---
title: "Understanding denials"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:operations-reasons@main"
source: "Operations/Reasons.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# Understanding denials {#operations-reasons}

Reason codes are fixed technical values. This mapping guides
investigation; it does not permit an automatic replacement transport.

| Code | Trigger | Next check |
| --- | --- | --- |
| `invalid_target` | Invalid URI, forbidden raw syntax, userinfo or fragment. | Inspect the original string before PSR-7 construction. |
| `scheme_forbidden` | Scheme other than HTTP or HTTPS. | Correct the actual application path. |
| `authority_mismatch` | Host header does not match the canonical URI authority. | Remove host or port overrides from the calling code. |
| `address_forbidden` | Forbidden address class, operator restriction or candidate outside a bound network. | Check the complete IP list and exact profile. |
| `resolution_unverified` | DNS incomplete, invalid, empty, unreachable or unverifiable; no static entry during offline diagnostics. | Check DNS server configuration and static host data. |
| `resolution_limit` | Address or CNAME limit exceeded, or a cycle. | Fix the DNS chain; do not truncate candidates. |
| `endpoint_mismatch` | Origin or method differs from the bound profile. | Compare service binding, target port and method. |
| `grant_invalid` | Unknown, foreign or expired binding. | Check profile validity and recreate the client correctly. |
| `transport_unsupported` | Missing cURL or cURL-multi, unsupported dependency major or minimum, incompatible Core/SDK API, or a second native attempt in one lease. | Check `doctor`, supported ranges, APIs and PHP functions. |
| `proxy_unsupported` | Explicit proxy option or actual proxy process variable. | Review the deployment environment and proxy needs with the operator. |
| `option_forbidden` | Unknown or uncontrolled SDK or transport option. | Check RequestFactory defaults and request options. |
| `redirect_forbidden` | Forbidden redirect origin, downgrade or invalid redirect option. | Inspect the actual Location and profile rules. |
| `configuration_invalid` | Schema error, inconsistent registry or middleware position. | Check `config-check`, `doctor` and service wiring; correct the invalid deployment configuration. |

Internal DNS errors may be summarized as
`resolution_unverified` at the resolver boundary. A reason
code is not a complete network diagnostic report and deliberately
contains no secrets.