> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Air-Gapped Devin Error Code Reference

> Complete catalog of LIC, MDL, IDP, NET, and CFG error codes printed by the air-gapped Devin CLI and Desktop, with the meaning and administrator action for each.

> [!NOTE]
>
> This documentation is for the federal deployments of Devin. [Back to Devin Docs](/get-started/devin-intro)

Every failure the air-gapped CLI and Desktop can diagnose is reported with a stable code of the form `XXXnnn`. Codes appear at the start of the error message on the terminal, in `devin airgap doctor` output, in Desktop diagnostics, and in the `error_code` field of `auth` [audit events](/federal/air-gapped/on-disk-formats#auth). The number identifies the condition, not the wording, so you can key support runbooks and SIEM alerts on it.

| Namespace | Covers | Detailed page |
| - | - | - |
| `LIC` | License file validation | [License](/federal/air-gapped/license) |
| `MDL` | Models file validation | [Models file](/federal/air-gapped/models-file) |
| `IDP` | SSO and identity provider | [SSO](/federal/air-gapped/sso) |
| `NET` | Endpoint reachability, TLS, HTTP probing | [Network and certificates](/federal/air-gapped/network-and-certificates) |
| `CFG` | Local paths, configuration, environment | [Network and certificates](/federal/air-gapped/network-and-certificates), [Models file](/federal/air-gapped/models-file) |

## `LIC` License

Printed as `LIC00n: <message>`, followed by the path that was checked and how to override it (`DEVIN_LICENSE_FILE`).

| Code | Meaning | What to do |
| - | - | - |
| `LIC001` | License file missing or unreadable at `/etc/devin/license.devin-onprem-license` (`C:\ProgramData\Devin\license.devin-onprem-license` on Windows), or at the `DEVIN_LICENSE_FILE` path. On Windows, also returned when a standard user tries to replace an administrator-owned license from Desktop. | Install the file at the default path or set `DEVIN_LICENSE_FILE`; check read permission for the user running Devin. |
| `LIC002` | Malformed file: not a valid EdDSA JWT, or no `kid` in the header. | Re-download the license from the portal; transfer it byte-for-byte (no added newline, wrapping, or encoding change). |
| `LIC003` | Signature verification failed. | The payload was altered after signing. Re-download the license. |
| `LIC004` | Unknown `kid`: no matching public key is embedded in this build. | Run the [`kid` check](/federal/air-gapped/license#check-the-key-id). The license was issued by a different environment, or your build predates a key rotation; install the current release. |
| `LIC005` | Expired beyond the 24-hour grace period. | Renew the license through the portal. |
| `LIC006` | Not yet valid: issued more than 24 hours in the future. | Check the host clock; if it is correct, contact your support team. |
| `LIC007` | Wrong `product` claim (not `devin-onprem`). | The file is not an air-gapped Devin license. Re-download it from the portal. |

## `MDL` Models file

Reported by `devin models validate`, `devin airgap doctor`, Desktop's models settings, and at agent startup. Each diagnostic names the model entry it applies to.

| Code | Meaning | What to do |
| - | - | - |
| `MDL001` | File is not valid JSON for schema v0, including unknown fields. | Fix the JSON; remove fields not in the [schema](/federal/air-gapped/models-file#schema-reference-version-0). |
| `MDL002` | Unsupported `schema_version`. | Set `"schema_version": 0`. |
| `MDL003` | `models` is empty. | Add at least one model entry. |
| `MDL004` | A model has an empty `name`. | Give every entry a unique `name`. |
| `MDL005` | Duplicate model `name`. | Rename one of the entries. |
| `MDL006` | Empty `base_url`. | Set the endpoint URL. |
| `MDL007` | Empty `api_key.env`. | Name the environment variable that holds the key. |
| `MDL008` | `max_context_tokens` is zero. | Set the model's context window. |
| `MDL009` | More than one model marked `default`. | Leave `default: true` on exactly one entry. |
| `MDL010` | `base_url` is not an `https://` URL with a host (`http://` is accepted only for loopback addresses). | Use `https://`, or a loopback address for a same-host server. |
| `MDL011` | `max_output_tokens` exceeds `max_context_tokens`. | Lower `max_output_tokens`. |
| `MDL012` | File exists but could not be read (permissions or invalid UTF-8). | Fix read permission for the user running Devin; save the file as UTF-8. |
| `MDL013` | `max_output_tokens` is zero. | Remove the field or set a positive value. |
| `MDL014` | File is owned by another user, so Desktop refuses to replace it. | Edit the file on disk as its owner, or point `DEVIN_MODELS_FILE` at a file you own. |

## `IDP` SSO and identity provider

Reported by `devin auth login`, `devin auth status`, at agent startup, and by the Desktop sign-in flow. `IDP004` and `IDP005` are also written to the audit log on `sso_login_denied` events, and any `IDP` code can appear on `sso_revalidation_failed`.

