> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/error-codes.md). # Error codes Every error code Devolutions CLI can report, grouped by area, with its exit code, what it means, and what to do. When a command fails, Devolutions CLI reports an error code, a short identifier such as `invalidSecretReference`, with a message: * In text output, the error is written as `

: `.
* In JSON or YAML output, each error is in the `errors` list, with its code in `errors[].code` and its message in `errors[].message`.

The exit code tells a script whether the command failed and why. See [Exit codes and errors](/cli/reference/exit-codes-and-errors.md) for the meaning of each exit code and where errors are written.

The codes below are grouped by area, and listed alphabetically within each area. The same code can exit with a different exit code depending on the command: the table says so when it applies. Always read the message too: it usually names the option, value, or item at fault.

## Command line and confirmation

Errors in how the command was typed, or a change that needs confirmation. Nothing was changed.

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
confirmationRequired 2 The command changes or deletes something and wasn't confirmed. Produced by most commands that change something, for example devo vault create, devo context delete on a sign-in context, devo config export, devo config unlock, devo daemon profile start, and the devo admin commands that change settings. MCP tools that change something return it too when the confirmation argument isn't set. Add --yes once you're sure. With an MCP tool, set its confirmation argument.
missingParameter 2 A value the command needs is missing, for example a name, a user name with credential sign-in, a vault for a new entry, or a file to attach. Many commands produce it. Read the message: it names what's missing. Add it and run the command again. Check the options with devo <command> --help.
invalidParameterValue 2 A value given to an option or argument isn't allowed, for example a date filter, a true/false option, a host port that isn't a number, or a field that the command can't change. Many commands produce it. Exception: with devo secret read and devo secret get, an --out-file that points to a folder exits with 1. Read the message: it names the option and the allowed values. Check them with devo <command> --help. See Commands.
usageError 2 The command line is invalid: unknown command or option, missing argument, or a value the option doesn't accept. Nothing was done. In text output, Devolutions CLI writes the problem and the help of the command instead of this code; the code appears in JSON and YAML output. Check the spelling with devo <command> --help. See Commands.
conflictingOptions 2 Two options that can't be used together were given, or more than one option was given where only one is allowed. Examples: --json and --yaml, --quiet and --verbose, --password-env and --password-file, --position and --label, --user, --group, and --application, --cloud and --server, a context name and a URL, or several sign-in modes with devo login. Also returned when a context with the same name already exists. MCP tools return it for conflicting arguments. Read the message: it names the options. Keep one of them. To overwrite an existing context, use the option the message suggests. See Global options.
mutationConfirmationRequired 2 A change to Devolutions Cloud, Devolutions Server, or a local profile wasn't confirmed, for example creating or deleting a group, deleting a user, changing vault access, updating a user, or deleting a vault. Nothing was changed. Add --yes once you're sure. An AI agent connected through devo mcp must set the confirmation explicitly.
invalidSource 2 or 1 The workspace type to use isn't valid. With an invalid --source value, the command stops before it starts and exits with 2. With an invalid DEVO_RDM_SOURCE environment variable, the commands that select a workspace exit with 1. devo secretspec also reports it, with exit code 2. Use sqlite, cloud, cloud:<context>, server, or server:<context>. Check DEVO_RDM_SOURCE if you didn't pass --source. See Global options and Environment variables.
usageSuggestion 2 Not an error on its own: it comes with usageError in JSON and YAML output, and its message is a correction Devolutions CLI suggests, such as the command or option you probably meant. Run the suggested command if it's what you meant.

## Sign-in and contexts

Errors when you sign in to Devolutions Cloud or Devolutions Server, select a context, or when a session expires. When the background process can't connect to the selected workspace, for example because the context is missing or its sign-in expired, the vault, entry, user, and group commands report the same code with a generic message asking to initialize the runtime. Their exit code is then `4` for a code that ends in `NotFound` and `3` for the others. See [Sign-in fails or the session expired](/cli/help/troubleshooting/sign-in-fails.md).

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
cloudAuthenticationFailed 1 or 3 Devolutions Cloud refused the sign-in of the context: the application key or application secret is invalid, the application was denied, or your account's key couldn't open the protected data of the organization. Exit code 1 with devo login, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Check the application key and secret, then sign in again with devo login <name> --cloud <url>. See Sign-in fails or the session expired.
cloudAuthenticationRequired 1 or 3 The Devolutions Cloud context has no usable sign-in: you didn't sign in, or the context has no application key. Exit code 1 with devo admin and devo secret commands, 3 with vault, entry, user, and group commands. Sign in again with devo login <name> --cloud <url>. See Sign in to Devolutions Cloud.
cloudContextNotFound 1 or 4 No Devolutions Cloud context has that name, or no Devolutions Cloud context is the current one. Exit code 1 with devo admin and devo secret commands, 4 with vault, entry, user, and group commands. Check the name with devo context list, or sign in with devo login <name> --cloud <url>. See Sign-in fails or the session expired.
cloudHealthFailed 1 or 3 Devolutions CLI couldn't get the health information of the Devolutions Cloud instance. It checks it with devo info and at each sign-in. The message may give the HTTP status returned. Exit code 1 with devo info, devo login, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Check the Devolutions Cloud URL of the context and your network connection. See Use Devolutions CLI behind a firewall or proxy.
cloudLoginFailed 1 or 3 Devolutions Cloud refused the sign-in request. The message may give the HTTP status returned. Exit code 1 with devo login, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Check your credentials and sign in again with devo login. See Sign-in fails or the session expired.
cloudOAuthAccountKeyMissing 1 or 3 The Devolutions Cloud session has no account key, so it can't open vault data. A sign-in with --use-device-code never gets one. Exit code 1 with devo secret commands, 3 with vault and entry commands. Sign in again with devo login <name> --cloud <url> --oauth, without --use-device-code. See Sign in to Devolutions Cloud.
cloudOAuthAuthorizationExpired 1 devo login --oauth: the sign-in wasn't completed in the browser or with the device code before it expired. Run devo login again and complete the sign-in sooner.
cloudOAuthAuthorizationFailed 1 devo login --oauth: Devolutions Account didn't authorize the session, for example because the sign-in was declined, or it couldn't start the device-code sign-in. Run devo login again and accept the request. See Sign-in fails or the session expired.
cloudOAuthDiscoveryFailed 1 or 3 Devolutions CLI couldn't find the sign-in endpoints of Devolutions Account, while signing in with --oauth or while renewing the session. Exit code 1 with devo login, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Check your network connection and try again. See Use Devolutions CLI behind a firewall or proxy.
cloudOAuthInvalidResponse 1 or 3 Devolutions Account returned an answer that Devolutions CLI couldn't read, while signing in with --oauth or while renewing the session. Exit code 1 with devo login, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Try again. If it persists, check whether a proxy changes the traffic, and contact support. See Collect diagnostics for support.
cloudOAuthLoopbackUnavailable 1 devo login --oauth: Devolutions CLI couldn't start the local listener that receives the browser redirect, for example because no local port in its range is free. Close what uses those local ports and try again. --use-device-code avoids the redirect, but its session has no account key and can't open vault data.
cloudOAuthLoopbackUnsupported 1 devo login --oauth: Devolutions Account doesn't offer the browser sign-in. Add --use-device-code, as the message says. Its session has no account key and can't open vault data: to read secrets, sign in with an application key instead.
cloudOAuthRefreshBusy 1 or 3 Another devo process was still renewing the Devolutions Cloud session after 60 seconds. Exit code 1 with devo admin and devo secret commands, 3 with vault, entry, user, and group commands. Wait for the other process to finish, then run the command again.
cloudOAuthRefreshFailed 1 or 3 The Devolutions Cloud session expired and couldn't be renewed. Exit code 1 with devo admin and devo secret commands, 3 with vault, entry, user, and group commands. Sign in again with devo login <name> --cloud <url> --oauth. See Sign-in fails or the session expired.
cloudOAuthSecureStoreRequired 1 or 3 Signing in to Devolutions Cloud with --oauth needs a secure store of the operating system, and none is available. Exit code 1 with devo login, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Make the secure store of the operating system available, or sign in with an application key instead. See Sign in to Devolutions Cloud.
cloudOAuthSessionExpired 1 or 3 The Devolutions Cloud session expired and can't be renewed. Exit code 1 with devo admin and devo secret commands, 3 with vault, entry, user, and group commands. Sign in again with devo login <name> --cloud <url> --oauth. See Sign-in fails or the session expired.
cloudOAuthSessionInvalid 1 or 3 The Devolutions Cloud session stored in the secure store of the operating system is invalid. Exit code 1 with devo admin and devo secret commands, 3 with vault, entry, user, and group commands. Sign in again with devo login <name> --cloud <url> --oauth.
cloudOAuthSessionMissing 1 or 3 The Devolutions Cloud session of the context isn't in the secure store of the operating system anymore. Exit code 1 with devo admin and devo secret commands, 3 with vault, entry, user, and group commands. Sign in again with devo login <name> --cloud <url> --oauth.
cloudOAuthStorageFailed 1 or 3 Devolutions CLI couldn't read, store, or remove the Devolutions Cloud session in the secure store of the operating system. Exit code 1 with devo login, devo logout, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Check that the secure store of the operating system is unlocked and reachable, then try again. See Collect diagnostics for support.
cloudOAuthUserInfoFailed 1 devo login --oauth: Devolutions CLI couldn't fetch your Devolutions Account profile after the sign-in. Run devo login again.
cloudPreLoginFailed 1 or 3 The first step of the sign-in to Devolutions Cloud failed. The message may give the HTTP status returned. Exit code 1 with devo login, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Check the Devolutions Cloud URL and your network connection, then try again. See Sign-in fails or the session expired.
cloudRequestTimeout 1 or 3 Devolutions Cloud or Devolutions Account didn't answer in time. Exit code 1 with devo login, devo info, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Check your network connection and try again. The timeout of a context is set with devo login --timeout, from 3 to 600 seconds. See Use Devolutions CLI behind a firewall or proxy.
cloudUnavailable 1 or 3 Devolutions CLI couldn't reach Devolutions Cloud or the Devolutions Account service. Exit code 1 with devo login, devo info, devo admin, and devo secret commands, 3 with vault, entry, user, and group commands. Check the URL of the context, your network connection, and your proxy settings. See Use Devolutions CLI behind a firewall or proxy.
contextAmbiguous 1 The context name exists for more than one workspace type, for example as a Devolutions Cloud context and as a local profile context, so Devolutions CLI can't tell which one you mean. Produced by devo context use, inspect, delete, and devo logout. Delete one of them with devo context delete <name> --kind <kind>, as the message shows, or pass --kind. See Switch between workspaces.
contextKindMismatch 1 The selected context is the wrong type for this command: for example a local profile context given to a command that works only with Devolutions Cloud or Devolutions Server, or devo logout on a local profile context, which has no sign-in. Select a context of the type the message names with --context. Check the types with devo context list. See Switch between workspaces.
contextNotFound 1 No context has that name, no context name was given, or no current context is set. Produced by devo context use, inspect, delete, and devo logout. A name given with the global --context option that doesn't exist is reported as unexpectedError with the message "Context '<name>' was not found." Check the names with devo context list. Sign in again with devo login if the context was deleted. See Switch between workspaces.
contextSelectionConflict 1 or 2 The context given as an argument and the one given with --context are different. Exits with 2 with devo secret set on Devolutions Server, and 1 with the commands that work only with Devolutions Cloud or Devolutions Server. Give the context only once, or make both values name the same context.
secretReferenceUnavailable Depends on the command A sign-in secret saved in the context points at an environment variable that isn't set for the background process, or at a file it can't read. Usually 3; 1 with devo secret commands. Set the variable before the background process starts, then run devo daemon restart, or fix the file. See Sign-in fails or the session expired.
serverAuthenticationFailed 1 or 3 Devolutions Server rejected the sign-in, or refused a request with an authorization error. With devo login, the username and password, the API key, or the OAuth session weren't accepted. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Check the credentials or the API key, then sign in again with devo login <name> --server <url>. Check that the account still exists and is enabled. See Sign-in fails or the session expired.
serverAuthenticationRequired 1 or 3 The selected Devolutions Server context has no stored sign-in, for example after devo logout. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Sign in with devo login <name> --server <url>. See Sign in to Devolutions Server.
serverContextNotFound 1 or 4 No Devolutions Server context has that name, or no current Devolutions Server context is set. The exit code is 4 with the vault, entry, and user commands that run in the background process, and 1 with devo logout, devo info --private, devo secret set, and the devo admin commands of Devolutions Server. Check the name with devo context list, or create the context with devo login <name> --server <url>. See Sign-in fails or the session expired.
serverInvalidResponse 1 or 3 Devolutions Server returned an answer that Devolutions CLI couldn't read, such as invalid JSON. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Check that the URL points at Devolutions Server and not at a proxy or a sign-in page, then try again. If it persists, run devo doctor and contact support. See Collect diagnostics for support.
serverLogoutFailed 1 devo login with a username and password: Devolutions Server accepted the credentials, but the session Devolutions CLI opened to check them couldn't be closed. The context isn't saved. Run devo login again. If it persists, check the state of Devolutions Server.
serverOAuthAuthorizationExpired 1 devo login --oauth: the browser or device code sign-in wasn't completed in time. Run devo login again and finish the sign-in sooner. See Sign-in fails or the session expired.
serverOAuthAuthorizationFailed 1 devo login --oauth: Devolutions Server didn't authorize the session, couldn't start the device code sign-in, or refused to issue the session. Run devo login again and approve the sign-in. Check that the account may sign in with OAuth on this Devolutions Server. See Sign in to Devolutions Server.
serverOAuthDiscoveryFailed 1 or 3 Devolutions CLI couldn't find the OAuth sign-in addresses of Devolutions Server, at sign-in or when it renews the session. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Check the Devolutions Server URL and that OAuth sign-in is available on it. Otherwise, sign in with another method. See Sign in to Devolutions Server.
serverOAuthInvalidResponse 1 or 3 Devolutions Server returned an OAuth answer that Devolutions CLI couldn't use, at sign-in or when it renews the session. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Try again. Check that the URL points at Devolutions Server and not at a proxy. If it persists, sign in with another method and contact support.
serverOAuthLoopbackUnavailable 1 devo login --oauth: Devolutions CLI couldn't start the local listener that receives the browser's answer. Try again, or add --use-device-code. See Sign-in fails or the session expired.
serverOAuthLoopbackUnsupported 1 devo login --oauth: Devolutions Server doesn't offer the browser sign-in. Add --use-device-code to devo login. See Sign-in fails or the session expired.
serverOAuthRefreshBusy 1 or 3 Another devo process has been renewing the same Devolutions Server OAuth session for more than 60 seconds. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Wait for the other command to finish, then try again.
serverOAuthRefreshFailed 1 or 3 The Devolutions Server OAuth session expired and couldn't be renewed. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Sign in again with devo login <name> --server <url> --oauth. See Sign-in fails or the session expired.
serverOAuthSecureStoreRequired 1 or 3 Devolutions Server OAuth sign-in needs the secure store of the operating system, and none is available on this computer. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Make the operating system's secure store available to your user account, or sign in with another method, such as an API key. See Sign in to Devolutions Server.
serverOAuthSessionInvalid 1 or 3 The stored Devolutions Server OAuth session is invalid or unreadable. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Sign in again with devo login <name> --server <url> --oauth. See Sign-in fails or the session expired.
serverOAuthSessionMissing 1 or 3 The context uses OAuth, but no Devolutions Server OAuth session is stored for it on this computer. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Sign in again with devo login <name> --server <url> --oauth. See Sign-in fails or the session expired.
serverOAuthStorageFailed 1 or 3 The Devolutions Server OAuth session couldn't be saved, read, or removed in the operating system's secure store, for example with devo login or devo logout. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Check that the secure store of your user account is unlocked and working, then try again.
serverPrivateInformationFailed 1 devo info --private: Devolutions Server didn't return its private information. Check that the context is signed in and that the account may see this information, then try again.
serverPublicInformationFailed 1 or 3 Devolutions Server didn't return its public information, which Devolutions CLI reads with devo info, at sign-in and before some requests. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Check the Devolutions Server URL and that the server is running, then try again.
serverRequestFailed 1 or 3 A request to Devolutions Server failed. The message gives the HTTP status that Devolutions Server returned, or the cause. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Read the message. Check the URL and that the item exists, then try again.
serverRequestTimeout 1 or 3 Devolutions Server didn't answer in time. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Check that you can reach the server from this computer, for example through a VPN or a proxy. If the server is slow, raise --timeout of devo login. See Sign-in fails or the session expired.
serverUnavailable 1 or 3 Devolutions CLI couldn't reach Devolutions Server. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands. Check the URL, the network, the VPN, or the proxy, and that the server is running. See Network and proxy.
windowsAuthenticationUnsupported 1 or 3 The Devolutions Server context uses Windows authentication (--windows-auth), which works only on Windows, and the command runs on another operating system. devo admin commands exit with 1; vault and entry commands exit with 3. Run the command on Windows, or sign in again with devo login using a user name and password or an application key. See Sign in to Devolutions Server.

