> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Report Connection Auth Error > Report that the provider rejected the stored credential for the calling user's connection. Called by tool-router when an upstream provider rejects a served OAuth token mid-use. The service first forces one refresh; if it succeeds the connection stays connected. The caller's connection flips to a reconnect prompt only when the provider refuses that refresh (the authorization is then dead for every connection using it), or when no refresh token exists and the token is older than the service's cooldown, which changes only the caller's own connection. A caller-supplied ``rejected_fingerprint`` matching the stored token on a credential with no refresh token skips the cooldown and retires the shared authorization, which also affects service-account connections that borrow it. A report that cannot be acted on (a just-issued token, a lost refresh race, a transient failure) changes nothing. The response is always 204 once the connection is found and never says which outcome occurred. ## OpenAPI ````yaml /api-reference/openapi.yaml post /api/registry/v1/servers/{server_id}/connection/auth-error openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/registry/v1/servers/{server_id}/connection/auth-error: post: tags: - registry summary: Report Connection Auth Error description: >- Report that the provider rejected the stored credential for the calling user's connection. Called by tool-router when an upstream provider rejects a served OAuth token mid-use. The service first forces one refresh; if it succeeds the connection stays connected. The caller's connection flips to a reconnect prompt only when the provider refuses that refresh (the authorization is then dead for every connection using it), or when no refresh token exists and the token is older than the service's cooldown, which changes only the caller's own connection. A caller-supplied ``rejected_fingerprint`` matching the stored token on a credential with no refresh token skips the cooldown and retires the shared authorization, which also affects service-account connections that borrow it. A report that cannot be acted on (a just-issued token, a lost refresh race, a transient failure) changes nothing. The response is always 204 once the connection is found and never says which outcome occurred. operationId: report_mcp_connection_auth_error parameters: - name: server_id in: path required: true schema: type: string title: Server Id - name: rejected_fingerprint in: query required: false schema: anyOf: - type: string minLength: 64 maxLength: 64 pattern: ^[0-9a-f]{64}$ - type: 'null' title: Rejected Fingerprint responses: '204': description: Successful Response '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.