| Code | Meaning | What to do |
| - | - | - |
| `IDP001` | The auth file is unreadable or invalid. | Fix `/etc/devin/auth.json` (`C:\ProgramData\Devin\auth.json` on Windows), or the file at the `DEVIN_AUTH_FILE` path; the message names the offending field. |
| `IDP002` | No cached login for the configured issuer. | Run `devin auth login`. |
| `IDP003` | The login is invalid or expired and could not be silently refreshed (including an IdP `invalid_grant` response). | Run `devin auth login` again. |
| `IDP004` | Logged in, but the user is not a member of `required_group`. | Add the user to the group at the IdP, or correct `required_group` / `groups_claim` in the auth file. |
| `IDP005` | The IdP could not be reached, returned an error, or returned an ID token that failed validation. | Check network reachability, TLS trust (`DEVIN_CA_BUNDLE`), the `issuer` value, and the IdP's own logs. |
| `IDP006` | The local SSO token cache is unreadable, malformed, or not private to the current user. | Run `devin auth login`; a fresh login rewrites the cache with owner-only permissions. |

## `NET` Network

Reported by `devin airgap doctor` endpoint probes and by inference and IdP requests. Each `NET` failure includes the underlying error chain.

| Code | Meaning | What to do |
| - | - | - |
| `NET001` | DNS resolution of the endpoint host failed. | Check the hostname in the models file or auth file, and DNS on the workstation. |
| `NET002` | TCP connection could not be established (refused, reset, or unroutable). | Check that the endpoint is listening on the port and that firewalls or proxy rules allow the workstation to reach it. |
| `NET003` | TLS handshake failed: untrusted, expired, or mismatched certificate. `devin airgap doctor` prints the certificate the server presented (subject, issuer, expiry) when obtainable, and whether `DEVIN_CA_BUNDLE` was in effect. | Trust the private CA with [`DEVIN_CA_BUNDLE`](/federal/air-gapped/network-and-certificates#trust-a-private-ca-with-devin_ca_bundle), or fix the server certificate (name, chain, expiry). |
| `NET004` | Endpoint returned a non-success HTTP status other than 401/403. A `404` on `GET {base_url}/models` is reported as a warning, since some OpenAI-compatible servers do not implement `/models`. | Check the endpoint's own logs and the `base_url` path (for example a missing `/v1`). |
| `NET005` | Request timed out (10 s for doctor probes, 30 s for IdP requests, 30 s connect / 300 s read for inference). | Check load on the endpoint and any intermediate proxy; see [timeouts](/federal/air-gapped/network-and-certificates#timeouts). |
| `NET006` | Endpoint rejected the configured credentials (HTTP 401/403). | Check the value in the `api_key.env` variable and that the key is valid for the endpoint. |

## `CFG` Configuration

Reported by `devin airgap doctor` and at startup.

| Code | Meaning | What to do |
| - | - | - |
| `CFG001` | A required config or state directory is missing or not writable (`~/.config/devin`, `~/.local/share/devin`, or the `cli-federal` product directory; on Windows, `%APPDATA%\devin` or its `cli-federal` subdirectory). | Create the directory or fix its ownership and permissions for the user running Devin. |
| `CFG002` | An environment variable referenced by configuration (a model's `api_key.env`) is not set in the agent's environment. | Export the variable, or set it through Desktop's `devin.acp.agentEnv` setting; see [API key environment variables](/federal/air-gapped/models-file#api-key-environment-variables). |
| `CFG003` | The models file could not be found at `/etc/devin/models.json` (`C:\ProgramData\Devin\models.json` on Windows) or the `DEVIN_MODELS_FILE` override. | Install the models file; see [Models file](/federal/air-gapped/models-file). |
| `CFG004` | The `DEVIN_CA_BUNDLE` file is missing, unreadable, or contains no valid PEM certificates. | Fix the path or the file contents; see [Network and certificates](/federal/air-gapped/network-and-certificates). |
| `CFG005` | A custom subagent definition (`agents/**/AGENT.md`, or a flat `agents/<name>.md`) could not be parsed, most often invalid YAML frontmatter; the profile is skipped. Also reported as a warning when a definition declares frontmatter keys Devin does not read (for example `allowed_tools` instead of `allowed-tools`); the profile still loads. | Fix the named file and the parse error `devin doctor` prints. |
| `CFG006` | An `OTEL_EXPORTER_OTLP_*` environment variable is set that OTLP export ignores (any field other than `ENDPOINT`, `HEADERS`, `TIMEOUT`, `PROTOCOL`; any `TRACES_` variable; or an unsupported `PROTOCOL`). A warning; the variable name is printed, never its value. | Remove or correct the variable. |

`CFG005` and `CFG006` come from the standard `devin doctor` checks and are not specific to the air-gapped build.

## Reading a failure

A typical validation failure:

```sh theme={null}
devin models validate
```

```text theme={null}
/etc/devin/models.json: 1 problem(s) found
  MDL010 [model 'qwen3-vl-32b']: model 'qwen3-vl-32b': `base_url` must be an https:// URL (plain http:// is only allowed for loopback addresses: localhost, 127.0.0.0/8, or [::1])
```

Find the code in the tables above, apply the action, then re-run `devin airgap doctor` until every check passes. If a code is not listed here, your build is newer than this page; run `devin --version` and include the full message in your support request as described in [Troubleshooting](/federal/air-gapped/troubleshooting).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.