## Secret references and reading secrets

Errors from `devo secret read`, `devo secret get`, and other commands that resolve a `devo://` reference. See [Secret reference syntax](/cli/reference/secret-references.md) and [A secret reference doesn't resolve](/cli/help/troubleshooting/reference-does-not-resolve.md).

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
cloudEncryptedEntryGetFailed 1 or 3 Devolutions CLI couldn't retrieve a Devolutions Cloud entry to read one of its fields. The message may give the HTTP status returned. Exit code 1 with devo secret commands, 3 with entry commands. Check that your account can access the entry, then try again. See A secret reference doesn't resolve.
cloudEncryptedEntryUnavailable 1 or 3 The Devolutions Cloud entry holds no protected connection data, so it has no secret field to read. Exit code 1 with devo secret commands, 3 with entry commands. Check that the reference points at the right entry. See A secret reference doesn't resolve.
cloudEntryDecryptionFailed 1 or 3 Devolutions CLI couldn't decrypt the Devolutions Cloud entry. Exit code 1 with devo secret commands, 3 with entry commands. Sign in again with devo login, then try again. If it persists, contact support. See Collect diagnostics for support.
cloudEntryKeyFailed 1 Devolutions CLI couldn't get the key needed to decrypt the requested field of a Devolutions Cloud entry. Check that your account is allowed to view the secrets of the entry, then try again.
cloudEntryPasswordKeyFailed 1 Devolutions Cloud didn't return the key that protects the password of the entry. The message may give the HTTP status returned. Check that your account is allowed to view the password of the entry, then try again.
cloudEntrySensitiveKeyFailed 1 Devolutions Cloud didn't return the key that protects the sensitive fields of the entry. The message may give the HTTP status returned. Check that your account is allowed to view the secrets of the entry, then try again.
cloudSecretFieldNotSupported 1 Devolutions CLI can't read that field from a Devolutions Cloud entry. Use a field the entry exposes: devo entry references <entry> lists them. See Secret reference syntax.
cloudSecretFieldUnavailable 1 The Devolutions Cloud entry has no value for the requested field, even after following the credentials it's linked to. Check the field name, or set a value on the entry. See A secret reference doesn't resolve.
cloudSecretNotFound 1 or 4 Devolutions Cloud says the entry doesn't exist in that vault, or your account can't see it. Exit code 1 with devo secret commands, 4 with entry commands. Check the vault and entry of the reference with devo entry list. See A secret reference doesn't resolve.
cloudSecretResolutionFailed 1 Devolutions CLI couldn't read the requested field of a Devolutions Cloud entry, without a more precise reason. Try again. If it persists, run devo doctor and contact support. See Collect diagnostics for support.
cloudVaultSelectionRequired 1 or 3 No vault was given and no vault is the current one, so entries can't be read. This code is also returned for a Devolutions Server workspace. Exit code 1 with devo secret commands, 3 with entry commands. Name the vault in the reference or with --vault-name or --vault-id, or set the current vault with devo vault use <vault>.
customFieldSelectorAmbiguous 1 Local profile: the custom field named in the reference matches more than one custom field of the entry. Produced when reading a secret, for example with devo secret read or devo secret inject. Rename the custom fields in Devolutions Remote Desktop Manager so each name is unique, then read the field again. See A secret reference doesn't resolve.
inputReadFailed 1 devo secret inject couldn't read the file given with --in-file, for example because of permissions. Check that the file exists and that you can read it. See Fill a configuration file from a template.
invalidConnectionData 1 Local profile: the entry's stored data couldn't be read, so its secret can't be returned. The message says the entry contains unsupported connection data. Produced when reading a secret, for example with devo secret read or devo secret inject. Open the entry in Devolutions Remote Desktop Manager to check it, or use another entry. If it persists, run devo doctor and contact support. See Collect diagnostics for support.
invalidSecretReference 2 or 1 The devo:// reference isn't written correctly; the message says what's wrong. With Devolutions Server, a named reference that leads to an entry without a vault and entry ID also gives this error. It can also mean that a sign-in secret saved in a context doesn't start with env: or file:. Exit code 2 with devo secret read, devo secret get, and devo secret shell; 1 with devo secret inject and devo secret run --check. Fix the reference using the messages in Secret reference syntax. To get a correct reference, run devo entry references <entry>. See A secret reference doesn't resolve.
missingSecretReferenceVariable 1 or 2 A reference in a template or an environment file uses an environment variable that isn't set or is empty, or a ${…} expression is invalid or isn't closed with }. Exit code 1 with devo secret inject; 2 with devo secret run --env-file. Set the variable, or give it a default with ${NAME:-default}. See References inside a text and Set the variables the reference uses.
outputWriteFailed 1 The file given with --out-file couldn't be written, for example because of permissions or because it's in use. Commands: devo secret read, devo secret get, devo secret inject. Check that you can write to the folder and that no other program holds the file, then run the command again.
secretFieldNotFound 4 or 1 The entry exists, but it doesn't have the field the reference names. Exit code 4 with devo secret read, devo secret get, and devo secret shell enter; 1 with devo secret inject and devo secret run. List the entry's fields with devo entry references <entry> and use one of them. See Check that the entry and the field exist.
secretFieldRequiresRuntimeDecryption 1 On a local profile, the field is encrypted and Devolutions CLI can't decrypt it. Read the value in Devolutions Remote Desktop Manager, or use a field that isn't encrypted. See Protected profiles and entries.
secretFieldUnsupported 1 The local profile can't read the field the reference names. An entry protected by a shared passphrase returns the password field only. Use a field the workspace can read. See Use a field the workspace can read and Protected profiles and entries.
secretReadFailed 1 The secret couldn't be read, and no more precise error was returned. Commands: devo secret read, devo secret get, devo secret inject, devo secret run. Run the command again. If it keeps failing, check the reference with devo secret run --check and see A secret reference doesn't resolve.
secretSectionUnsupported 1 On a local profile, the reference names a section that Devolutions CLI can't read. The message is "The requested secret field is not supported." Remove the section, or use connection or credentials. To get a correct reference, run devo entry references <entry>.
secretTextOutputRequired 2 devo secret get with --passphrase-env or --passphrase-file was asked for JSON or YAML output without --out-file. This read writes the value as plain text only. Remove --json, --yaml, or --output, or add --out-file.
sensitiveAuditMetadataRequired 3 or 1 Reading this secret value requires audit information, such as a comment and a ticket number, that wasn't provided. Read the value in Devolutions Remote Desktop Manager, where you can give the comment and ticket number.
sensitiveInputPermissionsInvalid 1 or 2 The file that holds the secret value or passphrase can be read by other users. On Windows, only its owner and trusted system accounts may access it; on Linux and macOS, only its owner. Same commands and exit codes as sensitiveInputUnavailable. Restrict the file's permissions, for example with chmod 600 <file> on Linux or macOS. See Local profiles: the workspace passphrase.
sensitiveInputTooLarge 1 or 2 The secret value or passphrase read from the variable or the file is larger than Devolutions CLI accepts. Same commands and exit codes as sensitiveInputUnavailable. Check that the variable or the file holds only the value, not a whole document.
sensitiveInputUnavailable 1 or 2 A secret value or passphrase given with an --…-env or --…-file option couldn't be read: the environment variable isn't set, or the file doesn't exist, isn't a regular file, or can't be read. Exit code 1 on a local profile, for example with devo secret set or devo secret get --passphrase-file; 2 with devo secret set on Devolutions Server. Check the variable name or the file path, and that the variable is set in the same shell. See Update a secret from a script.
sensitiveResolutionRequestInvalid 1 The request to read a secret value was incomplete, so the background process refused it. Run the command again. If the error persists, run devo doctor and contact support. See Collect diagnostics for support.
sensitiveUnauthenticatedCaller 1 The background process refused to return a secret value because the request didn't come from an authenticated session. Run the command again. If the error persists, restart the background process with devo daemon restart. See The background process won't start.
sensitiveValueNotAllowed 1 The background process is set to block secret values, such as passwords, one-time passwords, and private keys, or the way the value would be delivered doesn't allow a plain-text value. Read the value with a devo secret command. If the error persists, restart the background process with devo daemon restart.
sensitiveValueNotSupported 3 or 1 The workspace can show the entry's details but can't return this secret value. On a local profile, this applies to values such as one-time passwords and private keys, and local entry updates never write passwords or secret references. Exit code 3 with entry commands; 1 with devo secret commands. To change a password, use devo secret set. To read the value, use a workspace type that supports it. See A command says the workspace doesn't support it.
serverSecretNotFound 1 or 4 Devolutions Server didn't find the vault, the entry, or the field, or the field isn't available to this account. With devo secret read, devo secret get, devo secret run, devo secret inject, devo secret shell, and devo secret set, the exit code is 1; with the entry commands that run in the background process, it's 4. Check the vault ID, the entry ID, and the field name, and that your account can see the entry. See A secret reference doesn't resolve.
serverSecretPamUnsupported 1 devo secret set: Devolutions Server can't write a secret of an entry in a privileged access (PAM) vault. Change this secret in Devolutions Server. See Update a secret from a script.
serverSecretReadFailed 1 Devolutions Server couldn't read the requested secret, with devo secret read, devo secret get, devo secret run, devo secret inject, devo secret shell. Try again. Check the reference and that your account can read the entry. See A secret reference doesn't resolve.
serverSecretUnauthorized 1 Devolutions Server refused access to the secret: the sign-in was rejected or has expired, or the account isn't allowed to read or change it. Sign in again with devo login, and check the permissions of the account on the entry. See Sign-in fails or the session expired.
serverSecretWriteFailed 1 Devolutions Server couldn't update the secret, with devo secret set. Check the vault ID, the entry ID, and the field, and that your account may change the entry, then try again. See Update a secret from a script.
unsupportedSecretAttribute 2 or 1 The attribute in ?attribute= or --attribute isn't known, or the workspace can't return that attribute as a value: the local profile returns only value, and Devolutions Cloud and Devolutions Server don't return a value for otp. Exit code 2 with devo secret read and devo secret get; 1 with devo secret inject and devo secret run. Use value, type, id, title, or purpose. See Attributes.
unsupportedSecretField 1 The reference names a section, or a field that isn't an entry data property. Devolutions Cloud reads main entry fields only, such as password or username; Devolutions Server reads one entry data property, without a section. Remove the section from the reference and name a main field. See Use a field the workspace can read.
vaultNotSelected 1 devo secret get received an entry ID (--id), but no vault was given and no current vault is selected, so the entry can't be located. Pass --vault-id, or select a vault with devo vault use. See Select the vault you work in.
workspaceSelectorAmbiguous 1 The workspace named in a secret reference matches more than one workspace of the local profile. Produced while reading a secret, for example with devo secret read, devo secret get, devo secret inject, or devo secret run. Use the workspace ID in the reference instead of its name. See Secret reference syntax and A secret reference doesn't resolve.

