume.

MAINTENANCE

What you see

The platform is in maintenance. Workspaces can read but not change anything.

What to do

Wait for maintenance to end. See the status page.

SENDER_DOMAIN_NOT_VERIFIED

What you see

Mail from <domain> can't be sent until the domain is verified.

What to do

An administrator verifies the domain under Administration › Sending domains. See Sending domains and DNS.

SANDBOX_RECIPIENT_NOT_ALLOWED

What you see

While this workspace is in the sandbox, it can send only to its own people and to its verified domains. The message lists the addresses refused.

What to do

Remove those recipients, or verify their domain. Starting a paid plan lifts the sandbox.

SANDBOX_LIMIT_REACHED

What you see

A workspace in the sandbox can send 50 messages to 100 recipients a day, and this one has reached that.

What to do

Wait for the rolling 24 hours to pass, or start a paid plan.

SANDBOX_CAMPAIGNS_UNAVAILABLE

What you see

Campaigns are available once SecureThread lifts this workspace's sandbox.

What to do

Send individual messages until then.

CAMPAIGNS_NOT_VETTED

What you see

Bulk campaigns open once SecureThread has reviewed this workspace for them. Individual messages are not affected.

What to do

Contact SecureThread support to ask for a review.

FEATURE_DISABLED

What you see

SecureThread has switched this feature off for the workspace.

What to do

Contact SecureThread support.

The sender, the recipients and the content#

Code	What you see	What to do
`SENDER_NOT_ALLOWED`	The message names the From address or mailbox that is not allowed for you.	Choose a mailbox you may send from.
`RECIPIENT_INVALID`	The message names an address that is not valid.	Correct the address.
`RECIPIENT_LIMIT_EXCEEDED`	This message has N recipients. The limit is M per message.	Send to fewer recipients in one message.
`RECIPIENT_DOMAIN_NOT_ALLOWED`	One recipient (or N) is outside the domains your organization allows.	Remove those recipients, or ask an administrator to allow the domain.
`SUPPRESSED_RECIPIENT`	One recipient can no longer be emailed. Their address bounced, they unsubscribed, or they reported a message as spam.	Remove that recipient.
`CONTENT_REJECTED`	The message cannot be sent until one problem is fixed (or N problems). The details list them.	Fix each problem in the details.
`CONTENT_POLICY_VIOLATION`	The message contains language the content policy prohibits. Nothing was sent. The details list the flagged words and your warning count.	Change the flagged words. Repeated violations can lead to suspension of the account.
`CONTENT_POLICY_UNAVAILABLE`	The required AI content check could not run, so the message was held back. This is not a warning about the content.	Try again later.
`ACCOUNT_SUSPENDED`	The account is suspended under the content policy.	Only an administrator can restore the account. Contact SecureThread support.
`ATTACHMENT_REJECTED`	An attachment was refused.	Use a different file, or a smaller one.
`CONNECTION_UNAVAILABLE`	The mailbox can't be used right now.	Test or reconnect the mailbox under Workspace › Integrations.
`MAIL_PROVIDER_UNAVAILABLE`	The mail provider could not be reached, or it answered with an error. Nothing was changed.	Try again later.
`RECIPIENT_LIMIT_EXCEEDED`, detail `LIST_UNSUBSCRIBE_SINGLE_RECIPIENT`	An unsubscribe link can only be added to a message with one recipient.	Remove the link, or send the message as a campaign to several people outside the organization.
`CONTENT_REJECTED`, detail `UNSUBSCRIBE_LINK_UNAVAILABLE`	The `{{unsubscribe_url}}` link only works in campaign and workflow messages sent to one person.	Remove the link, or send the message as a campaign.

SENDER_NOT_ALLOWED

What you see

The message names the From address or mailbox that is not allowed for you.

What to do

Choose a mailbox you may send from.

RECIPIENT_INVALID

What you see

The message names an address that is not valid.

What to do

Correct the address.

RECIPIENT_LIMIT_EXCEEDED

What you see

This message has N recipients. The limit is M per message.

What to do

Send to fewer recipients in one message.

RECIPIENT_DOMAIN_NOT_ALLOWED

What you see

One recipient (or N) is outside the domains your organization allows.

