# `RequestSeal.Discovery.Error`
[🔗](https://github.com/baselabs/request_seal/blob/v0.5.2/lib/request_seal/discovery/error.ex#L1)

Bounded discovery failures, containing only `reason` and `retryable`.

Connect failure, deadline expiry, DNS resolution trouble, source unavailability, cache overload and
`:unexpected_status` from 5xx responses are retryable; 4xx responses and a
configured host that does not exist are not.
Retryability never authorizes replay of an application operation.
No host, URL, key ID, exception, bytes, or peer text is retained.

Configuration failures:

  * `:invalid_source` - the source or its attributes are not a valid
    `RequestSeal.Discovery.Source`.
  * `:invalid_options` - unknown, duplicate or out-of-range options, an invalid
    clock, or an invalid `negative_ttl`.
  * `:domain_not_found` - DNS answered authoritatively that the configured
    host does not exist (NXDOMAIN on every queried family): a configuration
    error, not resolver trouble.

Transport failures:

  * `:transport_unavailable` - the caller has not started the `:ssl` application.
  * `:resolution_failed` - DNS returned no usable address, or more than 64;
    possibly transient resolver trouble, so retryable.
  * `:address_denied` - a resolved or connected address is private or
    special-purpose and not in `permitted_addresses`.
  * `:connect_failed` - no address accepted a connection, or the request could
    not be sent.
  * `:tls_failed` - TLS negotiation or certificate validation failed, or the
    trust roots could not be loaded.
  * `:deadline_exceeded` - the operation deadline expired.
  * `:redirect_denied` - a redirect the source does not allow: redirects are
    disabled, the `Location` is missing, invalid or longer than 2,048 bytes, the
    target leaves the origin under `:same_origin`, or a CIMD `jwks_uri` names
    another origin.
  * `:redirect_limit` - more redirects than `max_redirects`.

Response failures:

  * `:unexpected_status` - a final status other than 200.
  * `:unexpected_media_type` - a missing or disallowed `Content-Type`.
  * `:limit` - a size or count bound was exceeded, such as body bytes, decoded
    bytes, header size, key count, JSON depth or members, or removals per source.
  * `:invalid_response` - malformed HTTP framing, content coding, cache fields or
    JSON, or an unexpected internal failure.
  * `:invalid_key_set` - the key set or a key entry is malformed or carries
    private material, an ID or `kid` breaks the source's key ID mode, eligible
    entries repeat an ID, or a CIMD document names no key source.
  * `:client_id_mismatch` - a CIMD document's `client_id` differs from the
    source location.
  * `:ambiguous_key_source` - a CIMD document has both `jwks` and `jwks_uri`.
  * `:directory_unsigned` - a directory without a signature while
    `require_signed_directory` is true.
  * `:directory_signature_invalid` - a selected directory signature is missing,
    malformed, expired or does not verify.

Resolution/cache failures:

  * `:unknown_key` - the key ID is malformed for the source's mode, or no fresh,
    compatible key has that ID.
  * `:revoked_key` - the thumbprint is revoked by the source or removed from the cache.
  * `:source_unavailable` - the source is within negative freshness, its fetch
    was canceled or failed unexpectedly, or the cache is not running.
  * `:cache_overloaded` - the cache's source, in-flight or waiter bound is reached.

# `reason`

```elixir
@type reason() ::
  :cache_overloaded
  | :source_unavailable
  | :revoked_key
  | :unknown_key
  | :directory_signature_invalid
  | :directory_unsigned
  | :ambiguous_key_source
  | :client_id_mismatch
  | :invalid_key_set
  | :invalid_response
  | :limit
  | :unexpected_media_type
  | :unexpected_status
  | :redirect_limit
  | :redirect_denied
  | :deadline_exceeded
  | :tls_failed
  | :connect_failed
  | :address_denied
  | :resolution_failed
  | :transport_unavailable
  | :domain_not_found
  | :invalid_options
  | :invalid_source
```

# `t`

```elixir
@type t() :: %RequestSeal.Discovery.Error{reason: reason(), retryable: boolean()}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*