## Running commands with secrets

Errors from `devo secret run`, `devo secret inject`, and `devo secret shell`. These errors are written as plain `: ` text to the error output.

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
invalidCommand 2 devo secret run has no command to start: nothing follows -- and no --manifest was given. Add the command after --, for example devo secret run --env-ref ... -- ./deploy.sh, or use --manifest. See Run a command with its secrets.
invalidEnvironmentFile 2 A line of the file given with devo secret run --env-file isn't in KEY=value form. Empty lines and lines that start with # are allowed. Fix the line. See How Devolutions CLI reads the file.
invalidReceiptFile 1 The path given with --receipt-file is a folder. The command ran, but devo secret run exits with 1 instead of the command's exit code. Give a file path. See Keep a record of the launch.
invalidSecretEnvironmentName 2 A variable name in the environment file or the launch manifest isn't valid. Names use letters, digits, and underscores, and can't start with a digit. Rename the variable. See Run a command with its secrets.
invalidSecretEnvironmentReference 2 An --env-ref isn't in NAME=devo://… form, the name isn't valid, or the value isn't an exact devo:// reference. In a launch manifest, each value of environment must be an exact reference. Write it as --env-ref NAME=devo://<workspace>/<vault>/<entry>/<field>. See Pass several secrets.
invalidSecretLaunchManifest 2 The launch manifest isn't valid JSON, doesn't use schemaVersion 1, has no command, or repeats a property or a variable name. Fix the manifest. See Use a launch manifest.
invalidSecretLaunchTimeout 2 The timeout, from --timeout-seconds or timeoutSeconds in a launch manifest, is zero or negative. Give a number of seconds greater than zero. See Limit how long the program runs.
invalidSecretLaunchWorkingDirectory 2 The workingDirectory of the launch manifest isn't an absolute path. Use a full path. See Use a launch manifest.
invalidSecretStdinReference 2 The value of --stdin-reference, or stdinReference in a launch manifest, isn't an exact devo:// reference. Pass one complete reference. See Send a secret to standard input.
receiptFileExists 1 The receipt file already exists, or couldn't be created. A receipt never replaces an existing file. The command ran, but devo secret run exits with 1. Use a new file name, or delete the old receipt first.
receiptWriteFailed 1 You don't have permission to write the receipt file. The command ran, but devo secret run exits with 1. Write the receipt to a folder you can write to.
secretEnvironmentConflict 2 The same variable is set more than once, for example by two --env-ref, or by an --env-ref and the environment file. Variable names aren't case-sensitive here. Keep one definition of each variable.
secretEnvironmentFileReadFailed 2 The file given with devo secret run --env-file exists but couldn't be read, for example because of permissions. Check that you can read the file.
secretLaunchArgumentReference 2 A devo:// reference was written as an argument of the command to run. Devolutions CLI refuses it, so the value can't appear in the process list. Pass it with --env-ref, --stdin-reference, or --manifest. See Keep references out of the command line.
secretLaunchCancelled 130 devo secret run was interrupted, for example with Ctrl+C, and the command it started was stopped. If the receipt file couldn't be written, the exit code is 1. Run it again.
secretLaunchCommandNotFound 1 devo secret run --check didn't find the command in the working folder or in the PATH. Check the command name, give its full path, or add its folder to PATH.
secretLaunchManifestReadFailed 2 The launch manifest given with --manifest exists but couldn't be read. Check that you can read the file.
secretLaunchModeConflict 2 devo secret run got both --dry-run and --check. Keep one of them. See Check before you run.
secretLaunchSourceConflict 2 --manifest was combined with --env-file, --env-ref, --stdin-reference, --timeout-seconds, or a command after --. Put everything in the manifest, or don't use --manifest.
secretLaunchStandardInputFailed 1 The command started by devo secret run stopped accepting standard input before it got the value of --stdin-reference. The command was stopped. Check that the command reads its standard input. See Send a secret to standard input.
secretLaunchStartFailed 1 The secrets were read, but the command couldn't be started, for example because it doesn't exist or isn't executable. Check the command with devo secret run --check, then run it again.
secretLaunchTimedOut 124 The command started by devo secret run exceeded --timeout-seconds and was stopped. If the receipt file couldn't be written, the exit code is 1. Raise the timeout, or find out why the command takes so long. See Limit how long the program runs.
secretLaunchWorkingDirectoryNotFound 2 The workingDirectory of the launch manifest doesn't exist. Create the folder or fix the path.
secretShellMappingInvalid 2 devo secret shell enter got no --env-ref, or an --env-ref that isn't a unique NAME=devo://… pair. Names reserved by Devolutions CLI are refused too. Pass at least one --env-ref NAME=<reference>, with a different name each time. See Enter the scope.
secretShellOutputFailed 1 devo secret shell enter or leave couldn't write the shell code to the standard output, for example because the pipe was closed. Run it again as shown in Use secrets in your current shell.
secretShellOutputModeConflict 2 The output format doesn't fit the devo secret shell command: enter and leave write shell code as text, while status and enter --check need --output json. Remove the output option from enter and leave; add --output json to status and enter --check. See Use secrets in your current shell.
secretShellStateInvalid 1 The DEVO_SECRET_SHELL_STATE_V1 variable that tracks the loaded secrets is damaged, or was set by another shell, for example a Bash scope seen from PowerShell. Use the same --shell as for enter. If the variable is damaged, open a new shell session.
secretShellUnsupported 2 The --shell value isn't supported. Use --shell bash or --shell pwsh.
secretShellValueUnsupported 1 A secret contains a NUL character, which a shell variable can't hold. Nothing was loaded. Use devo secret run with --stdin-reference, or change the secret.
secretEnvironmentResolutionFailed 1 devo secret run couldn't resolve the secrets of the command, and no more specific error was reported. Run the same command with --check to find the reference that fails. See A secret reference doesn't resolve.

## SecretSpec

Errors from the commands that register Devolutions CLI as a SecretSpec provider. When SecretSpec reads or writes a secret through Devolutions CLI, it doesn't receive these error codes: the provider answers with a general SecretSpec error instead, such as permission denied, interaction required, provider unavailable, or conflict, and a value that isn't found is usually reported as missing. See [Use Devolutions CLI with SecretSpec](/cli/guides/secrets/secretspec.md).

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
secretSpecClaimConflict 1 devo secretspec register found a claim for devo:// that points at another program. Check it with devo secretspec status. To replace it, add --force. See Register Devolutions CLI as the provider.
secretSpecClaimWriteFailed 1 devo secretspec register couldn't write the claim file, or devo secretspec unregister couldn't remove it. The message gives the path and the reason. With --system, administrator rights are usually needed. Run the command as an administrator for --system, or check the permissions of the folder. See Where the claim file goes.

## Local profile

Errors from the local profile, the Devolutions Remote Desktop Manager data file on your computer. See [Use a local Devolutions Remote Desktop Manager profile](/cli/guides/connect/local-profile.md).