What to do

Remove those recipients, or ask an administrator to allow the domain.

SUPPRESSED_RECIPIENT

What you see

One recipient can no longer be emailed. Their address bounced, they unsubscribed, or they reported a message as spam.

What to do

Remove that recipient.

CONTENT_REJECTED

What you see

The message cannot be sent until one problem is fixed (or N problems). The details list them.

What to do

Fix each problem in the details.

CONTENT_POLICY_VIOLATION

What you see

The message contains language the content policy prohibits. Nothing was sent. The details list the flagged words and your warning count.

What to do

Change the flagged words. Repeated violations can lead to suspension of the account.

CONTENT_POLICY_UNAVAILABLE

What you see

The required AI content check could not run, so the message was held back. This is not a warning about the content.

What to do

Try again later.

ACCOUNT_SUSPENDED

What you see

The account is suspended under the content policy.

What to do

Only an administrator can restore the account. Contact SecureThread support.

ATTACHMENT_REJECTED

What you see

An attachment was refused.

What to do

Use a different file, or a smaller one.

CONNECTION_UNAVAILABLE

What you see

The mailbox can't be used right now.

What to do

Test or reconnect the mailbox under Workspace › Integrations.

MAIL_PROVIDER_UNAVAILABLE

What you see

The mail provider could not be reached, or it answered with an error. Nothing was changed.

What to do

Try again later.

RECIPIENT_LIMIT_EXCEEDED, detail LIST_UNSUBSCRIBE_SINGLE_RECIPIENT

What you see

An unsubscribe link can only be added to a message with one recipient.

What to do

Remove the link, or send the message as a campaign to several people outside the organization.

CONTENT_REJECTED, detail UNSUBSCRIBE_LINK_UNAVAILABLE

What you see

The {{unsubscribe_url}} link only works in campaign and workflow messages sent to one person.

What to do

Remove the link, or send the message as a campaign.

Limits#

Code	What you see	What to do
`PLAN_LIMIT_REACHED`	This workspace can send N messages to M recipients a day on its plan, and has reached that.	Try again later, or change the plan under Administration › Billing.
`QUOTA_EXCEEDED`	You have reached your sending limit. The message says when you can send again.	Wait the time shown.
`RATE_LIMITED`	Too many requests in a short time.	Wait the number of seconds in the `Retry-After` header or in `retryAfterSeconds`.
`FEATURE_NOT_IN_PLAN`	The feature isn't included in this workspace's plan.	Change the plan under Administration › Billing.

PLAN_LIMIT_REACHED

What you see

This workspace can send N messages to M recipients a day on its plan, and has reached that.

What to do

Try again later, or change the plan under Administration › Billing.

QUOTA_EXCEEDED

What you see

You have reached your sending limit. The message says when you can send again.

What to do

Wait the time shown.

RATE_LIMITED

What you see

Too many requests in a short time.

What to do

Wait the number of seconds in the Retry-After header or in retryAfterSeconds.

FEATURE_NOT_IN_PLAN

What you see

The feature isn't included in this workspace's plan.

What to do

Change the plan under Administration › Billing.

Approvals and holds#

Code	What you see	What to do
`APPROVAL_REQUIRED`	A person has to approve this in SecureThread.	Give the person the approval link. Nothing is sent until they approve it.
`APPROVAL_NOT_PENDING`	The request is no longer waiting. It was approved, declined, expired or voided.	Check its status. Make a new request if it still needs to go out.
`APPROVAL_STALE`	The item changed after the request was made.	Make a new request.
`SELF_APPROVAL_NOT_ALLOWED`	You can't approve your own request.	Ask another person who may approve.

APPROVAL_REQUIRED

What you see

A person has to approve this in SecureThread.

What to do

Give the person the approval link. Nothing is sent until they approve it.

APPROVAL_NOT_PENDING

What you see

The request is no longer waiting. It was approved, declined, expired or voided.

What to do

Check its status. Make a new request if it still needs to go out.

APPROVAL_STALE

What you see

The item changed after the request was made.

What to do

Make a new request.

SELF_APPROVAL_NOT_ALLOWED

What you see

You can't approve your own request.

