#### [Abblix\.Oidc\.Server](https://www.abblix.com/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.DPoP](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP 'Abblix\.Oidc\.Server\.Features\.DPoP')

## ProofErrorReasons Class

Stable, machine\-friendly reason tokens that [Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.dpop.proofvalidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator') assigns to
[Reason](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Reason') for log filters and metric labels\. These are the
internal fine\-grained failure categories; the OAuth\-protocol\-level error code surfaced
to clients is always `invalid_dpop_proof` \(or `use_dpop_nonce` for the
nonce\-required path\) regardless of which of these matched\.

```csharp
public static class ProofErrorReasons
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ProofErrorReasons
### Fields

## ProofErrorReasons\.AccessTokenHashMismatch Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.AccessTokenHashMismatch}

Payload `ath` does not match `Base64Url(SHA-256(access_token))`\.

```csharp
public const string AccessTokenHashMismatch = "ath_mismatch";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.AccessTokenHashMissing Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.AccessTokenHashMissing}

Payload `ath` claim is required \(an access token is presented\) but missing\.

```csharp
public const string AccessTokenHashMissing = "ath_missing";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.HttpMethodMismatch Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.HttpMethodMismatch}

Payload `htm` does not match the request method\.

```csharp
public const string HttpMethodMismatch = "htm_mismatch";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.HttpUriInvalid Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.HttpUriInvalid}

Payload `htu` is not a valid absolute URI\.

```csharp
public const string HttpUriInvalid = "htu_invalid";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.HttpUriMismatch Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.HttpUriMismatch}

Payload `htu` does not match the request URI after RFC 3986 §6\.2 canonicalisation\.

```csharp
public const string HttpUriMismatch = "htu_mismatch";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.HttpUriMissing Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.HttpUriMissing}

Payload `htu` claim is missing\.

```csharp
public const string HttpUriMissing = "htu_missing";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.InvalidAlgorithm Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidAlgorithm}

Header `alg` is missing, not asymmetric, or not in the configured whitelist\.

```csharp
public const string InvalidAlgorithm = "invalid_alg";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.InvalidHeader Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidHeader}

A JOSE header parameter is malformed or violates a structural rule\.

```csharp
public const string InvalidHeader = "invalid_header";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Deliberately named for the header rather than for one member of it: this is what the JWT core's
`InvalidHeader` becomes, and that category covers an unusable `jwk`, a `crit` that
is malformed or names an extension nothing handles, and a header a trust model requires and the
token omits\. Reporting all three as `invalid_jwk` told a client its key was bad over a
`crit` it had written itself\.

WHICH of the three happened is on [Detail](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') and goes no further - no
response, no log, no metric label. That is a decision rather than an omission: two of the core's
`crit` descriptions are written by quoting the token, so the value carries what the client
put there, and the rest are constants that cannot be told apart from them at this seam.

The cost is stated rather than hidden: for all three causes a client is told `invalid_header`
and an operator's log line says the same, so nothing the library emits separates an unusable
`jwk` from a bad `crit`. A host that wants the difference reads
[Detail](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') off its own call - and sanitises it, because it may be the
client's own bytes.

## ProofErrorReasons\.InvalidJwk Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidJwk}

Header `jwk` is missing, malformed, or contains private\-key material\.

```csharp
public const string InvalidJwk = "invalid_jwk";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Only where THIS validator establishes it\. A refusal that came from the JWT core arrives under
[InvalidHeader](https://www.abblix.com/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidHeader 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofErrorReasons\.InvalidHeader') instead, because the core reports a bad `jwk`, a bad `crit`
and a missing required header under one category and cannot tell a consumer which it met\.

## ProofErrorReasons\.InvalidTokenType Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidTokenType}

Header `typ` is not `dpop+jwt`\.

```csharp
public const string InvalidTokenType = "invalid_typ";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.IssuedAtInvalid Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.IssuedAtInvalid}

Payload `iat` is not a Unix\-time numeric\.

```csharp
public const string IssuedAtInvalid = "iat_invalid";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.IssuedAtMissing Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.IssuedAtMissing}

Payload `iat` claim is missing\.

```csharp
public const string IssuedAtMissing = "iat_missing";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.IssuedAtOutOfWindow Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.IssuedAtOutOfWindow}

Payload `iat` falls outside the configured tolerance window around the current time\.

```csharp
public const string IssuedAtOutOfWindow = "iat_out_of_window";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.JwtIdMissing Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.JwtIdMissing}

Payload `jti` claim is missing\.

```csharp
public const string JwtIdMissing = "jti_missing";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.MalformedJwt Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.MalformedJwt}

JWS compact form is not three dot\-separated segments, base64url\-decode failed,
            or the header/payload is not a JSON object\.

```csharp
public const string MalformedJwt = "malformed_jwt";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.ReplayDetected Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.ReplayDetected}

Payload `jti` has already been used within the acceptance window\.

```csharp
public const string ReplayDetected = "replay_detected";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## ProofErrorReasons\.SignatureInvalid Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.SignatureInvalid}

JWS signature does not verify under the embedded `jwk`\.

```csharp
public const string SignatureInvalid = "signature_invalid";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')