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
applicationUnlockMaterialRequired Depends on the command The local Devolutions Remote Desktop Manager profile is protected by an application password, and it hasn't been unlocked for the background process. Commands that need the profile fail with this code: usually 3, and 1 with devo secret commands. Unlock it with devo config unlock --password-env <VARIABLE> --yes. See Protected profiles and entries.
headlessConfigUnavailable Depends on the command The local profile folder couldn't be read or created, for example because of permissions. Usually 3; 1 with devo secret commands and devo config unlock. Check the folder shown by devo config path and its permissions, or set RDM_CONFIG_PATH to another folder. See Environment variables.
headlessCoreExtractionRequired 3 The local profile doesn't support this operation in Devolutions CLI yet, for example some entry changes or some reads of entry details. When Devolutions CLI can't write entries to this local profile at all, every change command reports this code, even those that would otherwise report a more precise code such as sqliteVaultLifecycleUnavailable. Use Devolutions Remote Desktop Manager for this operation. See A command says the workspace doesn't support it.
headlessSqliteNotFound Depends on the command The local profile folder doesn't contain a SQLite workspace (*.db file) yet, or the folder isn't set. Commands that need the workspace fail with this code and a message on how to create one: 4 with workspace, vault, and entry commands, 1 with devo secret commands and devo config unlock. Create a workspace with devo workspace create <name> --passphrase-env <VARIABLE> --yes, or point to an existing profile with devo login <name> --sqlite <profile-folder>. See Use a local Devolutions Remote Desktop Manager profile.
headlessSqliteUnavailable Depends on the command The SQLite workspace of the local profile couldn't be read, for example because it's locked or damaged. Usually 3; 1 with devo secret commands and devo config unlock. Close programs that may lock the file, then restart the background process with devo daemon restart. See The background process won't start.
invalidHeadlessSqlite Depends on the command The SQLite workspace of the local profile isn't in a format Devolutions CLI supports, for example because it's encrypted. Usually 3; 1 with devo secret commands and devo config unlock. Use a workspace that isn't encrypted. See Protected profiles and entries.
invalidRdmOptions Depends on the command The options file of the local Devolutions Remote Desktop Manager profile couldn't be read or parsed. Usually 3; 1 with devo secret commands and devo config unlock. Open the profile in Devolutions Remote Desktop Manager to check it, then run devo daemon restart.
malformedProtectedPayload 1 The protected data of the entry is damaged, so its value can't be read. Open the entry in Devolutions Remote Desktop Manager and save its password again.
protectedMetadataInvalid 1 The entry is protected, but the shared passphrase settings of the workspace or the vault are missing or invalid. Open the workspace in Devolutions Remote Desktop Manager and check its shared passphrase settings.
protectedProfileSecretResolutionFailed 1 The local profile protected by an application password is unlocked, but the field the reference names couldn't be read from it. Check that the field exists with devo entry references <entry>. If the profile was unlocked before a restart of the background process, unlock it again.
protectedProfileUnlockFailed 1 devo config unlock couldn't unlock the local profile, usually because the application password is wrong. Commands that need the profile then fail with this code too. Check the password in the variable or the file, and run devo config unlock again. See Protected profiles and entries.
protectedSharedPassphraseV2Payload 1 The entry is protected by a shared passphrase, and the reference couldn't be read with a passphrase, for example because it's a named reference. Use devo secret get password <entry>, or the canonical reference from devo entry references. Give the passphrase with --passphrase-env or --passphrase-file if there's no passphrase file next to the workspace. See Protected profiles and entries.
requiresUnlock Depends on the command The background process was told that the local profile must be unlocked, and no unlock value was given. Usually 3; 1 with devo secret commands. Unlock the profile with devo config unlock. See Protected profiles and entries.
sqliteActivityLogExportSchemaUnavailable 3 devo admin logs export on a local profile: the workspace database doesn't have the activity log columns needed for the export. The message gives the reason. Use a local profile whose workspace has an activity log, or export the logs from Devolutions Remote Desktop Manager. See Review activity logs.
sqliteDocumentationContentUpdateUnavailable 3 devo entry documentation update with new content on a local profile. A local profile can rename a documentation page, but not change its content. Pass only --new-title, or change the content in Devolutions Remote Desktop Manager.
sqliteDocumentationDatabaseNotFound 4 devo entry documentation update on a local profile: the workspace database file wasn't found. Check the current workspace with devo workspace current and that its file still exists in the profile folder (devo config path).
sqliteDocumentationDatabaseUnavailable 3 The workspace database couldn't be opened to rename a documentation page, for example because it's locked or access is denied. Close programs that may lock the file, check its permissions, and try again.
sqliteDocumentationDatabaseUnsupported 3 Renaming a documentation page needs an unencrypted workspace database that Devolutions CLI supports. This one is encrypted or not supported. Rename the page in Devolutions Remote Desktop Manager. See Protected profiles and entries.
sqliteDocumentationSchemaUnsupported 3 The workspace database doesn't have the documentation tables or columns that a title rename needs, or has a database trigger that Devolutions CLI can't validate. Renames are blocked for this workspace. Rename the page in Devolutions Remote Desktop Manager.
sqliteDocumentationTitleUpdateAuditIdentityUnavailable 3 Renaming a documentation page in a local profile records who made the change. The background process has no user identity to record, so the rename is refused. Restart the background process from your own user session with devo daemon restart, then try again.
sqliteDocumentationTitleUpdateConflict 3 The documentation page changed, was removed, or the database was locked by another program while the rename was applied. Nothing was changed. Run the command again. If Devolutions Remote Desktop Manager has the workspace open, wait until it's done saving.
sqliteDocumentationTitleUpdateNoChanges 3 The new title is the same as the current title. Pass a different --new-title.
sqliteDocumentationTitleUpdateSnapshotRequired 3 The documentation page couldn't be loaded with the details a rename needs. Run the command again. If it keeps failing, restart the background process with devo daemon restart.
sqliteDocumentationTitleUpdateUnavailable 3 The documentation page couldn't be renamed in this local profile: either the workspace doesn't support renames (the message gives the reason), or the database refused the change. Nothing was changed. Read the message. Check that the workspace file isn't read-only or locked, then try again, or rename the page in Devolutions Remote Desktop Manager.
sqliteDocumentationVersionInvalid 3 The workspace database doesn't have a valid database version, so documentation pages can't be renamed. Open the workspace in Devolutions Remote Desktop Manager to check it, or rename the page there.
sqliteDocumentationVersionUnsupported 3 The workspace database is too old for documentation renames. The message gives the minimum version. Upgrade the workspace in Devolutions Remote Desktop Manager, or rename the page there.
sqliteEntryCreateFailed 1 devo entry create on a local profile: the entry couldn't be created. Nothing was saved. Check that the workspace file isn't read-only or locked, then try again.
sqliteEntryCreateNameInvalid 2 devo entry create on a local profile: the entry name is empty. Give a name for the entry.
sqliteEntryCreateVaultUnsupported 2 devo entry create on a local profile can create entries in the default vault only. Remove --vault-id or --vault-name, or create the entry in Devolutions Remote Desktop Manager.
sqliteEntryMoveConflict 3 devo entry move on a local profile: an entry changed or was removed while it was being moved, or couldn't be read back afterward. Nothing was changed. Run the command again.
sqliteEntryMoveNoChanges 3 devo entry move: the entries are already in the destination folder. Check the destination folder.
sqliteEntryMoveSchemaUnsupported 3 devo entry move: the workspace database doesn't store entries per vault in the way Devolutions CLI supports, so entries can't be moved. Move the entries in Devolutions Remote Desktop Manager.
sqliteEntryMutationUnavailable 3 The workspace database refused or couldn't save an entry change (devo entry update, entry field set, entry status set, entry tag set, entry parameter set, entry move, entry folder rename). Nothing was changed. Check that the workspace file isn't read-only, locked, or full, then try again.
sqliteEntryParameterUpdateFieldUnsupported 3 devo entry parameter set on a local profile can rename a parameter (its label) only. It can't change the parameter type. Remove the type option, or change the type in Devolutions Remote Desktop Manager.
sqliteEntryParameterUpdateOperationUnsupported 3 A local profile supports only setting a parameter label. Use devo entry parameter set with a new label.
sqliteEntryParameterXmlProjectionUnavailable 3 devo entry parameter set: the parameter labels of this entry are stored in a form Devolutions CLI can't safely update. Nothing was changed. Change the parameter in Devolutions Remote Desktop Manager.
sqliteEntryUpdateConflict 3 The entry changed or was removed after it was loaded, the database was locked by another program, or the entry couldn't be read back after the change. Nothing was changed. Run the command again. If Devolutions Remote Desktop Manager has the workspace open, wait until it's done saving.
sqliteEntryUpdateFieldUnsupported 3 A local profile can't change this entry detail: the folder (use devo entry move), the host port, or, when the workspace doesn't store them, the status or tags. The message names the detail. Change it in Devolutions Remote Desktop Manager, or use devo entry move to change the folder.
sqliteEntryUpdateNoChanges 3 The update asks for no change: no supported detail was given, or the new values are the same as the current ones. A local profile can update the name, host, domain, user name, status, and tags. Pass at least one detail with a new value.
sqliteEntryWriteDatabaseNotFound 4 An entry change on a local profile: the workspace database file wasn't found. Check the current workspace with devo workspace current and that its file still exists in the profile folder (devo config path).
sqliteEntryWriteDatabaseUnavailable 3 The workspace database couldn't be opened to change an entry, for example because it's locked or access is denied. Close programs that may lock the file, check its permissions, and try again.
sqliteEntryWriteDatabaseUnsupported 3 Entry changes need an unencrypted workspace database that Devolutions CLI supports. This one is encrypted or not supported. Change the entry in Devolutions Remote Desktop Manager. See Protected profiles and entries.
sqliteEntryWriteSchemaUnavailable 3 Entry changes (devo entry update, entry field set, entry status set, entry tag set, entry parameter set, entry move, entry folder rename) aren't available for this local profile. The message gives the reason, for example an encrypted or unsupported workspace database. Read the message. Use a supported, unencrypted workspace and back it up before the first change, or make the change in Devolutions Remote Desktop Manager. See A command says the workspace doesn't support it.
sqliteEntryWriteSchemaUnsupported 3 The workspace database doesn't have the entry and history tables that Devolutions CLI needs to change entries safely. Change the entry in Devolutions Remote Desktop Manager.
sqliteEntryWriteVersionInvalid 3 The workspace database doesn't have a valid database version, so entries can't be changed. Open the workspace in Devolutions Remote Desktop Manager to check it, or make the change there.
sqliteEntryWriteVersionUnsupported 3 The workspace database is too old for entry changes. The message gives the minimum version. Upgrade the workspace in Devolutions Remote Desktop Manager, or make the change there.
sqliteEntryXmlProjectionUnavailable 3 The entry stores the requested detail in a form Devolutions CLI can't update without touching protected data. Nothing was changed. Change the entry in Devolutions Remote Desktop Manager.
sqliteFolderRenameConflict 3 devo entry folder rename: the folder changed or was removed while it was being renamed, or couldn't be read back afterward. Nothing was changed. Run the command again.
sqliteFolderRenameNoChanges 3 devo entry folder rename: the new name is the same as the current one. Pass a different --new-name.
sqliteFolderRenameSchemaUnsupported 3 devo entry folder rename: the workspace database doesn't store entries per vault in the way Devolutions CLI supports, so folders can't be renamed. Rename the folder in Devolutions Remote Desktop Manager.
sqliteMutationApplicationPasswordUnsupported 1 The local profile is protected by an application password, or its application password settings can't be validated. Devolutions CLI can't read or write protected passwords in such a profile. Read or change the password in Devolutions Remote Desktop Manager. See Protected profiles and entries.