What to do

Ask another person who may approve.

The approval page can also say "Only an administrator can approve this request.", or "You can't approve a request you're involved in." Both mean another person has to decide. See Agents and approvals.

Scheduled sends, campaigns and workflows#

Scheduled sends and campaigns can also be refused with codes such as SCHEDULE_TIME_INVALID and CAMPAIGN_NOT_READY. A campaign that is not ready lists why, for example EXTERNAL_NOT_ALLOWED (the organization has not allowed campaigns to external recipients) or REPEAT_DETECTED (the same content went to the same audience recently; confirm the repeat to continue). Each message says what to change. If a message does not say, contact support and give the code.

Code	What you see	What to do
`SCHEDULE_NOT_EDITABLE`	The schedule is not in a state that allows this change, such as a cancelled or completed schedule.	Check the schedule's status. Schedule the email again if it still needs to go.
`RECURRENCE_INVALID`	The repeat rule is incomplete, has no dates left to send, or the send time is not a valid date and time.	Change the repeat rule or the send time, then save again.
`CAMPAIGN_RECIPIENT_LIMIT`	The campaign or import would exceed the organization's recipient limit.	Send to fewer recipients.
`CAMPAIGN_IMPORT_INVALID`	The file has no email column.	Add the email column to the file, then import it again.
`CAMPAIGN_CONFIRMATION_MISMATCH`	The recipient count changed before you confirmed it. The message gives the count now.	Check the count, confirm it again, then send.
`TEMPLATE_CHECKS_FAILED`	Publishing needs a passing check of this exact version of the template first.	Run the checks, then publish.
`CONTENT_TOO_LARGE`	A template's source is larger than the limit. The message gives the limit.	Make the template smaller.

SCHEDULE_NOT_EDITABLE

What you see

The schedule is not in a state that allows this change, such as a cancelled or completed schedule.

What to do

Check the schedule's status. Schedule the email again if it still needs to go.

RECURRENCE_INVALID

What you see

The repeat rule is incomplete, has no dates left to send, or the send time is not a valid date and time.

What to do

Change the repeat rule or the send time, then save again.

CAMPAIGN_RECIPIENT_LIMIT

What you see

The campaign or import would exceed the organization's recipient limit.

What to do

Send to fewer recipients.

CAMPAIGN_IMPORT_INVALID

What you see

The file has no email column.

What to do

Add the email column to the file, then import it again.

CAMPAIGN_CONFIRMATION_MISMATCH

What you see

The recipient count changed before you confirmed it. The message gives the count now.

What to do

Check the count, confirm it again, then send.

TEMPLATE_CHECKS_FAILED

What you see

Publishing needs a passing check of this exact version of the template first.

What to do

Run the checks, then publish.

CONTENT_TOO_LARGE

What you see

A template's source is larger than the limit. The message gives the limit.

What to do

Make the template smaller.

Other send and route codes#

Code	What you see	What to do
`CONCURRENT_CHANGE`	Someone else changed the item first.	Reload it, make the change again, then save.
`MESSAGE_NOT_RETRYABLE`	The message cannot be retried in its current state. The message says why.	Read the message, then check the message's status before trying again.
`ROUTING_DENIED`	A routing rule does not allow this message. The message says why.	Choose another mailbox, or ask an administrator to review the routing rule.
`NO_ROUTE_AVAILABLE`	No routing rule finds a mailbox for this message, and you did not choose one. The message explains why.	Choose a mailbox for the message.
`CONNECTION_SUSPENDED`	An administrator has suspended this mailbox.	Choose another mailbox, or ask an administrator to resume it.
`PROVIDER_DISABLED`	An administrator has turned off sending through this mailbox's provider.	Choose a mailbox on another provider.
`PROVIDER_NOT_CONFIGURED`	The provider is not set up on this server, so mail cannot go through it.	Choose a mailbox on another provider, or ask an administrator to set it up.
`SENDER_DOMAIN_NOT_APPROVED`	The sending domain of this address is not approved for this service.	An administrator must add the domain under Administration › Mailboxes first.

CONCURRENT_CHANGE

What you see

Someone else changed the item first.

