{"record":{"id":"74970dd1a662ccf6","repo":"openai/codex","slug":"the-workload-identity-token-exchange-was-rejected","errorCode":null,"errorMessage":"the workload identity token exchange was rejected with HTTP {0}","messagePattern":"the workload identity token exchange was rejected with HTTP (.+?)","errorType":"exception","errorClass":"WorkloadIdentityError","httpStatus":null,"severity":"error","filePath":"codex-rs/workload-identity/src/lib.rs","lineNumber":62,"sourceCode":"    #[error(\"the workload identity assertion file path must be absolute\")]\n    AssertionFileMustBeAbsolute,\n    #[error(\"the workload identity assertion is invalid\")]\n    InvalidAssertion,\n    #[error(\"the workload identity assertion exceeds 16 KiB\")]\n    AssertionTooLarge,\n    #[error(\"could not read workload identity assertion file {path}\")]\n    AssertionFile {\n        path: PathBuf,\n        #[source]\n        source: Arc<std::io::Error>,\n    },\n    #[error(\"could not configure the workload identity HTTP client\")]\n    HttpClientConfiguration,\n    #[error(\"the workload identity token URL must use HTTPS or loopback HTTP\")]\n    InvalidTokenUrl,\n    #[error(\"the workload identity token exchange is unavailable\")]\n    ExchangeUnavailable,\n    #[error(\"the workload identity token exchange was rejected with HTTP {0}\")]\n    ExchangeRejected(u16),\n    #[error(\"the workload identity token exchange returned an invalid response\")]\n    InvalidExchangeResponse,\n}\n\nimpl WorkloadIdentityError {\n    /// Whether retrying the operation may succeed without changing configuration.\n    pub fn is_transient(&self) -> bool {\n        match self {\n            Self::AssertionFile { source, .. } => matches!(\n                source.kind(),\n                std::io::ErrorKind::Interrupted\n                    | std::io::ErrorKind::NotFound\n                    | std::io::ErrorKind::TimedOut\n                    | std::io::ErrorKind::WouldBlock\n            ),\n            Self::ExchangeUnavailable | Self::ExchangeRejected(408 | 429 | 500..=599) => true,\n            Self::InvalidFederationRuleId","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/workload-identity/src/lib.rs#L44-L80","documentation":"Error \"the workload identity token exchange was rejected with HTTP {0}\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/workload-identity/src/lib.rs:62 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the HTTP status and response body from the token endpoint; verify the federation rule and assertion are accepted by the provider."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}