feat(dgw): explain rejected requests in API error responses by CBenoit · Pull Request #2081 · Devolutions/devolutions-gateway

Benoît Cortier (CBenoit) · 2026-10-15T08:13:13Z

API errors now include a machine-readable reason (RFC 9457 problem details). Devolutions Server, Devolutions Hub and other clients can show precise errors, such as a provisioner key mismatch, an expired token (clock skew) or a gateway ID mismatch, instead of a generic failure.

Issue: DGW-467

🤖 Generated with Claude Code

API errors now include a machine-readable reason (RFC 9457 problem details). Devolutions Server, Devolutions Hub and other clients can show precise errors, such as a provisioner key mismatch, an expired token (clock skew) or a gateway ID mismatch, instead of a generic failure. Issue: DGW-467 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Issue: DGW-467 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Benoît Cortier (CBenoit) · 2026-10-15T08:13:22Z

Implementation notes:

Format

Every HttpError response now has an RFC 9457 body with Content-Type: application/problem+json: {"type":"about:blank","title":"Unauthorized","status":401,"error":"gateway_id_mismatch"}.
type is always about:blank, so title is the status reason phrase, as RFC 9457 recommends. The code lives in an error extension member, the name /jet/net/scan already uses for its 400 body.
.NET clients can read it with ProblemDetails; the code ends up in Extensions["error"].
The bare 408 from the timeout layer now has the same body (request_timeout).

One list of codes

devolutions-gateway/src/error_code.rs defines ErrorCode once, through a small declarative macro, so the variant, its wire string (as_str()) and its description can't drift apart. Serialize and the OpenAPI schema both go through as_str(), so later PRs can reuse it for WebSocket close frames and RDCleanPath errors.
HttpErrorBuilder::with_error_code() sets a specific code. Without one, the code comes from the status: bad_request, unauthorized, forbidden, not_found, request_timeout, conflict, payload_too_large, internal_error, bad_gateway, service_unavailable, gateway_timeout, insufficient_storage.
Token and authorization codes: missing_token, malformed_token, bad_signature, unknown_subkey, expired, not_yet_valid, gateway_id_mismatch, revoked, unexpected_replay, invalid_token (401), wrong_token_type, insufficient_scope (403). TokenError::code() maps every variant with an exhaustive match, so a new TokenError variant can't compile without a decision.
The jwt_rejected system events now take error.code().as_str(), so the event log and the response always carry the same string (bad_signature, unexpected_replay: same values as before).
Codes are public API: append-only, never renamed. A snapshot test (codes_are_stable) fails on any rename or removal. New codes go at the end, because the generated .NET enum numbers its members by position.

Disclosure

Only the code leaves the Gateway. The msg strings, the source chain, key names, claim values and so on are still logged, now with an error_code field so a code reported by a client can be matched to its log entry.
The signature check still runs before any claim check. Everything raised before it (JWE decryption, missing delegation key, JWS decoding) maps to malformed_token, so a caller without a properly signed token only ever sees missing_token, malformed_token, bad_signature or unknown_subkey. An integration test signs expired, not-yet-valid, wrong-gateway and malformed-claims tokens with an untrusted key and expects bad_signature for all of them.
WWW-Authenticate follows RFC 6750: Bearer for missing_token, Bearer error="invalid_token" for the 401 token codes, Bearer error="insufficient_scope" for insufficient_scope. wrong_token_type and the Basic-auth 401s of /jet/webapp/app-token carry no Bearer challenge.

OpenAPI and clients

New ApiError and ErrorCode schemas. The error property is typed as a plain string that points to ErrorCode, rather than as a $ref to the enum: the generated .NET client deserializes enums with Newtonsoft's StringEnumConverter, which throws on unknown values, and that would break old clients as soon as a new code is added. Clients compare against ErrorCode.X.ToValue() (.NET) or ErrorCode.X (TypeScript).
The error responses declare application/problem+json bodies, except on endpoints whose success body isn't JSON (GetLogs, SignAppToken, SignSessionToken, PullRecordingSession). The generated TypeScript client picks the first JSON media type among all responses for Accept and for parsing, so it would start parsing logs, tokens and ZIP files as JSON. The 400 of /jet/net/scan keeps its own JSON body, and /jet/health has no HttpError path.
utoipa 4 turns body = crate::http::ApiError into a $ref named crate.http.ApiError, so the annotations use the bare ApiError name (utoipa 4 only uses it as a string).
/jet/jrec/search (merged from master) declares the same error body in its annotation, but the spec isn't regenerated for it here: chore(openapi): add the recording search endpoint to the clients #2114 adds that endpoint to the spec and clients, and whichever PR lands second picks up both changes on regeneration.
gateway-api.yaml and the clients are regenerated in a separate commit. The spec had not been regenerated since the 2026.3.2 version bump, so the document version changes in every generated file header too. Client package versions are not bumped.

Not covered yet

Rejections produced by axum itself (unknown route 404, 405, JSON body parsing 400/415/422) and the custom 400 body of /jet/net/scan don't use this format yet.