What to do

Reload it, make the change again, then save.

MESSAGE_NOT_RETRYABLE

What you see

The message cannot be retried in its current state. The message says why.

What to do

Read the message, then check the message's status before trying again.

ROUTING_DENIED

What you see

A routing rule does not allow this message. The message says why.

What to do

Choose another mailbox, or ask an administrator to review the routing rule.

NO_ROUTE_AVAILABLE

What you see

No routing rule finds a mailbox for this message, and you did not choose one. The message explains why.

What to do

Choose a mailbox for the message.

CONNECTION_SUSPENDED

What you see

An administrator has suspended this mailbox.

What to do

Choose another mailbox, or ask an administrator to resume it.

PROVIDER_DISABLED

What you see

An administrator has turned off sending through this mailbox's provider.

What to do

Choose a mailbox on another provider.

PROVIDER_NOT_CONFIGURED

What you see

The provider is not set up on this server, so mail cannot go through it.

What to do

Choose a mailbox on another provider, or ask an administrator to set it up.

SENDER_DOMAIN_NOT_APPROVED

What you see

The sending domain of this address is not approved for this service.

What to do

An administrator must add the domain under Administration › Mailboxes first.

AI drafting codes#

Code	What you see	What to do
`AI_DISABLED`	AI features are not available to you. AI may be off for the workspace, no AI provider may be set up, external processing may not be allowed, or your role may not include AI.	Ask an administrator to check the AI settings.
`AI_NOT_CONFIGURED`	The AI provider refused its key, or no model and key are saved for it.	An administrator saves a model and a valid API key for the AI provider.
`AI_PROVIDER_FAILED`	The AI provider could not complete the request.	Try again later.
`AI_OUTPUT_REJECTED`	The AI reply could not be used, or it was cut short.	Try again, or write the text yourself.

AI_DISABLED

What you see

AI features are not available to you. AI may be off for the workspace, no AI provider may be set up, external processing may not be allowed, or your role may not include AI.

What to do

Ask an administrator to check the AI settings.

AI_NOT_CONFIGURED

What you see

The AI provider refused its key, or no model and key are saved for it.

What to do

An administrator saves a model and a valid API key for the AI provider.

AI_PROVIDER_FAILED

What you see

The AI provider could not complete the request.

What to do

Try again later.

AI_OUTPUT_REJECTED

What you see

The AI reply could not be used, or it was cut short.

What to do

Try again, or write the text yourself.

API responses#

Code	What you see	What to do
`VALIDATION_FAILED`	A field is not valid. The details name each field.	Correct the named fields.
`UNAUTHENTICATED`	You are not signed in, or your session has ended.	Sign in again.
`FORBIDDEN`	You are signed in, but your role does not allow this action.	Ask an administrator, or check your role.
`NOT_FOUND`	The item does not exist, or you cannot see it.	Check the reference, or choose another item.
`PAYLOAD_TOO_LARGE`	The request is larger than the limit.	Make the request smaller.

VALIDATION_FAILED

What you see

A field is not valid. The details name each field.

What to do

Correct the named fields.

UNAUTHENTICATED

What you see

You are not signed in, or your session has ended.

What to do

FORBIDDEN

What you see

You are signed in, but your role does not allow this action.

What to do

Ask an administrator, or check your role.

NOT_FOUND

What you see

The item does not exist, or you cannot see it.

What to do

Check the reference, or choose another item.

PAYLOAD_TOO_LARGE

What you see

The request is larger than the limit.

What to do

Make the request smaller.

Drafts and idempotency (API callers)#

Code	What you see	What to do
`IDEMPOTENCY_KEY_REQUIRED`	Sending requires an `Idempotency-Key` header, so a retried request cannot send twice.	Send a unique key for each message, such as a UUID.
`IDEMPOTENCY_KEY_REUSED`	The key was already used for a different message.	Use a new key for new content.
`IDEMPOTENCY_IN_PROGRESS`	This message is already being submitted.	Wait, then check its status.
`DRAFT_SCHEDULED`	This draft is reserved by a scheduled send.	Open the schedule and choose Edit as draft to change the draft or send it yourself.
`MESSAGE_NOT_EDITABLE`	The draft was already sent and can no longer be changed.	None.
`MESSAGE_NOT_CANCELLABLE`	Only messages still waiting to be sent can be cancelled.	None.
`CONFLICT` (drafts)	This draft was changed in another window.	Reload the draft, then save again.

