{
  "topic": "errors.OIDC_INVALID_TENANT",
  "path": [
    "errors",
    "OIDC_INVALID_TENANT"
  ],
  "title": "OIDC_INVALID_TENANT — OIDC provider registration requires UUID-shaped tenant identifier",
  "synopsis": "cyoda treats legal entity identifiers as UUIDs. OIDC provider ownership is\nrecorded as a `uuid.UUID` `OwnerLegalEntityID` field, which keys both the\nper-tenant KV blob storage and the validated user-context tenant binding at\ntoken validation time.",
  "body": "# errors.OIDC_INVALID_TENANT\n\n## NAME\n\nOIDC_INVALID_TENANT — OIDC provider registration requires a UUID-shaped tenant identifier.\n\n## SYNOPSIS\n\nHTTP: `400` `Bad Request` with code `OIDC_INVALID_TENANT` on `POST /oauth/oidc/providers`\nwhen the calling tenant's ID is not a valid UUID.\n\n## DESCRIPTION\n\ncyoda treats legal entity identifiers as UUIDs. OIDC provider ownership is\nrecorded as a `uuid.UUID` `OwnerLegalEntityID` field, which keys both the\nper-tenant KV blob storage and the validated user-context tenant binding at\ntoken validation time.\n\nNon-UUID tenant IDs (e.g. the dev-convenience `default-tenant` string accepted\nby `CYODA_BOOTSTRAP_TENANT_ID`) cannot be used to register OIDC providers for\ntwo reasons:\n\n1. **KV collision** — every non-UUID tenant would map to the same\n   `00000000-0000-0000-0000-000000000000` storage key, allowing cross-tenant\n   data leakage between all bootstrap deployments.\n2. **Synthetic identity** — OIDC-validated tokens issued against such a provider\n   would carry a fabricated \"nil tenant\" downstream, breaking tenant-scoped\n   access control.\n\nProduction deployments use UUID-shaped legal entity identifiers and are not\naffected by this restriction.\n\n## RESOLUTION\n\nProvision a real tenant with a UUID identifier before registering OIDC providers:\n\n- For bootstrap deployments: set `CYODA_BOOTSTRAP_TENANT_ID` to a valid UUID\n  (e.g. `CYODA_BOOTSTRAP_TENANT_ID=$(uuidgen)`) and restart the server.\n- For non-default tenants in production: ensure the tenant was created with a\n  UUID identifier and that your M2M credential carries that UUID as `caas_org_id`.\n\nThen retry the `POST /oauth/oidc/providers` registration.\n\n## SEE ALSO\n\n- errors\n- errors.OIDC_PROVIDER_DUPLICATE\n- config.auth\n",
  "sections": [
    {
      "name": "NAME",
      "body": "OIDC_INVALID_TENANT — OIDC provider registration requires a UUID-shaped tenant identifier."
    },
    {
      "name": "SYNOPSIS",
      "body": "HTTP: `400` `Bad Request` with code `OIDC_INVALID_TENANT` on `POST /oauth/oidc/providers`\nwhen the calling tenant's ID is not a valid UUID."
    },
    {
      "name": "DESCRIPTION",
      "body": "cyoda treats legal entity identifiers as UUIDs. OIDC provider ownership is\nrecorded as a `uuid.UUID` `OwnerLegalEntityID` field, which keys both the\nper-tenant KV blob storage and the validated user-context tenant binding at\ntoken validation time.\n\nNon-UUID tenant IDs (e.g. the dev-convenience `default-tenant` string accepted\nby `CYODA_BOOTSTRAP_TENANT_ID`) cannot be used to register OIDC providers for\ntwo reasons:\n\n1. **KV collision** — every non-UUID tenant would map to the same\n   `00000000-0000-0000-0000-000000000000` storage key, allowing cross-tenant\n   data leakage between all bootstrap deployments.\n2. **Synthetic identity** — OIDC-validated tokens issued against such a provider\n   would carry a fabricated \"nil tenant\" downstream, breaking tenant-scoped\n   access control.\n\nProduction deployments use UUID-shaped legal entity identifiers and are not\naffected by this restriction."
    },
    {
      "name": "RESOLUTION",
      "body": "Provision a real tenant with a UUID identifier before registering OIDC providers:\n\n- For bootstrap deployments: set `CYODA_BOOTSTRAP_TENANT_ID` to a valid UUID\n  (e.g. `CYODA_BOOTSTRAP_TENANT_ID=$(uuidgen)`) and restart the server.\n- For non-default tenants in production: ensure the tenant was created with a\n  UUID identifier and that your M2M credential carries that UUID as `caas_org_id`.\n\nThen retry the `POST /oauth/oidc/providers` registration."
    },
    {
      "name": "SEE ALSO",
      "body": "- errors\n- errors.OIDC_PROVIDER_DUPLICATE\n- config.auth"
    }
  ],
  "see_also": [
    "errors",
    "errors.OIDC_PROVIDER_DUPLICATE",
    "config.auth"
  ],
  "stability": "stable",
  "actions": []
}