sqliteMutationCancelled 1 Reading or writing a protected password in a local profile was cancelled before it finished. If you pressed Ctrl+C, Devolutions CLI reports interrupted with exit code 130 instead. Run the command again.
sqliteMutationConflict 1 devo secret set on a local profile: the entry, the vault, or the workspace settings changed between the check and the write. Nothing was changed. Run the command again.
sqliteMutationDatabaseBusy 1 The workspace database is busy or locked by another program, so the password couldn't be read or written. Wait until Devolutions Remote Desktop Manager or the other program is done, then try again.
sqliteMutationEncryptedContainerUnsupported 1 The workspace database file is encrypted. Devolutions CLI reads and writes protected passwords, and creates entries, only in an unencrypted workspace file. Use Devolutions Remote Desktop Manager for this workspace. See Protected profiles and entries.
sqliteMutationEntryNotFound 4, or 1 (see meaning) The entry wasn't found in the vault, its ID isn't valid, several entries match, or it has no protected password. Exits with 4 for devo secret set and devo secret get with a passphrase option, and 1 when a reference is read (devo secret read, inject, run). Check the entry ID with devo entry get or devo entry list.
sqliteMutationLifecycleUnsupported 1 devo secret set: the entry or the workspace password history settings have a shape that Devolutions CLI can't update safely, for example an entry with more than one password field. Nothing was changed. Change the password in Devolutions Remote Desktop Manager.
sqliteMutationPasswordUnsupported 1 The entry has no password Devolutions CLI can read or change: it has none, more than one, or it takes its password from another credential. Only the password field of a protected entry is supported. Read or change the credential where it's stored, or use Devolutions Remote Desktop Manager.
sqliteMutationPersistenceFailed 1 The protected password couldn't be saved, or couldn't be read (devo secret set, devo secret get with a passphrase option). When the change is refused, nothing was saved. Check that the workspace file isn't read-only or locked, then try again.
sqliteMutationReadOnly 1 The workspace database couldn't be opened for writing, for example because it's read-only, locked, or open in another program. Check the file's permissions, close programs that may lock it, and try again.
sqliteMutationSchemaUnsupported 1 The workspace database is missing tables or settings that Devolutions CLI needs to read or write a protected password, or its settings are ambiguous. Open the workspace in Devolutions Remote Desktop Manager to check it, or make the change there.
sqliteMutationSecurityProviderUnsupported 1 The workspace isn't protected by a shared passphrase, or its protection settings are malformed. Devolutions CLI reads and writes protected passwords, and creates entries, only with a shared passphrase. Use Devolutions Remote Desktop Manager for this workspace. See Protected profiles and entries.
sqliteMutationSourceInvalid 2, or 1 (see meaning) The workspace ID isn't a valid sqlite:<file-name>.db ID, or the passphrase file next to the workspace can't be located in the profile folder. Exits with 2 for devo secret set and devo secret get with a passphrase option, and 1 when a reference is read. Use the exact workspace ID that devo workspace list shows. See Local profiles: the workspace passphrase.
sqliteMutationUnlockFailed 1 The shared passphrase is wrong, or the workspace's passphrase settings are invalid. Check the passphrase in the <workspace file>.passphrase file, or in the variable or file you pass with --passphrase-env or --passphrase-file. See Local profiles: the workspace passphrase.
sqliteMutationUnlockRequired 1 The shared passphrase must be checked before the password is read or written, and it wasn't. Give the passphrase: the <workspace file>.passphrase file, --passphrase-env, or --passphrase-file. See Local profiles: the workspace passphrase.
sqliteMutationUnsafeMirrorUnsupported 1 The workspace or the entry keeps a clear-text copy of passwords. Devolutions CLI doesn't write passwords in that case. Change the password in Devolutions Remote Desktop Manager.
sqliteMutationVaultNotFound 4, or 1 (see meaning) The vault wasn't found, its ID isn't valid, or several vaults match. Exits with 4 for devo secret set and devo secret get with a passphrase option, and 1 when a reference is read. Check the vault ID with devo vault list.
sqliteMutationWorkspaceBusy 1 Another Devolutions CLI operation is already changing this local workspace. Wait until it's done, then try again.
sqliteMutationWorkspaceMismatch 1 The profile folder uses a symbolic link or junction that makes the workspace path ambiguous, or the entry's protected data doesn't match the selected entry. Nothing was changed. Use a profile folder without symbolic links or junctions. If the entry is the problem, check it in Devolutions Remote Desktop Manager.
sqliteMutationWorkspaceNotFound 4, or 1 (see meaning) The workspace file wasn't found in the profile folder. Exits with 4 for devo secret set and devo secret get with a passphrase option, and 1 with devo workspace delete and when a reference is read. Check the workspace ID with devo workspace list and the profile folder with devo config path.
sqliteOperationFailed 1 A local profile operation run by the background process failed without a more precise reason. Try again. If it keeps failing, run devo doctor. See Collect diagnostics for support.
sqliteSchemaProjectionUnavailable 3 The command reads data that this local profile's workspace doesn't contain in a form Devolutions CLI supports, for example users, groups, entry permissions, password lists, playlists, tasks, or vault settings. The message gives the reason. Use a workspace that has this data, or read it in Devolutions Remote Desktop Manager. See A command says the workspace doesn't support it.
sqliteSchemaUnavailable 1 Reading a secret from a local profile: the workspace database has no entries table, so secrets can't be read from it. Check that the current workspace is a Devolutions Remote Desktop Manager workspace with devo workspace current.
sqliteSecretFieldUnsupported 2 devo secret set, or devo secret get with --passphrase-env or --passphrase-file, on a local profile supports the password field only. Use the password field. See Update a secret from a script.
sqliteSecretNotFound 1 devo secret get on a local profile: the workspace, vault, entry, or field wasn't found. Check the IDs with devo workspace list, devo vault list, and devo entry get.
sqliteSecretReadFailed 1 A secret couldn't be read from the local profile, or the background process didn't return it. Try again. If it keeps failing, restart the background process with devo daemon restart.
sqliteSecretResolutionUnavailable 1 The local profile's workspace database couldn't be read to get the secret. Check that the workspace file isn't locked or damaged, then try again.
sqliteVariableDeleteNoChanges 3 devo workspace variable delete or devo vault variable delete: the variable wasn't found, so nothing was deleted. Check the name with devo workspace variable list or devo vault variable list. See Use custom variables.
sqliteVariableMutationUnavailable 3 The workspace database refused or couldn't save a custom variable change. Nothing was changed. Check that the workspace file isn't read-only or locked, then try again.
sqliteVariableScopeUnsupported 3 A local profile can change workspace and vault custom variables only, not user vault or option variables. Use devo workspace variable or devo vault variable. See Use custom variables.
sqliteVariableStoreMalformed 3 The custom variables of the workspace or vault are stored in a form Devolutions CLI can't update safely, for example a variable without a unique name. Nothing was changed. Check the variables in Devolutions Remote Desktop Manager, or change them there.
sqliteVariableStoreUnavailable 3 The workspace or vault custom variables couldn't be found in the workspace database, for example because the workspace settings are missing. Open the workspace in Devolutions Remote Desktop Manager to check it, or change the variables there.
sqliteVariableUpdateConflict 3 The custom variables changed after they were loaded, the database was locked by another program, or the change couldn't be read back. Nothing was changed. Run the command again.
sqliteVariableUpdateNoChanges 3 The variable already has this value and description. Nothing to do, or pass a different value.
sqliteVariableWriteDatabaseNotFound 4 A custom variable change on a local profile: the workspace database file wasn't found. Check the current workspace with devo workspace current and that its file still exists in the profile folder (devo config path).
sqliteVariableWriteDatabaseUnavailable 3 The workspace database couldn't be opened to change a custom variable, for example because it's locked or access is denied. Close programs that may lock the file, check its permissions, and try again.
sqliteVariableWriteDatabaseUnsupported 3 Custom variable changes need an unencrypted workspace database that Devolutions CLI supports. This one is encrypted or not supported. Change the variables in Devolutions Remote Desktop Manager.
sqliteVariableWriteSchemaUnavailable 3 devo workspace variable set, delete, and devo vault variable set, delete aren't available for this local profile. The message gives the reason. Read the message. Use a supported, unencrypted workspace and back it up before the first change, or make the change in Devolutions Remote Desktop Manager. See Use custom variables.
sqliteVariableWriteSchemaUnsupported 3 The workspace database doesn't have the tables or settings Devolutions CLI needs to change custom variables safely. Change the variables in Devolutions Remote Desktop Manager.
sqliteVariableWriteVersionInvalid 3 The workspace database doesn't have a valid database version, so custom variables can't be changed. Open the workspace in Devolutions Remote Desktop Manager to check it, or make the change there.
sqliteVariableWriteVersionUnsupported 3 The workspace database is too old for custom variable changes. The message gives the minimum version. Upgrade the workspace in Devolutions Remote Desktop Manager, or make the change there.
sqliteVaultLifecycleUnavailable 3 A local profile can't create, update, or delete vaults, change their settings, or grant and revoke vault access. If Devolutions CLI can't write entries to this local profile at all, these commands report headlessCoreExtractionRequired instead. Make the change in Devolutions Remote Desktop Manager. See A command says the workspace doesn't support it.
sqliteWorkspaceAlreadyExists 1 devo workspace create: a workspace file with this name already exists in the profile folder. Choose another name or --path, or use the existing workspace with devo workspace use.
sqliteWorkspaceBootstrapCancelled 1 Creating or deleting a local workspace, or creating an entry in it, was cancelled before it finished. If you pressed Ctrl+C, Devolutions CLI reports interrupted with exit code 130 instead. Check the workspace with devo workspace list, then run the command again.
sqliteWorkspaceBusy 1 devo workspace create, devo workspace delete, or devo entry create: the workspace is open in another program, locked, or already being changed by another operation. Close Devolutions Remote Desktop Manager or wait until the other operation is done, then try again.
sqliteWorkspaceCreationFailed 1 devo workspace create: the workspace file couldn't be created. Check that the profile folder exists and that you can write to it (devo config path), then try again.
sqliteWorkspaceDeleteUnsupported 3 devo workspace delete on a local profile works on Windows only. Delete the workspace in Devolutions Remote Desktop Manager, or from a Windows computer.
sqliteWorkspaceDeletionFailed 1 devo workspace delete: the workspace file couldn't be deleted. Close programs that may use the file, check its permissions, and try again.
sqliteWorkspaceDeletionIncomplete 1 devo workspace delete: the workspace database was deleted, but a related file next to it couldn't be removed. Remove the leftover files of the workspace from the profile folder (devo config path).
sqliteWorkspaceLifecycleUnavailable 3 This change to a local workspace isn't supported, for example devo workspace delete with a workspace name instead of its sqlite: ID. For devo workspace delete, pass the exact ID that devo workspace list shows. Otherwise, make the change in Devolutions Remote Desktop Manager.
sqliteWorkspacePassphraseInvalid 1 devo workspace create: the shared passphrase is too short. The message gives the minimum length. Use a longer passphrase in the variable or file you pass with --passphrase-env or --passphrase-file.
sqliteWorkspaceRootNotFound 1 The local profile folder doesn't exist. Check the folder with devo config path. See Find the profile folder Devolutions CLI uses.
sqliteWorkspaceSchemaUnsupported 1 devo entry create: the workspace database isn't in a form Devolutions CLI supports. Create the entry in Devolutions Remote Desktop Manager.
sqliteWorkspaceSourceInvalid 2 The workspace isn't a valid sqlite:<file-name>.db file name directly in the profile folder, or the profile folder uses a symbolic link or junction that makes the path ambiguous. Use a plain file name ending in .db, without folders, and a profile folder without symbolic links or junctions.
unsupportedWorkspaceType 3 The type of workspace in use doesn't support this read, for example personal account details, which a local profile doesn't have. Select a workspace that supports it with --context. See A command says the workspace doesn't support it.
workspaceNotSelected 1 No workspace is selected in the local profile, so the command doesn't know which workspace to use. Produced by commands that read or write a local SQLite workspace without naming it, for example devo secret get with an entry ID, devo secret set, or devo entry create. Select a workspace with devo workspace use <workspace>, or name the workspace in the command. See Use a local profile.