IDEMPOTENCY_KEY_REQUIRED

What you see

Sending requires an Idempotency-Key header, so a retried request cannot send twice.

What to do

Send a unique key for each message, such as a UUID.

IDEMPOTENCY_KEY_REUSED

What you see

The key was already used for a different message.

What to do

Use a new key for new content.

IDEMPOTENCY_IN_PROGRESS

What you see

This message is already being submitted.

What to do

Wait, then check its status.

DRAFT_SCHEDULED

What you see

This draft is reserved by a scheduled send.

What to do

Open the schedule and choose Edit as draft to change the draft or send it yourself.

MESSAGE_NOT_EDITABLE

What you see

The draft was already sent and can no longer be changed.

What to do

None.

MESSAGE_NOT_CANCELLABLE

What you see

Only messages still waiting to be sent can be cancelled.

What to do

None.

CONFLICT (drafts)

What you see

This draft was changed in another window.

What to do

Reload the draft, then save again.

AI assistant refusals#

Codes an assistant sees#

These codes come back in the results of assistant requests. Each one tells the assistant what to do next.

Code	Meaning	What to do
`AUTHENTICATION_REQUIRED`	The assistant's access no longer works. It may be revoked or expired, or the person changed their password.	Reconnect the assistant. See AI assistants (MCP).
`PERMISSION_DENIED`	The person's role, or the access this assistant was given, does not allow the action.	Do not retry. Ask the person, or change the access level.
`NOT_FOUND`	The item does not exist, or the person cannot see it.	Check the reference, or choose another item.
`CONNECTION_NOT_FOUND`	The mailbox connection does not exist, or the person cannot use it.	List the connections and choose another.
`PROVIDER_REAUTH_REQUIRED`	The mailbox's sign-in has expired or was revoked.	The person reconnects the mailbox under Workspace › Integrations.
`PROVIDER_UNAVAILABLE`	The mailbox provider could not complete the request, or it is not set up.	Try again later, or tell the person.
`VALIDATION_ERROR`	Some arguments are not valid. The details name each field.	Correct the named fields.
`CONTENT_REJECTED`	The email content or an attachment was refused. It may be unsafe, too large, or unable to render.	Change the content before trying again.
`APPROVAL_REQUIRED`	A person has to finish this in SecureThread.	Give the person the approval link, then stop.
`RATE_LIMITED`	Too many requests.	Wait the number of seconds in `retryAfterSeconds`.
`QUOTA_EXCEEDED`	A sending limit has been reached. It resets later.	Tell the person.
`SENDING_DISABLED`	An administrator has switched sending off for the organization.	Nothing can be sent until sending is switched on again.
`IDEMPOTENCY_CONFLICT`	The idempotency key was already used for a different request, or the first request is still running.	Use a new key only for a genuinely new request.
`CONFLICT`	The current state does not allow the action, for example because the message was already sent or the draft changed.	Read the item again, then decide.
`INTERNAL_ERROR`	Something went wrong on SecureThread's side.	Try again later.

AUTHENTICATION_REQUIRED

Meaning

The assistant's access no longer works. It may be revoked or expired, or the person changed their password.

What to do

Reconnect the assistant. See AI assistants (MCP).

PERMISSION_DENIED

Meaning

The person's role, or the access this assistant was given, does not allow the action.

What to do

Do not retry. Ask the person, or change the access level.

NOT_FOUND

Meaning

The item does not exist, or the person cannot see it.

What to do

Check the reference, or choose another item.

CONNECTION_NOT_FOUND

Meaning

The mailbox connection does not exist, or the person cannot use it.

What to do

List the connections and choose another.

PROVIDER_REAUTH_REQUIRED

Meaning

The mailbox's sign-in has expired or was revoked.

What to do

The person reconnects the mailbox under Workspace › Integrations.

PROVIDER_UNAVAILABLE

Meaning

The mailbox provider could not complete the request, or it is not set up.

