{"record":{"id":"311b14ee566bbc03","repo":"openai/codex","slug":"the-workload-identity-assertion-is-invalid","errorCode":null,"errorMessage":"the workload identity assertion is invalid","messagePattern":"the workload identity assertion is invalid","errorType":"exception","errorClass":"WorkloadIdentityError","httpStatus":null,"severity":"error","filePath":"codex-rs/workload-identity/src/lib.rs","lineNumber":46,"sourceCode":"        }\n        if !assertion_file.is_absolute() {\n            return Err(WorkloadIdentityError::AssertionFileMustBeAbsolute);\n        }\n        Ok(Self {\n            assertion_file,\n            federation_rule_id: federation_rule_id.to_string(),\n            workload_identity_context,\n        })\n    }\n}\n\n#[derive(Clone, Debug, Error)]\npub enum WorkloadIdentityError {\n    #[error(\"the workload identity federation rule ID must not be empty\")]\n    InvalidFederationRuleId,\n    #[error(\"the workload identity assertion file path must be absolute\")]\n    AssertionFileMustBeAbsolute,\n    #[error(\"the workload identity assertion is invalid\")]\n    InvalidAssertion,\n    #[error(\"the workload identity assertion exceeds 16 KiB\")]\n    AssertionTooLarge,\n    #[error(\"could not read workload identity assertion file {path}\")]\n    AssertionFile {\n        path: PathBuf,\n        #[source]\n        source: Arc<std::io::Error>,\n    },\n    #[error(\"could not configure the workload identity HTTP client\")]\n    HttpClientConfiguration,\n    #[error(\"the workload identity token URL must use HTTPS or loopback HTTP\")]\n    InvalidTokenUrl,\n    #[error(\"the workload identity token exchange is unavailable\")]\n    ExchangeUnavailable,\n    #[error(\"the workload identity token exchange was rejected with HTTP {0}\")]\n    ExchangeRejected(u16),\n    #[error(\"the workload identity token exchange returned an invalid response\")]","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/workload-identity/src/lib.rs#L28-L64","documentation":"Error \"the workload identity assertion is invalid\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/workload-identity/src/lib.rs:46 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate or replace the assertion file with a valid token from the identity provider."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}