---
title: SAML error codes
description: Learn about the error parameters and error codes that Advanced Identity Cloud can send to a configured SAML error page.
component: pingoneaic
page_id: pingoneaic:am-saml2:saml2-error-codes
canonical_url: https://docs.pingidentity.com/pingoneaic/am-saml2/saml2-error-codes.html
llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-09-30T12:18:01Z
keywords: ["SAML 2.0", "error codes", "error page"]
section_ids:
  saml2-error-page-parameters: Error page parameters
  saml2-error-code-values: SAML 2.0 error codes
---

# SAML error codes

When an error occurs during a SAML 2.0 flow, Advanced Identity Cloud can redirect the user to the configured SAML error page.

You can override the default SAML 2.0 error page URL and the HTTP binding used to redirect users to the error page with an [ESV variable](../tenants/esvs.html#variables):

* To override the error page URL, configure an ESV variable named `esv-global-saml-error-page-url` and set its value to the desired URL. If you don't set this variable, Advanced Identity Cloud uses the default value of `/saml2/jsp/saml2error.jsp`.

* To override the HTTP binding, configure an ESV variable named `esv-global-saml-error-page-http-binding` and set its value to `HTTP-POST` or `HTTP-Redirect`. If you don't set this variable, Advanced Identity Cloud uses the default value of `HTTP-POST`.

## Error page parameters

The error page can receive the following parameters:

* `errorcode`

  The error code, which is the key used to look up the error message.

* `errormessage`

  A more detailed, localized error message.

* `httpstatuscode`

  The HTTP status code associated with the error.

With the `HTTP-POST` binding, Advanced Identity Cloud sends the parameters as form parameters. With the `HTTP-Redirect` binding, Advanced Identity Cloud sends the parameters as query parameters. The available parameters can depend on where the error occurs. Don't assume that every error path sends the same parameters. Some error paths can also provide values such as the originating realm or `RelayState`. However, these values aren't part of a stable, documented contract for every error path.

The error page URL is a global setting that applies to all realms. You can't configure it separately for each realm. Don't rely on the originating realm, realm alias, `RelayState`, hosted entity ID, SP entity ID, transaction ID, or correlation ID to select realm-specific error content or branding.

Integrated SAML 2.0 flows that use authentication trees don't use the same error-reporting mechanism.

## SAML 2.0 error codes

The following error-code values are listed by the default SAML 2.0 error page. The `errorcode` value identifies the error, and `errormessage` provides more detail.

|   |                                                                                                                                    |
| - | ---------------------------------------------------------------------------------------------------------------------------------- |
|   | The stability of this interface is classified as evolving. Don't assume that this list is exhaustive or unchanged across versions. |

* `assertionNotSigned`

* `cannotFindArtifactResolutionUrl`

* `errorCreateArtifact`

* `errorCreateArtifactResolve`

* `errorDecodeResponse`

* `errorInSOAPCommunication`

* `errorMetaManager`

* `errorObtainArtifact`

* `errorObtainResponse`

* `failedToAuthenticateRequesterURI`

* `failedToCreateArtifactResponse`

* `failedToCreateAssertionIDRequest`

* `failedToCreateAttributeQuery`

* `failedToCreateAuthnQuery`

* `failedToCreateResponse`

* `failedToCreateSOAPMessage`

* `failedToGetAssertionIDRequestMapper`

* `failedToGetIDPSSODescriptor`

* `failedToInitECPRequest`

* `failedToProcessQueryRequest`

* `failedToProcessSSOResponse`

* `failedToSendECPResponse`

* `idpNotFound`

* `invalidAssertion`

* `invalidAssertionID`

* `invalidHttpRequestFromECP`

* `invalidIDP`

* `invalidInResponseTo`

* `invalidIssuer`

* `invalidMetaAlias`

* `invalidRequestUri`

* `invalidSignature`

* `invalidSOAPMessage`

* `invalidStatusCode`

* `largeContentLength`

* `LogoutRequestCreationError`

* `LogoutRequestProcessingError`

* `LogoutResponseProcessingError`

* `metaDataError`

* `missingArtifact`

* `missingArtifactResponse`

* `MissingSAMLRequest`

* `missingSAMLResponse`

* `nameIDMappingFailed`

* `noRedirectionURL`

* `notSupportedHTTPMethod`

* `nullAssertionID`

* `nullDecodedStrFromSamlResponse`

* `nullIDPEntityID`

* `nullIDPMetaAlias`

* `nullInput`

* `nullNameID`

* `nullPathInfo`

* `nullRequestType`

* `nullRequestUri`

* `nullSessionIndex`

* `nullSessionProvider`

* `nullSPEntityID`

* `nullSSOToken`

* `readerServiceFailed`

* `requestProcessingError`

* `requestProcessingMNIError`

* `singleLogoutFailed`

* `soapError`

* `SSOFailed`

* `UnableToCreateArtifactResponse`

* `UnableToRedirectToAuth`

* `unsupportedEncoding`