What to do

Try again later, or tell the person.

VALIDATION_ERROR

Meaning

Some arguments are not valid. The details name each field.

What to do

Correct the named fields.

CONTENT_REJECTED

Meaning

The email content or an attachment was refused. It may be unsafe, too large, or unable to render.

What to do

Change the content before trying again.

APPROVAL_REQUIRED

Meaning

A person has to finish this in SecureThread.

What to do

Give the person the approval link, then stop.

RATE_LIMITED

Meaning

Too many requests.

What to do

Wait the number of seconds in retryAfterSeconds.

QUOTA_EXCEEDED

Meaning

A sending limit has been reached. It resets later.

What to do

Tell the person.

SENDING_DISABLED

Meaning

An administrator has switched sending off for the organization.

What to do

Nothing can be sent until sending is switched on again.

IDEMPOTENCY_CONFLICT

Meaning

The idempotency key was already used for a different request, or the first request is still running.

What to do

Use a new key only for a genuinely new request.

CONFLICT

Meaning

The current state does not allow the action, for example because the message was already sent or the draft changed.

What to do

Read the item again, then decide.

INTERNAL_ERROR

Meaning

Something went wrong on SecureThread's side.

What to do

Try again later.

An assistant's send request that waits for approval returns pending_confirmation or PENDING_APPROVAL. This is expected. Give the person the approval link.

Access and agent codes#

Code	What you see	What to do
`AI_ACCESS_DISABLED`	AI assistant access is turned off for your organization.	An administrator turns it on under Administration › AI access.
`AGENT_PAUSED`	The agent is paused. Nothing it asks for is done until someone resumes it.	Resume the agent under Workspace › Agents.
`AGENT_REVOKED`	The agent was revoked and can no longer act.	Create a new agent.
`AGENT_POLICY_VIOLATION`	The request is outside the agent's policy. The message says why: for example, the recipients are outside its allowed list, or it must send from a published template.	Change the request to fit the policy, or change the policy. A person can send the email instead.
`AGENT_LIMIT_REACHED`	The agent's own daily limit is reached.	Wait for the rolling 24 hours to pass, or raise the limit in its policy.

AI_ACCESS_DISABLED

What you see

AI assistant access is turned off for your organization.

What to do

An administrator turns it on under Administration › AI access.

AGENT_PAUSED

What you see

The agent is paused. Nothing it asks for is done until someone resumes it.

What to do

Resume the agent under Workspace › Agents.

AGENT_REVOKED

What you see

The agent was revoked and can no longer act.

What to do

Create a new agent.

AGENT_POLICY_VIOLATION

What you see

The request is outside the agent's policy. The message says why: for example, the recipients are outside its allowed list, or it must send from a published template.

What to do

Change the request to fit the policy, or change the policy. A person can send the email instead.

AGENT_LIMIT_REACHED

What you see

The agent's own daily limit is reached.

What to do

Wait for the rolling 24 hours to pass, or raise the limit in its policy.

Code	What you see	What to do
`INVALID_CREDENTIALS`	That email address and password do not match.	Check the address and password. Use reset if you forgot the password.
`ACCOUNT_LOCKED`	This account is temporarily locked after too many wrong passwords or codes. Try again later.	Wait for the time the page shows, then try again.
`ACCOUNT_DEACTIVATED`	The account has been deactivated.	Ask an administrator.
`MFA_REQUIRED`	The account needs a two-step verification code.	Enter the current code from your authenticator app.
`MFA_INVALID`	The verification code was wrong or has expired.	Enter the current code.
`MFA_ENROLLMENT_REQUIRED`	Two-step verification must be set up before you can sign in.	Follow the prompt to set it up.
`TOKEN_INVALID`	A sign-in, invitation or reset link is used, expired or incorrect.	Request a new link. Sign-up links work once and expire after a day.
`CSRF_INVALID`	The page's security check failed.	Reload the page and try again.
`WORKSPACE_PENDING_APPROVAL`	"Your workspace is waiting for approval. We review new workspaces before anyone can sign in, and we'll email you when it's ready."	Wait for the email.
`WORKSPACE_UNAVAILABLE` (sign-in)	"Your workspace isn't open right now. It may still be waiting for approval, or it has been paused."	Contact the person who set up the workspace, or SecureThread support.
`SIGNUP_PAUSED`	New sign-ups are paused.	Try again later, or ask for an invitation.

