# API errors

The errors on this page are returned as a problem details object with the `application/problem+json` content type, and the object's `type` links to the error's heading here. Other failures of the QR test endpoint return a plain JSON message instead.

## Error response

```json
{
  "type": "https://docs.stoe.no/id-card/API/errors#session-expired",
  "title": "Session expired",
  "status": 410,
  "detail": "Session has expired or is invalid"
}
```

## Errors

### Missing bearer token

**Status:** `401`

**Message:** `Missing bearer token.`

**Cause:** The request has no `Authorization` header with a bearer token.

**Fix:** Send the access token you get from BankID OIDC as `Authorization: Bearer <<ACCESS_TOKEN>>`. See [Authentication](https://docs.stoe.no/id-card/getting-started/authentication.md).

### Authorization error

**Status:** `401`

**Message:** `Authorization error.` or `Bearer token is missing.`

**Cause:** The bearer token couldn't be verified with BankID OIDC's signing key, or it's missing the `sub`, `scope` or client ID claim.

**Fix:** Get a new access token from BankID OIDC, as described in [Authentication](https://docs.stoe.no/id-card/getting-started/authentication.md), and send it unchanged.

### Bad request

**Status:** `400`

**Message:** One or more of these, separated by commas:

- `SessionId parameter in request body is missing.`
- `SessionId is in an invalid format.`
- `Unable to parse request body.`

**Cause:** The request body isn't JSON, has no `sessionId`, or the `sessionId` isn't 36 or 43 characters long.

**Fix:** Send a JSON body with the `sessionId` read from the user's QR code, unchanged.

### Session expired

**Status:** `410`

**Message:** `Session has expired or is invalid`

**Cause:** There's no session with this `sessionId`. A `sessionId` can be used once, and expires about a minute after it's created.

**Fix:** Ask the user to show a new QR code, and use its `sessionId`.

### Session invalid

**Status:** `410`

**Message:** `Session is invalid`

**Cause:** The session exists, but the user it belongs to can't be found, for example because the user has been deleted.

**Fix:** Ask the user to show a new QR code, and use its `sessionId`.

### Unknown error

**Status:** `500`

**Message:** `Something went wrong`

**Cause:** Something unexpected went wrong in the ID-Card API.