## Workspaces, vaults, and entries

Errors from `devo vault`, `devo entry`, `devo workspace`, `devo variable`, and related commands. A code that ends in `NotFound` exits with `4` on these commands.

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
activityLogExportWriteFailed 3 Local profile: devo logs export couldn't write the activity log report to the output file, for example because the file is locked or you don't have write access. Check that you can write to the output path, close any program that has the file open, and run the command again. See Review activity logs.
cloudEntryGetFailed 1 or 3 Devolutions CLI couldn't retrieve the Devolutions Cloud entry. The message may give the HTTP status returned. Exit code 1 with devo entry access grant and revoke, 3 with the other entry commands. Check the vault and entry IDs, and that your account can access the entry. See Manage vaults and entries.
cloudEntryListFailed 1 or 3 Devolutions CLI couldn't list the entries of the Devolutions Cloud vault, for example to find an entry by name. Exit code 1 with devo secret commands, 3 with entry commands. Check that your account can access the vault, then try again.
cloudEntryPasswordUpdateFailed 3 devo secret set: Devolutions CLI couldn't change the password of the Devolutions Cloud entry, without a more precise reason. Try again. See Update a secret from a script.
cloudEntryPermissionEntryAmbiguous 3 devo entry permission get: more than one Devolutions Cloud entry has that name. Select the entry by ID, with id:<value> or --id.
cloudEntryPermissionListFailed 1 or 3 Devolutions CLI couldn't fetch the role assignments of the Devolutions Cloud entry. Exit code 1 with devo entry access commands, 3 with devo entry permission get. Check that your account can manage the security of the entry, then try again. See Manage users, groups, and access.
cloudEntryPermissionPathUnsupported 3 devo entry permission get: with Devolutions Cloud, the entry can't be selected by path. Select the entry by ID or by its exact name.
cloudEntryPermissionSubjectUnavailable 3 devo entry permission get: a role assignment of the Devolutions Cloud entry doesn't say which user or group it's for. Review the permissions of the entry in Devolutions Cloud. If it persists, contact support.
cloudEntrySoftDeleteCanonicalIdRequired 3 Deleting a Devolutions Cloud entry needs the IDs of the vault and of the entry, and a value given isn't a valid ID. Most often seen with the entry deletion tool of the MCP server, which returns it without an exit code. Pass the vault ID and the entry ID, as shown by devo entry get.
cloudEntrySoftDeleteFailed 3 devo entry delete: Devolutions Cloud couldn't delete the entry. The message may give the HTTP status returned. Check that your account can delete the entry and what's under it, then try again. See Manage vaults and entries.
cloudEntrySoftDeleteProviderRequired 3 The background process wasn't connected to Devolutions Cloud when it received the request to delete a Devolutions Cloud entry. Make sure the Devolutions Cloud context is selected, then run the command again. If it persists, run devo daemon restart. See The background process won't start.
cloudEntrySoftDeleteRequired 3 Devolutions Cloud deletes an entry together with what's under it, so the generic deletion was refused. Use devo entry delete --acknowledge-recursive-scope.
cloudGroupCanonicalIdRequired 3 devo admin group delete: the group ID given isn't a valid ID. Pass the group by name, or by the ID shown by devo admin group list.
cloudGroupCreateFailed 3 devo admin group create: Devolutions Cloud couldn't create the group. The message may give the HTTP status returned. Check that your account can manage groups, then try again. See Manage users, groups, and access.
cloudGroupDeleteFailed 3 devo admin group delete: Devolutions Cloud couldn't delete the group. The message may give the HTTP status returned. Check that your account can manage groups, then try again.
cloudGroupGetFailed 3 Devolutions CLI couldn't retrieve the Devolutions Cloud group, before changing or deleting it, or to list its members. Check the group with devo admin group list, then try again.
cloudGroupListFailed 3 Devolutions CLI couldn't list the Devolutions Cloud groups. Check that your account can view groups, then try again.
cloudGroupMembershipUpdateFailed 3 devo admin group members add or remove: Devolutions Cloud couldn't change the members of the group. Check that your account can manage groups, then try again. See Manage users, groups, and access.
cloudGroupSynchronized 3 The Devolutions Cloud group is synchronized from your organization's directory, so Devolutions CLI can't change or delete it, or change its members. Make the change in your organization's directory.
cloudGroupUpdateFailed 3 devo admin group update: Devolutions Cloud couldn't change the group. Check that your account can manage groups, then try again.
cloudPasswordMutationCanonicalIdRequired 3 devo secret set: changing the password of a Devolutions Cloud entry needs valid vault and entry IDs, and one of them isn't valid. Select the entry by its ID, as shown by devo entry get.
cloudPasswordMutationDecryptionFailed 3 devo secret set: Devolutions CLI couldn't decrypt the Devolutions Cloud entry to change its password. Nothing was changed. Sign in again with devo login, then try again. If it persists, contact support.
cloudPasswordMutationEncryptionFailed 3 devo secret set: Devolutions CLI couldn't encrypt the entry with its new password. Nothing was changed. Try again. If it persists, contact support.
cloudPasswordMutationEntryGetFailed 3 devo secret set: Devolutions CLI couldn't retrieve the Devolutions Cloud entry to change its password. The message may give the HTTP status returned. Check that your account can edit the entry, then try again.
cloudPasswordMutationEntryNotFound 4 devo secret set: Devolutions Cloud says the entry doesn't exist in that vault. Check the entry and its vault with devo entry list.
cloudPasswordMutationEntryUnsupported 3 devo secret set: Devolutions CLI can't change the password of this Devolutions Cloud entry, for example because of its type or because its credentials come from elsewhere. Change the password in Devolutions Cloud. See Update a secret from a script.
cloudPasswordMutationEnvelopeUnsupported 3 devo secret set: the password of the Devolutions Cloud entry is stored in a form that Devolutions CLI can't change. Nothing was changed. Change the password in Devolutions Cloud.
cloudPasswordMutationInputInvalid 3 devo secret set: Devolutions CLI didn't have everything it needs to change the password, such as the protected entry data or its key. Nothing was changed. Try again. If it persists, contact support.
cloudPasswordMutationKeyInvalid 3 devo secret set: the key that protects the password of the entry isn't valid. Nothing was changed. Try again. If it persists, contact support.
cloudPasswordMutationLockFailed 3 devo secret set: Devolutions CLI couldn't lock the Devolutions Cloud entry for editing, for example because someone else is editing it. Nothing was changed. Wait until the entry is no longer being edited, then try again.
cloudPasswordMutationPasswordKeyFailed 3 devo secret set: Devolutions Cloud didn't return the key needed to write the password. Nothing was changed. Check that your account can edit the password of the entry, then try again.
cloudPasswordMutationPutFailed 3 devo secret set: Devolutions Cloud refused to save the entry with its new password. The message may give the HTTP status returned. Check that your account can edit the entry, then try again.
cloudPasswordMutationUnlockFailed 3 devo secret set: the password was changed, but Devolutions CLI couldn't unlock the Devolutions Cloud entry afterward. Check the entry in Devolutions Cloud and unlock it if it's still locked. Don't change the password again.
cloudUserDeleteFailed 3 devo admin user delete: Devolutions Cloud couldn't delete the user. Check that your account can manage users, then try again. See Manage users, groups, and access.
cloudUserGetFailed 1 or 3 Devolutions CLI couldn't retrieve the Devolutions Cloud user before changing or deleting it, or got an answer it couldn't read. Exit code 1 with devo admin user update, 3 with devo admin user delete. Check the user with devo admin user list, then try again.
cloudUserListFailed 3 Devolutions CLI couldn't list the Devolutions Cloud users. Check that your account can view users, then try again.
cloudUserSynchronized 3 The Devolutions Cloud user is synchronized from your organization's directory, so Devolutions CLI can't change or delete it. Make the change in your organization's directory.
cloudUserUpdateFailed 1 devo admin user update: Devolutions Cloud couldn't change the user. The message may give the HTTP status returned. Check that your account can manage users, then try again. See Manage users, groups, and access.
cloudVaultAccessApplicationUnsupported 3 devo vault access list --application: Devolutions CLI can't list the vault access of applications in Devolutions Cloud. Filter with --user or --group instead, or check application access in Devolutions Cloud.
cloudVaultAccessPrincipalUnsupported 3 devo vault access grant or revoke: with Devolutions Cloud, a change applies to exactly one user or one group, not to an application or to everyone at once. Pass one --user or one --group. See Manage users, groups, and access.
cloudVaultCanonicalIdRequired 3 devo vault delete: Devolutions Cloud deletes a vault only by its ID, not by its name. Pass the vault ID with id:<value> or --id, as shown by devo vault list.
cloudVaultCreateFailed 3 devo vault create: Devolutions Cloud couldn't create the vault. Check that your account can create vaults and that the name isn't taken, then try again. See Manage vaults and entries.
cloudVaultDeleteFailed 3 devo vault delete: Devolutions Cloud couldn't delete the vault. Check that your account can delete the vault, then try again.
cloudVaultGetFailed 3 Devolutions CLI couldn't retrieve the Devolutions Cloud vault before changing it or its access (devo vault update, devo vault access grant or revoke). Check the vault with devo vault list, then try again.
cloudVaultListFailed 1 or 3 Devolutions CLI couldn't list the Devolutions Cloud vaults, for example to find a vault by name. Exit code 1 with devo secret commands, 3 with vault and entry commands. Check that your account can view vaults, then try again.
cloudVaultPermissionListFailed 3 devo vault access list: Devolutions CLI couldn't list who has access to the vault. Check that your account can manage the security of the vault, then try again.
cloudVaultPermissionUpdateFailed 3 devo vault access grant or revoke: Devolutions Cloud couldn't change the access to the vault. Check that your account can manage the security of the vault, then try again. See Manage users, groups, and access.
cloudVaultRoleListFailed 1 or 3 Devolutions CLI couldn't fetch the vault roles of Devolutions Cloud. Exit code 1 with devo admin role commands, 3 with devo vault access commands. Check that your account can view roles, then try again.
cloudVaultRoleNotFound 1 or 4 The vault role doesn't exist. With devo admin role get (exit code 1), no vault role has that ID. With devo vault access commands (exit code 4), the --role value matches no role, or an access assignment uses a role that's no longer available. Check the roles with devo admin role list. See Manage users, groups, and access.
cloudVaultUpdateFailed 3 devo vault update: Devolutions Cloud couldn't change the vault. Check that your account can edit the vault, then try again.
documentationEntryNotFound 4 Local profile: the entry given to devo entry documentation update wasn't found. Check the entry ID with devo entry list.
documentationEntryRequired 3 Local profile: a documentation command was run without an entry ID. Pass the entry ID, for example devo entry documentation get <entry-id> --title <title>.
documentationPageNotFound 4 Local profile: no documentation page with that title or ID exists on the entry. Produced by devo entry documentation get and update. List the pages with devo entry documentation list <entry-id> and use a title or page ID from the list.
documentationPageRequired 3 Local profile: no documentation page was given. A page ID or a unique title is required. Pass --title or --page-id.
documentationPageSelectorAmbiguous 3 Local profile: more than one documentation page of the entry has that title. Use the page ID shown by devo entry documentation list <entry-id>.
documentationTitleMustBeUnique 3 Local profile: devo entry documentation update can't rename the page, because the entry already has a page with the new title. Choose another title with --new-title.
documentationTitleRequired 3 Local profile: devo entry documentation update needs a new, non-empty page title. Pass --new-title with a non-empty value. A local profile can only rename pages; it can't change their content.
entryFieldNotFound 4 devo entry field get couldn't find the field on the entry. Check the field name. List the fields of the entry with devo entry get <entry>. See Manage vaults and entries.
entryIdRequired 3 Local profile: an entry update or a command parameter update was sent without an entry ID. Pass the entry name or ID. If you passed one, run devo doctor and contact support.
entryMoveCrossVaultUnsupported 3 Local profile: devo entry move can only move entries within the same vault. Choose a destination folder in the entry's own vault.
entryMoveFolderCycle 3 Local profile: devo entry move was asked to move a folder into itself or into one of its subfolders. Choose a destination outside the folder you're moving.
entryMoveSelectionOverlap 3 Local profile: devo entry move was given a folder and also entries inside that folder. Select either the folder or the entries inside it, not both.
entryMoveSelectorDuplicate 3 Local profile: devo entry move was given the same entry more than once. List each entry only once.
entryNotFound 4 or 1 The entry wasn't found in the selected workspace or vault, for example with devo entry get, update, move, delete, devo secret read, or devo secret shell enter. Exits with 1 with devo secret run. With devo secret get on a local profile, it is reported as sqliteSecretNotFound. Check the entry name or ID with devo entry list, and the selected workspace and vault with devo status. See A secret reference doesn't resolve.
entryParameterNotFound 4 Local profile: devo entry parameter set couldn't find a command parameter with that label on the entry. List the parameters with devo entry parameter list <entry> and use one of their labels or positions.
entryParameterSelectorAmbiguous 3 Local profile: more than one command parameter of the entry has that label. Select the parameter with --position instead of --label.
entryParameterSelectorRequired 3 Local profile: devo entry parameter set needs exactly one parameter, given by position or by label. Pass either --position or --label.
entrySelectorAmbiguous 3 or 1 More than one entry has that name, so Devolutions CLI won't guess which one you mean. Produced by entry commands with Devolutions Cloud, Devolutions Server, and a local profile, and, on a local profile, when reading a secret (exits with 1 with devo secret read and devo secret inject). Use the entry ID instead of its name. Find it with devo entry list.
entrySelectorRequired 3 No entry was given: an entry ID or exact name is required, or, with devo entry move, at least one entry to move. Pass the entry ID or its exact name.
folderAlreadyExists 3 Local profile: a folder already exists at the destination path, or several selected folders would end up at the same path. Produced by devo entry folder rename and devo entry move. Choose another name or destination, or rename or move the existing folder first.
folderNameRequired 3 Local profile: devo entry folder rename needs a non-empty new folder name. Pass a new name.
folderNotFound 4 Local profile: devo entry folder rename couldn't find the folder in the selected vault. Check the folder path with devo entry list and the selected vault with devo vault current.
folderPathRequired 3 Local profile: devo entry folder rename needs the path of the folder to rename. Pass the folder path.
folderSelectorAmbiguous 3 Local profile: the folder path matches more than one entry. Use a folder path that is unique in the vault.
groupNotFound 4 No user group with that name or ID exists in the selected workspace. Produced by devo group commands. Check the name or ID with devo group list. See Manage users, groups, and access.
groupSelectorAmbiguous 3 More than one user group has that name, so a command that changes a group won't guess which one you mean. Pass the group ID with --id. Find it with devo group list.
invalidVariableScope 3 The custom variable scope isn't valid. Produced mainly by devo variable export --scope. Use workspace, vault, user-vault, or option. See Use custom variables.
operationNotSupported 3 The background process refused the operation because the selected workspace can't do it, for example a read that the local profile doesn't provide. The message names the operation or says what to do. Select another workspace type with --context or --source. See A command says the workspace doesn't support it.
operationNotSupportedBySource 1 The selected workspace type can't run this command, or doesn't accept one of its options. For example, a local profile creates RDP entries only, and accepts secret writes to the password field only; Devolutions Cloud groups have no administrator flag. Select another workspace with --context, or drop the option the message names. See A command says the workspace doesn't support it.
principalAmbiguous 3 The user or group given to devo vault access grant or devo vault access revoke matches more than one user or group. Give the user or group by ID. See Roles and vault access.
principalNotFound 4 The user or group given to devo vault access grant or devo vault access revoke wasn't found. Check the name, email, or ID with devo admin user list or devo admin group list. See Roles and vault access.
rawSensitiveValueRejected 2 A password was passed in a way that could expose it: as a plain value with devo entry field set, or as a password value when creating an entry. Use devo secret set with --value-env or --value-file, or give the password of a new entry as a secret reference. See Update a secret from a script.
recursiveScopeAcknowledgementRequired 3 devo entry delete on Devolutions Cloud: deleting an entry also deletes everything under it, and that wasn't acknowledged. Nothing was deleted. The devo mcp delete tool reports the same code when the acknowledgement isn't set. Add --acknowledge-recursive-scope once you're sure. See Delete entries and vaults.
serverEntryDeleteFailed 3 devo entry delete: Devolutions Server couldn't delete the entry. The message gives the reason when the server returns one. Read the message, check that your account may delete the entry, then try again. See Manage vaults and entries.
serverEntryGetFailed 3 Devolutions Server couldn't return the entry, for example with devo entry get. The message gives the reason when the server returns one. Check the entry and vault IDs and that your account can see the entry, then try again.
serverEntryListFailed 3 Devolutions Server couldn't list the entries of the vault, for example with devo entry list. Check the vault and that your account can see it, then try again.
serverEntryUpdateFailed 3 Devolutions Server couldn't update the entry, for example with devo entry update or devo entry field set. Check that your account may change the entry, then try again. See Manage vaults and entries.
serverVaultCreateFailed 3 devo vault create or devo vault create-many: Devolutions Server couldn't create the vault. The message gives the reason when the server returns one. Read the message. Check that the name isn't already used and that your account may create vaults.
serverVaultDeleteFailed 3 devo vault delete: Devolutions Server couldn't delete the vault. Read the message and check that your account may delete the vault, then try again.
serverVaultListFailed 3 Devolutions Server couldn't list the vaults, for example with devo vault list, or while finding a vault by name. Check the sign-in with devo status --online, then try again.
serverVaultUpdateFailed 3 devo vault update: Devolutions Server couldn't rename the vault or change its description. Read the message and check that your account may change the vault, then try again.
smartFolderUnavailable 3 devo entry list --smart-folder: the selected workspace can't evaluate smart folders. Devolutions Cloud and the local profile don't. Filter with --group or --type instead. See Find entries.
unsupportedEntryType 1 devo entry create: the entry type isn't one this workspace can create. Only Group and RDPConfigured entries are accepted. Use --type RDPConfigured (the default) or --type Group, or create the entry in Devolutions Remote Desktop Manager. See Create and update entries.
vaultNotFound 4 or 1 The vault wasn't found, or there's no current vault. Vault, entry, and variable commands and devo secret shell exit with 4. While reading a secret from a local profile (devo secret read, devo secret get, devo secret inject, devo secret run), the code is the same and the exit code is 1. Check the vault name or ID with devo vault list, or select one with devo vault use. See Select the vault you work in and A secret reference doesn't resolve.
vaultSelectorAmbiguous 3 or 1 More than one vault matches the name you gave. devo vault get exits with 3; while reading a secret from a local profile, the exit code is 1. Give the vault by ID. See Select the vault you work in.
workspaceNotFound 4 or 1 The workspace wasn't found, or no current workspace is set in the local profile, for example with devo workspace current or a workspace custom variable. While reading a secret (devo secret read, devo secret get, devo secret inject, devo secret run), the exit code is 1. List the workspaces with devo workspace list and select one with devo workspace use. Check the workspace name in the secret reference. See See and select workspaces.
partialFailure 0 devo vault create-many created some of the vaults, but not all. The result has the status partial, and each vault has its own result. Check which vaults failed and why, then create them again.
vaultCreateFailed 3 devo vault create-many couldn't create any of the vaults. Check the result of each vault for the reason, for example a name that already exists or a missing permission.