INVALID_CREDENTIALS

What you see

That email address and password do not match.

What to do

Check the address and password. Use reset if you forgot the password.

ACCOUNT_LOCKED

What you see

This account is temporarily locked after too many wrong passwords or codes. Try again later.

What to do

Wait for the time the page shows, then try again.

ACCOUNT_DEACTIVATED

What you see

The account has been deactivated.

What to do

Ask an administrator.

MFA_REQUIRED

What you see

The account needs a two-step verification code.

What to do

Enter the current code from your authenticator app.

MFA_INVALID

What you see

The verification code was wrong or has expired.

What to do

Enter the current code.

MFA_ENROLLMENT_REQUIRED

What you see

Two-step verification must be set up before you can sign in.

What to do

Follow the prompt to set it up.

TOKEN_INVALID

What you see

A sign-in, invitation or reset link is used, expired or incorrect.

What to do

Request a new link. Sign-up links work once and expire after a day.

CSRF_INVALID

What you see

The page's security check failed.

What to do

Reload the page and try again.

WORKSPACE_PENDING_APPROVAL

What you see

"Your workspace is waiting for approval. We review new workspaces before anyone can sign in, and we'll email you when it's ready."

What to do

Wait for the email.

WORKSPACE_UNAVAILABLE (sign-in)

What you see

"Your workspace isn't open right now. It may still be waiting for approval, or it has been paused."

What to do

Contact the person who set up the workspace, or SecureThread support.

SIGNUP_PAUSED

What you see

New sign-ups are paused.

What to do

Try again later, or ask for an invitation.

Mailbox connection#

Code	What you see	What to do
`NEEDS_REAUTH`, `TOKEN_REVOKED`, `TOKEN_EXPIRED`	The mailbox's sign-in has expired or was revoked.	Reconnect the mailbox under Workspace › Integrations.
`INSUFFICIENT_SCOPE`, `SCOPE_NOT_GRANTED`	The connection does not have the access SecureThread needs.	Reconnect, and approve the access the provider asks for.
`APP_PASSWORD_REQUIRED`	The provider needs an app password for this connection.	Create an app password in the account's security settings, and enter it.
`SMTP_AUTH_DISABLED`	The provider has turned off password sign-in for SMTP on this mailbox.	Connect with Sign in with your provider instead, or ask the provider's administrator to allow SMTP sign-in.
`DAILY_LIMIT_EXCEEDED`	The mailbox provider's daily sending limit is reached.	Wait for the provider's limit to reset, or send from another mailbox.

NEEDS_REAUTH, TOKEN_REVOKED, TOKEN_EXPIRED

What you see

The mailbox's sign-in has expired or was revoked.

What to do

Reconnect the mailbox under Workspace › Integrations.

INSUFFICIENT_SCOPE, SCOPE_NOT_GRANTED

What you see

The connection does not have the access SecureThread needs.

What to do

Reconnect, and approve the access the provider asks for.

APP_PASSWORD_REQUIRED

What you see

The provider needs an app password for this connection.

What to do

Create an app password in the account's security settings, and enter it.

SMTP_AUTH_DISABLED

What you see

The provider has turned off password sign-in for SMTP on this mailbox.

What to do

Connect with Sign in with your provider instead, or ask the provider's administrator to allow SMTP sign-in.

DAILY_LIMIT_EXCEEDED

What you see

The mailbox provider's daily sending limit is reached.

What to do

Wait for the provider's limit to reset, or send from another mailbox.

