session route valid


missing authentication

Authentication required


malformed bearer exact parser

Authentication required


invalid bearer overrides valid cookie

Authentication required


valid bearer exemption after authentication


expired session rejected

Authentication required


disabled user rejected

Authentication required


login exact origin issues four cookies


login absent origin denied before credential check

Forbidden


invalid credentials nonenumerating

Invalid credentials


logout valid refresh proof revokes and clears


logout invalid refresh only clears cookies


refresh dependency absent is blocked

Service temporarily unavailable


refresh csrf bootstrap dependency absent is blocked

Service temporarily unavailable


refresh stale csrf is forbidden without revocation

Forbidden


refresh ancestor replay after csrf revokes family

Authentication required


prefix origin denied

Forbidden


sibling origin denied

Forbidden


http origin denied

Forbidden


null origin denied

Forbidden


arbitrary origin denied

Forbidden


allowed actual response has exact cors headers


valid preflight uses JSON envelope


mixed-case requested headers accepted canonically


duplicate requested header rejected

Forbidden


unapproved preflight method denied

Forbidden


unapproved preflight header denied

Forbidden


missing header blocks mutation

Forbidden


missing cookie blocks mutation

Forbidden


wrong cookie blocks mutation

Forbidden


wrong header blocks mutation

Forbidden


stale token blocks mutation

Forbidden


absent origin blocks mutation

Forbidden


sibling cookie injection blocks mutation

Forbidden


matching double submit and stored hash permits mutation


csrf persistence failure exposes no token

Service temporarily unavailable


conversion_read owner positive


conversion_read foreign hidden

Not found


conversion_read absent identical

Not found


conversion_cancel owner positive


conversion_cancel foreign hidden

Not found


conversion_cancel absent identical

Not found


download_sign owner positive


download_sign foreign hidden

Not found


download_sign absent identical

Not found


upload_read owner positive


upload_read foreign hidden

Not found


upload_read absent identical

Not found


upload_complete owner positive


upload_complete foreign hidden

Not found


upload_complete absent identical

Not found


source_metadata owner positive


source_metadata foreign hidden

Not found


source_metadata absent identical

Not found


owned library pagination scoped


foreign cursor rejected without data

Invalid request


first canonical acceptance


exact replay returns original identity


same key different hash conflicts

Idempotency key conflict


key too short

Invalid request


key too long

Invalid request


key invalid charset

Invalid request


key absent

Invalid request


same key different actor is independent


twenty way identical race one commit


concurrent different payload one winner one conflict


registration exact limit allowed


registration over limit throttled

Too many requests


login exact limit allowed


login over limit throttled

Too many requests


upload_creation exact limit allowed


upload_creation over limit throttled

Too many requests


upload_completion exact limit allowed


upload_completion over limit throttled

Too many requests


conversion_acceptance exact limit allowed


conversion_acceptance over limit throttled

Too many requests


checkout exact limit allowed


checkout over limit throttled

Too many requests


download_signing exact limit allowed


download_signing over limit throttled

Too many requests


stripe_webhook exact limit allowed


stripe_webhook over limit throttled

Too many requests


worker_claim exact limit allowed


worker_claim over limit throttled

Too many requests


worker_heartbeat exact limit allowed


worker_heartbeat over limit throttled

Too many requests


worker_completion exact limit allowed


worker_completion over limit throttled

Too many requests


admin_mutation exact limit allowed


admin_mutation over limit throttled

Too many requests


missing production rate policy blocks readiness

Service temporarily unavailable


untrusted forwarded headers ignored

Too many requests


trusted proxy normalized ipv6 key

Too many requests


retry command accepted and audited


customer denied retry

Forbidden


adjust command accepted and audited


customer denied adjust

Forbidden


suspend command accepted and audited


customer denied suspend

Forbidden


forged role and owner fields rejected

Invalid request


admin concurrent replay one audit


invalid json

Invalid request


duplicate member

Invalid request


wrong content type

Invalid request


invalid unicode marker

Invalid request


bounded depth marker

Invalid request


unsafe number

Invalid request


unknown nested field

Invalid request


invalid api version header

Invalid request


invalid uuid path

Invalid request


invalid pagination limit

Invalid request


duplicate authorization header marker

Invalid request


bounded oversized authorization marker

Invalid request


app_log excludes sensitive canary classes


proxy_log excludes sensitive canary classes


waf_log excludes sensitive canary classes


cdn_log excludes sensitive canary classes


apm excludes sensitive canary classes


trace excludes sensitive canary classes


metric excludes sensitive canary classes