## Administration

Errors from `devo admin` commands and other commands that manage users, groups, permissions, and settings in Devolutions Cloud or Devolutions Server.

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
cloudArchivedLogsFailed 1 devo admin logs archived: Devolutions CLI couldn't fetch the archived logs. The message may give the HTTP status returned. Check the date (yyyy-MM-dd) and that your account can view logs. See Review activity logs.
cloudEntryPermissionGetFailed 1 devo entry access get: Devolutions CLI couldn't fetch the role of the user or group on the entry. Check the vault and entry IDs and your access, then try again.
cloudEntryPermissionNotFound 1 devo entry access get: the user or group has no role assigned on the entry. List the assignments with devo entry access list.
cloudEntryPermissionUpdateFailed 1 devo entry access grant or revoke: Devolutions Cloud couldn't change the role on the entry. Check the IDs and that your account can manage the security of the entry, then try again. See Manage users, groups, and access.
cloudEntryRoleGetFailed 1 devo admin role get --scope entry: Devolutions CLI couldn't fetch the entry role. Check the role ID with devo admin role list --scope entry, then try again.
cloudEntryRoleListFailed 1 Devolutions CLI couldn't fetch the entry roles of Devolutions Cloud, for example with devo admin role list --scope entry. The MCP tool that lists security roles can also return it, without an exit code. Check that your account can view roles, then try again.
cloudEntryRoleNotFound 1 devo admin role get --scope entry: no entry role has that ID. Check the role ID with devo admin role list --scope entry.
cloudGatewayDeleteFailed 1 devo admin gateway delete: Devolutions Cloud couldn't delete the gateway. The message may give the HTTP status returned. Check the gateway ID with devo admin gateway list and your permissions, then try again.
cloudGatewayGetFailed 1 devo admin gateway get: Devolutions CLI couldn't fetch the gateway. Check the gateway ID with devo admin gateway list, then try again.
cloudGatewayListFailed 1 devo admin gateway list: Devolutions CLI couldn't fetch the gateways. Check that your account can view gateways, then try again.
cloudGatewaySettingsGetFailed 1 devo admin gateway settings get: Devolutions CLI couldn't fetch the gateway settings. Check that your account can view gateways, then try again.
cloudInvitationDeleteFailed 1 devo admin invitation delete: Devolutions Cloud couldn't delete the invitation. Check the invitation with devo admin invitation list, then try again.
cloudInvitationGetFailed 1 devo admin invitation get: Devolutions CLI couldn't fetch the invitation. Check the invitation with devo admin invitation list, then try again.
cloudInvitationListFailed 1 devo admin invitation list: Devolutions CLI couldn't fetch the invitations. Check that your account can manage invitations, then try again.
cloudInvitationRemoveEmailFailed 1 devo admin invitation remove-email: Devolutions Cloud couldn't remove the email address from the invitation. Check the invitation and the email address, then try again.
cloudOwnerGetFailed 1 devo admin owner get: Devolutions CLI couldn't fetch the owner of the organization. Check that your account can view this information, then try again.
cloudOwnerSetFailed 1 devo admin owner set: Devolutions Cloud couldn't change the owner of the organization. Check the new owner and that your account is allowed to change the owner, then try again.
cloudSettingsGetFailed 1 Devolutions CLI couldn't fetch the system settings of Devolutions Cloud, or couldn't read them. Returned by devo admin settings get and update, and by devo admin access system and system-vault grant and revoke, which read the settings before changing them. Check that your account can manage system settings, then try again.
cloudSettingsUpdateFailed 1 devo admin settings update: Devolutions Cloud couldn't save the system settings. Check the values and that your account can manage system settings, then try again.
cloudSiemLogsFailed 1 devo admin logs siem: Devolutions CLI couldn't fetch the SIEM report logs. Check that your account can view logs, then try again. See Review activity logs.
cloudSsoUpdateFailed 1 devo admin settings update: Devolutions Cloud couldn't change the SSO sign-in setting. The message gives the HTTP status returned. Check the value and that your account can manage system settings, then try again.
cloudSystemPermissionGetFailed 1 devo admin access system get: Devolutions CLI couldn't fetch the system permissions of the user or group. Check the user or group ID, then try again.
cloudSystemPermissionListFailed 1 devo admin access system list or get: Devolutions CLI couldn't fetch the system permissions. Check that your account can manage system permissions, then try again.
cloudSystemPermissionUpdateFailed 1 devo admin access system grant or revoke: Devolutions Cloud couldn't change the system permissions. Check the permission names and that your account can manage system permissions, then try again. See Manage users, groups, and access.
cloudSystemVaultPermissionGetFailed 1 devo admin access system-vault get: Devolutions CLI couldn't fetch the system vault role of the user or group. Check the user or group ID, then try again.
cloudSystemVaultPermissionListFailed 1 devo admin access system-vault list or get: Devolutions CLI couldn't fetch the system vault roles. Check that your account can manage system permissions, then try again.
cloudSystemVaultPermissionUpdateFailed 1 devo admin access system-vault grant or revoke: Devolutions Cloud couldn't change the system vault role. Check the role and that your account can manage system permissions, then try again.
cloudVaultRoleGetFailed 1 devo admin role get: Devolutions CLI couldn't fetch the vault role. Check the role ID with devo admin role list, then try again.
invalidOperation Depends on the command The change isn't allowed. devo admin settings auth-modes set (exit code 2): at least one primary authentication mode must stay enabled on Devolutions Server. devo admin user update (exit code 1): a Devolutions Cloud user synchronized from your organization directory can't be changed. devo admin group delete (exit code 3): a synchronized Devolutions Cloud group can't be deleted. Keep at least one authentication mode enabled. Change synchronized users and groups in your organization directory instead. See Manage users, groups, and access.
serverAuthModesFailed 1 devo admin settings auth-modes get or set: Devolutions Server didn't return its authentication modes. Check that your account is a Devolutions Server administrator, then try again. See Manage users, groups, and access.
serverAuthModesUpdateFailed 1 devo admin settings auth-modes set: Devolutions Server didn't save the authentication modes. Read the message, check your administrator rights, then try again.
serverCacheResetFailed 1 devo admin cache reset: Devolutions Server didn't reset the caches. Read the message, check your administrator rights, then try again.
serverDomainListFailed 1 devo admin domain list: Devolutions Server didn't return its Active Directory domains. Check your administrator rights, then try again.
serverDomainUserListFailed 1 devo admin domain users: Devolutions Server didn't return the users of the Active Directory domain. Check the --domain name with devo admin domain list, then try again.
serverGatewayRevocationPublishFailed 1 devo admin gateway revocation-list publish: Devolutions Server didn't publish the revocation lists. Check the --gateway-id value and your administrator rights, then try again.
serverLicenseListFailed 1 devo admin license list: Devolutions Server didn't return its licenses. Check your administrator rights, then try again.
serverLicenseSaveFailed 1 devo admin license register: Devolutions Server didn't register the license. Read the message and check the license serial or JWT, then try again.
serverLicenseUserAssignmentsFailed 1 devo admin license users list: Devolutions Server didn't return the users assigned to the license. Check the license serial, then try again.
serverLogsFailed 1 devo admin logs activity, administration, login-attempts, pam, or rotation: Devolutions Server didn't return the logs. Check the filters and your rights, then try again. See Review activity logs.
serverPamAccountListFailed 1 devo admin pam account list: Devolutions Server didn't return the privileged accounts. Check the vault ID and your rights, then try again.
serverPamProviderGetFailed 1 devo admin pam provider get: Devolutions Server didn't return the privileged access provider. Check the provider ID with devo admin pam provider list, then try again.
serverPamProviderListFailed 1 devo admin pam provider list: Devolutions Server didn't return the privileged access providers. Check your rights, then try again.
serverPermissionSetListFailed 3 devo admin access permission-sets: Devolutions Server didn't return the permission sets. Check your rights, then try again.
serverTrialStartFailed 1 devo admin license trial start: Devolutions Server didn't start the trial license. Read the message, then try again.
serverTwoFactorConfigurationFailed 1 devo admin settings two-factor get or devo admin user 2fa set: Devolutions Server didn't return its two-factor authentication configuration. Check your administrator rights, then try again.
serverTwoFactorSaveFailed 1 devo admin user 2fa set or clear: Devolutions Server didn't save the user's two-factor authentication. Read the message, check the user and the --type, then try again. See Manage users, groups, and access.
serverUserCanonicalIdRequired 3 devo admin user delete on Devolutions Server: the user must be given by its ID, and the value isn't a valid user ID. Pass the user's name, or its exact ID with id:<value> or --id. Find the ID with devo admin user list.
serverUserCreateFailed 1 devo admin user create: Devolutions Server didn't create the user. Read the message. Check that the username isn't already used and that the password meets the server's rules.
serverUserDeleteFailed 3 devo admin user delete: Devolutions Server didn't delete the user. Read the message and check your administrator rights, then try again.
serverUserGetFailed 1 or 3 Devolutions Server didn't return the user that the command works on. The exit code is 1 with devo admin user update and 3 with devo admin user delete. Check the user with devo admin user list, then try again.
serverUserListFailed 3 Devolutions Server didn't return its users, for example with devo admin user list, or while finding a user by name. Check your rights, then try again.
serverUserPurgeFailed 1 devo admin user trash purge: Devolutions Server didn't permanently delete the user. Check the ID with devo admin user trash list, then try again.
serverUserRestoreFailed 1 devo admin user trash restore: Devolutions Server didn't restore the user. Check the ID with devo admin user trash list, then try again.
serverUserTrashListFailed 1 devo admin user trash list: Devolutions Server didn't return the deleted users. Check your administrator rights, then try again.
serverUserUpdateFailed 1 devo admin user update: Devolutions Server didn't save the changes to the user. Read the message, check the values you passed, then try again.
userNotFound 4 The user wasn't found, for example with devo admin user get, update, delete, or groups. Check the name, email, or ID with devo admin user list. See Users.
userSelectorAmbiguous 3 More than one user has the name you gave, so Devolutions CLI won't guess which one to change. Give the user by ID with --id. See Users.

