Skip to content
Zautha

form_param_invalid

Returned as
The problem's code, and the code of the field it concerns in errors[]
HTTP status
400 Bad Request, 422 Unprocessable Entity
type
https://zautha.com/docs/errors/form_param_invalid

When it happens

Section titled “When it happens”

A request parameter is missing, not allowed with the others, or not valid for this step. The message says which and why. Examples:

  • a sign-in or sign-up that mixes strategies (a password with a social sign-in, a ticket without the ticket strategy);
  • a transfer when there is nothing to transfer;
  • an empty identifier or password, a passkey name of the wrong length, unsafe_metadata over 4 KB;
  • account changes the application’s settings forbid: removing the last second factor while two-step verification is required, removing the primary email address, adding a second authenticator app or more than 10 passkeys, ending the session you are using;
  • a user’s organization request whose fields are not valid (the field errors then carry this code too).

Most come as 422. A test address asking for an email link instead of a code, an OIDC consent decision other than allow or deny and a handshake state of the wrong form come as 400, the last two as a field error inside validation_failed.

What to do

Section titled “What to do”

Show the message next to the field errors[] names. With the components these cases are handled for you.