Testing

Unit tests next to the code, as testsuite/CLAUDE.md asks for tests of Gateway internals: rstest mapping of every TokenError variant (token.rs) and a snapshot of all codes (error_code.rs).
Every new test carries an oracle marker citing docs/API-spec.md (the new Errors section, plus the SCOPE, JRL, scopes and OpenAPI sections where a test's setup depends on them). The SCOPE section now states the existing rule that a SCOPE token is valid for a single request, which the unexpected_replay test relies on.
testsuite/tests/cli/dgw/api_errors.rs: starts the Gateway with token validation enabled, a test provisioner key and a Gateway ID, and checks status, Content-Type, WWW-Authenticate and the exact body (nothing but the four members) for each code, the disclosure order, the generic fallback (not_found), and the KDC proxy path token.
New helpers: testsuite::token (trusted and untrusted test keys, signing) and DgwConfig::id. Tokens are signed with picky directly instead of tools/tokengen: tokengen always uses nbf = now, so it can't make expired or not-yet-valid tokens, and it is a separate workspace with its own dependency tree.
Dependencies: picky, base64 and uuid move from the testsuite's dev-dependencies to its dependencies, because the testsuite::token and DgwConfig::id helpers in src/ need them. No new crate is added. The tests sign real tokens instead of using disable_token_validation, since token validation is what they test.

Copilot

🔵 Needs a closer look

One or more issues must be addressed before approval.

0 open findings

What changed in this PR

Adds machine-readable API rejection reasons to help clients diagnose Gateway authentication failures without exposing internal details.

Changes:

Adds stable error codes, RFC 9457 responses, and bearer-token challenges.
Documents the response format and updates generated clients.
Adds error-code tests and token-signing helpers.

No material findings identified. Tests were not executed. The separate prose-verifier pass was skipped due to the five-skill limit.

File	Description
testsuite/tests/main.rs	Updated as part of this pull request.
testsuite/tests/error_codes.rs	Updated as part of this pull request.
testsuite/tests/cli/dgw/mod.rs	Updated as part of this pull request.
testsuite/src/token.rs	Updated as part of this pull request.
testsuite/src/lib.rs	Updated as part of this pull request.
testsuite/src/dgw_config.rs	Updated as part of this pull request.
testsuite/Cargo.toml	Updated as part of this pull request.
docs/API-spec.md	Updated as part of this pull request.
devolutions-gateway/tests/webapp.rs	Updated as part of this pull request.
devolutions-gateway/src/token.rs	Updated as part of this pull request.
devolutions-gateway/src/openapi.rs	Updated as part of this pull request.
devolutions-gateway/src/middleware/auth.rs	Updated as part of this pull request.
devolutions-gateway/src/lib.rs	Updated as part of this pull request.
devolutions-gateway/src/http.rs	Updated as part of this pull request.
devolutions-gateway/src/error_code.rs	Updated as part of this pull request.
devolutions-gateway/src/api/webapp.rs	Updated as part of this pull request.
devolutions-gateway/src/api/update.rs	Updated as part of this pull request.
devolutions-gateway/src/api/tunnel.rs	Updated as part of this pull request.
devolutions-gateway/src/api/traffic.rs	Updated as part of this pull request.
devolutions-gateway/src/api/sessions.rs	Updated as part of this pull request.
devolutions-gateway/src/api/session.rs	Updated as part of this pull request.
devolutions-gateway/src/api/preflight.rs	Updated as part of this pull request.
devolutions-gateway/src/api/net.rs	Updated as part of this pull request.
devolutions-gateway/src/api/monitoring.rs	Updated as part of this pull request.
devolutions-gateway/src/api/jrl.rs	Updated as part of this pull request.
devolutions-gateway/src/api/jrec.rs	Updated as part of this pull request.
devolutions-gateway/src/api/heartbeat.rs	Updated as part of this pull request.
devolutions-gateway/src/api/diagnostics.rs	Updated as part of this pull request.
devolutions-gateway/src/api/config.rs	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/README.md	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/model/models.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/model/errorCode.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/model/apiError.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/update.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/traffic.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/sessions.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/preflight.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/networkMonitoring.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/net.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/jrl.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/jrec.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/heartbeat.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/diagnostics.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/config.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/api/agent.service.ts	Updated as part of this pull request.
devolutions-gateway/openapi/ts-angular-client/.openapi-generator/FILES	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/UpdateRequestSchema.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/UpdateProductInfo.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/TransportProtocolResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/TrafficEventResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/TargetConnectionOptions.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/Subscriber.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/SubProvisionerKey.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/SetUpdateScheduleRequest.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/SetConfigResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/SessionTokenSignRequest.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/SessionTokenContentType.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/SessionInfo.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ScanResultSourceDto.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ScanOriginDto.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/PubKeyFormat.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/PreflightOutputKind.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/PreflightOutput.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/PreflightOperationKind.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/PreflightOperation.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/PreflightAlertStatus.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/NetworkScanSourceDto.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/NetworkScanSourceCapabilitiesDto.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/NetworkScanResultKindDto.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/NetworkScanResultEventDto.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/NetworkInterfacesResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/NetworkInterfaceDto.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/MonitorsConfig.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/MonitorResult.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/MonitoringProbeTypeOneOf.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/MonitoringProbeType.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/MonitoringLogResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/MonitorDefinitionProbeTypeError.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/MonitorDefinition.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ListenerUrls.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/JrlInfo.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/InterfaceInfo.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/Identity.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/HostScanStateDto.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/Heartbeat.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/GetUpdateScheduleResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/GetUpdateProductsResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/EventOutcomeResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/EnrollResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/EnrollRequest.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/DeleteManyResult.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/DataEncoding.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ConnectionMode.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ConfigPatch.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ConfigDiagnostic.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ClockDiagnostic.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ClaimedTrafficEvent.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AppTokenSignRequest.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AppTokenContentType.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AppCredentialKind.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AppCredential.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/ApiError.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AgentStatus.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AgentInfo.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AgentDomainAdvertisement.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AddressFamily.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AckResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AckRequest.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AccessScope.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Model/AbstractOpenAPISchema.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/WebRequestPathBuilder.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/RetryConfiguration.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/RequestOptions.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/OpenAPIDateConverter.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/Multimap.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/ISynchronousClient.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/IReadableConfiguration.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/IAsynchronousClient.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/IApiAccessor.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/GlobalConfiguration.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/FileParameter.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/ExceptionFactory.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/Configuration.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/ClientUtils.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/ApiResponse.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/ApiException.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Client/ApiClient.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/WebAppApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/UpdateApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/TrafficApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/SessionsApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/PreflightApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/NetworkMonitoringApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/NetApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/JrlApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/JrecApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/HeartbeatApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/HealthApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/DiagnosticsApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/ConfigApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/src/Devolutions.Gateway.Client/Api/AgentApi.cs	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/README.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/UpdateApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/TrafficApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/SessionsApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/PreflightApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/NetworkMonitoringApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/NetApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/JrlApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/JrecApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/HeartbeatApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/ErrorCode.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/DiagnosticsApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/ConfigApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/ApiError.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/docs/AgentApi.md	Updated as part of this pull request.
devolutions-gateway/openapi/dotnet-client/.openapi-generator/FILES	Updated as part of this pull request.