AI assistant connection#

What you see	What it means	What to do
The assistant says it needs sign-in, but no browser opens.	The assistant could not read the sign-in details.	On AI access, choose Check connection. If the check fails, contact support.
"This request has expired."	The consent request is older than 10 minutes.	Start connecting again from the app.
"This request isn't available."	The request was approved or denied already, has expired, or was started in another browser.	Start again from the app, in the browser you are using now.
"SecureThread doesn't recognise this app."	The app is not registered with SecureThread.	Start again from the app. If it keeps happening, remove SecureThread from the app and add it again.
"This app asked to return to an unknown address."	SecureThread only returns to addresses the app registered in advance.	The app needs to register again. Contact the app's support.
"AI assistants are turned off."	Your organization has not turned AI assistant access on.	Ask an administrator to turn it on under Administration › AI access.
"Too many connection attempts."	SecureThread is limiting new connections for a moment.	Wait a minute, then start again.
The consent page shows an address that is not yours in It will act as.	The connection would act as someone else.	Choose Deny. Sign in with your own account, then start again.
`invalid_token` (401) from a connected assistant.	Its access expired or was revoked, your password changed, or your permission to use assistants was removed.	Reconnect the assistant.
403 or `access_denied` with a valid token.	AI assistant access is off, or the request came from a web page rather than an assistant app.	Ask an administrator to check AI access.
A tool is missing from the assistant's list.	The access level was not approved, or your role lacks the permission. Administration tools also need the Administration level, approved from a session that completed two-step verification.	Check What assistants can do on AI access. Reconnect with the level you need.
HTTP 429	The connection is limited for a moment.	Wait the number of seconds in `Retry-After`.
Check connection reports a different address from the one you use.	The address configured for SecureThread differs from the address you use.	Contact SecureThread support.

The assistant says it needs sign-in, but no browser opens.

What it means

The assistant could not read the sign-in details.

What to do

On AI access, choose Check connection. If the check fails, contact support.

"This request has expired."

What it means

The consent request is older than 10 minutes.

What to do

Start connecting again from the app.

"This request isn't available."

What it means

The request was approved or denied already, has expired, or was started in another browser.

What to do

Start again from the app, in the browser you are using now.

"SecureThread doesn't recognise this app."

What it means

The app is not registered with SecureThread.

What to do

Start again from the app. If it keeps happening, remove SecureThread from the app and add it again.

"This app asked to return to an unknown address."

What it means

SecureThread only returns to addresses the app registered in advance.

What to do

The app needs to register again. Contact the app's support.

"AI assistants are turned off."

What it means

Your organization has not turned AI assistant access on.

What to do

Ask an administrator to turn it on under Administration › AI access.

"Too many connection attempts."

What it means

SecureThread is limiting new connections for a moment.

What to do

Wait a minute, then start again.

The consent page shows an address that is not yours in It will act as.

What it means

The connection would act as someone else.

What to do

Choose Deny. Sign in with your own account, then start again.

invalid_token (401) from a connected assistant.

What it means

Its access expired or was revoked, your password changed, or your permission to use assistants was removed.

What to do

Reconnect the assistant.

403 or access_denied with a valid token.

What it means

AI assistant access is off, or the request came from a web page rather than an assistant app.

What to do

Ask an administrator to check AI access.

A tool is missing from the assistant's list.

What it means

The access level was not approved, or your role lacks the permission. Administration tools also need the Administration level, approved from a session that completed two-step verification.

What to do

Check What assistants can do on AI access. Reconnect with the level you need.

HTTP 429

What it means

The connection is limited for a moment.

What to do

Wait the number of seconds in Retry-After.

Check connection reports a different address from the one you use.

What it means

The address configured for SecureThread differs from the address you use.

What to do

Contact SecureThread support.

Sending domain (DNS) errors#

Each DNS message has a meaning and a fix. The messages include "DNS didn't answer", "Not found yet", "Wrong value", a doubled name, and SPF records that are duplicated or too long. The full list is in Sending domains and DNS.

Contact support#

If none of the entries above fits your problem, contact support with the code, the message, the time and the page you were on. See Support.

Troubleshooting

Sending refusals#

Before anything is sent: the workspace and the platform#

The sender, the recipients and the content#

Limits#

Approvals and holds#

Scheduled sends, campaigns and workflows#

Other send and route codes#

AI drafting codes#

API responses#

Drafts and idempotency (API callers)#

AI assistant refusals#

Codes an assistant sees#

Access and agent codes#

Sign-in and sign-up#

Mailbox connection#

AI assistant connection#

Sending domain (DNS) errors#

Contact support#