crash_dump excludes sensitive canary classes


error_reporter excludes sensitive canary classes


support_ui excludes sensitive canary classes


register OPTIONS exact success


register OPTIONS rejects origin

Forbidden


register OPTIONS rejects acr_missing

Forbidden


register OPTIONS rejects method

Forbidden


register OPTIONS rejects header

Forbidden


login OPTIONS exact success


login OPTIONS rejects origin

Forbidden


login OPTIONS rejects acr_missing

Forbidden


login OPTIONS rejects method

Forbidden


login OPTIONS rejects header

Forbidden


logout OPTIONS exact success


logout OPTIONS rejects origin

Forbidden


logout OPTIONS rejects acr_missing

Forbidden


logout OPTIONS rejects method

Forbidden


logout OPTIONS rejects header

Forbidden


session OPTIONS exact success


session OPTIONS rejects origin

Forbidden


session OPTIONS rejects acr_missing

Forbidden


session OPTIONS rejects method

Forbidden


session OPTIONS rejects header

Forbidden


csrf_issue OPTIONS exact success


csrf_issue OPTIONS rejects origin

Forbidden


csrf_issue OPTIONS rejects acr_missing

Forbidden


csrf_issue OPTIONS rejects method

Forbidden


csrf_issue OPTIONS rejects header

Forbidden


refresh_csrf OPTIONS exact success


refresh_csrf OPTIONS rejects origin

Forbidden


refresh_csrf OPTIONS rejects acr_missing

Forbidden


refresh_csrf OPTIONS rejects method

Forbidden


refresh_csrf OPTIONS rejects header

Forbidden


refresh OPTIONS exact success


refresh OPTIONS rejects origin

Forbidden


refresh OPTIONS rejects acr_missing

Forbidden


refresh OPTIONS rejects method

Forbidden


refresh OPTIONS rejects header

Forbidden


password_reset_request OPTIONS exact success


password_reset_request OPTIONS rejects origin

Forbidden


password_reset_request OPTIONS rejects acr_missing

Forbidden


password_reset_request OPTIONS rejects method

Forbidden


password_reset_request OPTIONS rejects header

Forbidden


password_reset_complete OPTIONS exact success


password_reset_complete OPTIONS rejects origin

Forbidden


password_reset_complete OPTIONS rejects acr_missing

Forbidden


password_reset_complete OPTIONS rejects method

Forbidden


password_reset_complete OPTIONS rejects header

Forbidden


register canonical actual success target remains blocked by adapter

Service temporarily unavailable


login canonical actual success target remains blocked by adapter

Service temporarily unavailable


password_reset_request canonical actual success target remains blocked by adapter

Service temporarily unavailable


password_reset_complete canonical actual success target remains blocked by adapter

Service temporarily unavailable


csrf_issue canonical actual success target remains blocked by adapter

Service temporarily unavailable


refresh_csrf canonical actual success target remains blocked by adapter

Service temporarily unavailable


refresh canonical actual success target remains blocked by adapter

Service temporarily unavailable


access expiry clears access and ordinary csrf

safe lookup/CAS/full-family adapter unavailable

Service temporarily unavailable


refresh expiry clears all cookies

Service temporarily unavailable


registration atomic bootstrap

Service temporarily unavailable


login atomic bootstrap

Service temporarily unavailable


refresh csrf generation increments exactly one

Service temporarily unavailable


bootstrap CAS winner and bounded loser

Service temporarily unavailable


two tab stale bootstrap response discarded

Service temporarily unavailable


two tab post logout response cannot repopulate cookies

Service temporarily unavailable


full family ancestor replay revokes family

Service temporarily unavailable


refresh exact committed outcome recovery

Service temporarily unavailable


refresh indeterminate outcome fails closed

Service temporarily unavailable


logout CAS state conflict

Service temporarily unavailable


password reset invalidates all sessions

Service temporarily unavailable


crash seam register_after_send_before_cookie_application

production crash injector and exact-outcome adapter unavailable

Service temporarily unavailable


crash seam register_during_cookie_application

Service temporarily unavailable


crash seam login_after_send_before_cookie_application

Service temporarily unavailable


crash seam login_during_cookie_application

Service temporarily unavailable


crash seam csrf_after_send_before_cookie_application

Service temporarily unavailable


crash seam csrf_during_cookie_application

Service temporarily unavailable


crash seam bootstrap_after_send_before_client_generation_cas

Service temporarily unavailable


crash seam refresh_after_send_before_cookie_application

Service temporarily unavailable


crash seam refresh_during_cookie_application

Service temporarily unavailable


crash seam refresh_after_cookie_application_before_generation_cas

Service temporarily unavailable


crash seam logout_after_send_before_cookie_application

Service temporarily unavailable


crash seam logout_during_cookie_application

Service temporarily unavailable


crash seam reset_request_after_send_connection_loss

Service temporarily unavailable


purchase_read owner parity


purchase_read foreign parity

Not found


account_read owner parity


account_read foreign parity

Not found


zip_download owner parity


zip_download foreign parity

Not found


conversion_list owner parity


conversion_list foreign parity

Not found