🧠 Review effort: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…ateway into DGW-467-api-error-codes

…n-crate Tag the 403 of the new recording search scope with `insufficient_scope`, and declare the problem details body on the error responses of `/jet/jrec/search`. Move the `TokenError` mapping and code list tests next to the code, as `testsuite/CLAUDE.md` asks for tests of Gateway internals. Issue: DGW-467 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The changes require final human review because they are too complex or risky for automated approval.

No open issues 🎉

_{Review effort: Balanced}

Cite the documented error format and codes as the source of each new test's expected values, as the oracle marker check requires. - Document that a SCOPE token is valid for a single request, which the `unexpected_replay` test relies on. - Check `invalid_token` with an outdated revocation list, a documented rule, instead of the undocumented BRIDGE token lifetime limit. - Drop the uniqueness and format test of the code list: no source decides it, and the code list snapshot already pins every code. Issue: DGW-467 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The changes require final human review because they are too complex or risky for automated approval.

No open issues 🎉

_{Review effort: Balanced}

Benoît Cortier (CBenoit) and others added 3 commits October 15, 2026 17:00

chore(openapi): regenerate the spec and clients for API error responses

a74b0fe

Issue: DGW-467 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test(dgw): expect the problem details body on rejected web app logins

e4d9802

Issue: DGW-467 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot AI balanced review requested due to automatic review settings October 15, 2026 08:13

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) October 15, 2026 08:13

View session

Copilot AI reviewed Oct 15, 2026

View reviewed changes

Benoît Cortier (CBenoit) and others added 2 commits October 23, 2026 03:02

Merge branch 'master' of https://github.com/Devolutions/devolutions-g…

62a8cc0

…ateway into DGW-467-api-error-codes

Benoît Cortier (CBenoit) requested a balanced review from Copilot October 22, 2026 19:04

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) October 22, 2026 19:05

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Benoît Cortier (CBenoit) requested a balanced review from Copilot October 22, 2026 19:39

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) October 22, 2026 19:39

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Navigation Menu

Repository navigation

feat(dgw): explain rejected requests in API error responses - #2081

feat(dgw): explain rejected requests in API error responses#2081
Benoît Cortier (CBenoit) wants to merge 6 commits into
masterfrom
DGW-467-api-error-codes

Benoît Cortier (CBenoit) commented Oct 15, 2026

Uh oh!

Benoît Cortier (CBenoit) commented Oct 15, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

Benoît Cortier (CBenoit) commented Oct 15, 2026

Uh oh!

Benoît Cortier (CBenoit) commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Benoît Cortier (CBenoit) commented Oct 15, 2026 •

edited

Loading