## MCP

Errors returned by the MCP tools of Devolutions CLI. They are returned in the tool result, so they have no exit code. See [Connect an AI client with MCP](/cli/guides/ai-agents/connect-mcp.md).

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
runtimeUnavailable — Returned by an MCP tool: no background process is available to run the tool. The MCP server keeps running. Run devo daemon status, start or restart the background process with devo daemon restart, then call the tool again. See The background process won't start.
daemonOperationFailed An MCP tool that controls the background process failed. It's returned to the AI client as the tool result, not as an exit code. Run devo daemon status, then devo daemon restart. See The background process won't start.

## Background process

Errors from the background process that keeps your workspaces loaded. See [The background process won't start](/cli/help/troubleshooting/daemon-wont-start.md).

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
automationSessionNotInitialized 3 The background process received the command before it finished loading the local profile. Run the command again. If it keeps failing, run devo daemon restart. See The background process won't start.
invalidRequest 3 The background process received a request it couldn't read. Restart the background process with devo daemon restart and run the command again. If it persists, see Collect diagnostics for support.
daemonTimeout 3 The background process didn't answer in time, or the request was cancelled without an interruption from you. Run devo daemon status, then devo daemon restart, and run the command again. See The background process won't start.
invalidSubmittedSecret 3 A password or passphrase that Devolutions CLI passed to the background process arrived in an unreadable form. Run the command again. If it keeps failing, run devo daemon restart, then collect diagnostics for support. See Collect diagnostics for support.
daemonRequestFailed — A request to the background process failed because the connection broke. Reported by MCP tools, and for one session in the output of devo daemon sessions, which still succeeds. Run devo daemon status, then devo daemon restart. See The background process won't start.
providerSelectionChanged 3 or 1 The workspace selected for this command isn't the one the background process was started with, for example after devo context use or with --source. With Devolutions Cloud, it can also mean that the reference names another workspace than the selected context. Exit code 3 with workspace, vault, and entry commands; 1 with devo secret commands. Run the command again, or run devo daemon restart. For a reference, check that its workspace matches the selected context. See Use the right context.
headlessBootstrapFailed Depends on the command The background process couldn't load the local Devolutions Remote Desktop Manager profile, and no more precise reason was returned. Usually 3; 1 with devo secret commands and devo config unlock. Run devo daemon restart. If it keeps failing, run devo doctor and see The background process won't start.
missingSubmittedSecret 3 A password or passphrase that the command needed, such as a user password, a workspace passphrase, or an entry password, didn't reach the background process. Run the command again. If it keeps failing, run devo daemon restart, then collect diagnostics for support. See Collect diagnostics for support.
daemonIoError 3 The connection to the background process broke while the command was running. Run devo daemon status, then devo daemon restart, and run the command again. See The background process won't start.
ipcHandlerError 3 The background process hit an unexpected error while processing the command. Run devo daemon restart and try again. If it persists, run devo doctor and contact support. See The background process won't start.
daemonUnavailable 3 The background process couldn't be reached or isn't running, or it was turned off with --daemon never for a command that needs it. devo daemon sessions also shows it for a session that can't be reached, and the MCP tool that reloads the runtime returns it when no background process is registered. Run devo daemon status, then devo daemon start or devo daemon restart. Don't use --daemon never with this command. See The background process won't start.
methodNotFound 3 The background process doesn't know the request it received, for example because it was started by another version of Devolutions CLI. Run devo daemon restart, so the background process matches the devo you run.
daemonRequestTimedOut — The background process didn't answer in time. Reported by MCP tools, and for one session in the output of devo daemon sessions, which still succeeds. Run devo daemon status, then devo daemon restart. See The background process won't start.
unauthorized 3 The background process refused the request: the access token Devolutions CLI uses to talk to it is missing or invalid, for example after the background process was restarted from another session. When Devolutions CLI is allowed to start the background process, it retries on its own and you don't see this code. Run devo daemon restart, then the command again. See The background process won't start.
headlessBootstrapNotImplemented Depends on the command The background process is running, but no local profile is loaded. It shows in devo daemon status, and as the code of commands that need the profile: usually 3, 1 with devo secret commands. Check the profile folder with devo config path, select a workspace, then run devo daemon restart. See Use a local Devolutions Remote Desktop Manager profile.
daemonConfigRootMismatch 3 The running background process serves a different Devolutions Remote Desktop Manager profile folder than the one this command selects, for example after you changed RDM_CONFIG_PATH. Run devo daemon restart so the background process uses the selected folder. See The background process won't start.
daemonRequestCanceled — A request to the background process was cancelled. Reported by MCP tools. Run the tool again.

## Configuration and diagnostics

Errors from `devo config`, `devo doctor`, and related commands.

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
configRootUnavailable 1 devo config path couldn't work out which Devolutions Remote Desktop Manager configuration folder to use. Check the RDM_CONFIG_PATH environment variable, see Environment variables. If it persists, run devo doctor.

## Other

Errors that any command can return.

ERROR CODE EXIT CODE WHAT IT MEANS WHAT TO DO
directoryNotFound 2, 1, or 4 The folder of the output file given with --out-file doesn't exist. The exit code depends on the command: 2 with devo config export, devo daemon profile start, and devo generate ssh-key; 1 with devo secret read, devo secret inject, and devo secret get; 4 with devo variable export and devo logs export. Create the folder first, or give a path in an existing folder.
fileNotFound 2 devo generate ssh-key: the file given with --passphrase-file doesn't exist. Check the path. See Generate passwords and SSH keys.
environmentVariableMissing 2 devo generate ssh-key --passphrase-env names an environment variable that isn't set or is empty. Set the variable in the same shell, or use --passphrase-file. See Generate passwords and SSH keys.
unexpectedError 1 An error Devolutions CLI didn't expect. The message gives the details. Run devo doctor and contact support. See Collect diagnostics for support.
emptySecret 2 The file given with devo generate ssh-key --passphrase-file is empty. Write the passphrase in the file, or leave out the option to create a key without a passphrase.
fileExists 2 or 1 The output file already exists, and Devolutions CLI doesn't overwrite files unless asked. Exits with 2 with devo config export, devo daemon profile start, and devo generate ssh-key, and with 1 with devo secret read, devo secret inject, devo secret get, devo variable export, and devo logs export. Pass --force to overwrite the file, or choose another path. With the MCP tool that exports activity logs, set its force argument.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/error-codes.md?ask=&goal=
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`confirmationRequired`	2	The command changes or deletes something and wasn't confirmed. Produced by most commands that change something, for example `devo vault create`, `devo context delete` on a sign-in context, `devo config export`, `devo config unlock`, `devo daemon profile start`, and the `devo admin` commands that change settings. MCP tools that change something return it too when the confirmation argument isn't set.	Add `--yes` once you're sure. With an MCP tool, set its confirmation argument.
`missingParameter`	2	A value the command needs is missing, for example a name, a user name with credential sign-in, a vault for a new entry, or a file to attach. Many commands produce it.	Read the message: it names what's missing. Add it and run the command again. Check the options with `devo <command> --help`.
`invalidParameterValue`	2	A value given to an option or argument isn't allowed, for example a date filter, a `true`/`false` option, a host port that isn't a number, or a field that the command can't change. Many commands produce it. Exception: with `devo secret read` and `devo secret get`, an `--out-file` that points to a folder exits with `1`.	Read the message: it names the option and the allowed values. Check them with `devo <command> --help`. See Commands.
`usageError`	2	The command line is invalid: unknown command or option, missing argument, or a value the option doesn't accept. Nothing was done. In text output, Devolutions CLI writes the problem and the help of the command instead of this code; the code appears in JSON and YAML output.	Check the spelling with `devo <command> --help`. See Commands.
`conflictingOptions`	2	Two options that can't be used together were given, or more than one option was given where only one is allowed. Examples: `--json` and `--yaml`, `--quiet` and `--verbose`, `--password-env` and `--password-file`, `--position` and `--label`, `--user`, `--group`, and `--application`, `--cloud` and `--server`, a context name and a URL, or several sign-in modes with `devo login`. Also returned when a context with the same name already exists. MCP tools return it for conflicting arguments.	Read the message: it names the options. Keep one of them. To overwrite an existing context, use the option the message suggests. See Global options.
`mutationConfirmationRequired`	2	A change to Devolutions Cloud, Devolutions Server, or a local profile wasn't confirmed, for example creating or deleting a group, deleting a user, changing vault access, updating a user, or deleting a vault. Nothing was changed.	Add `--yes` once you're sure. An AI agent connected through `devo mcp` must set the confirmation explicitly.
`invalidSource`	2 or 1	The workspace type to use isn't valid. With an invalid `--source` value, the command stops before it starts and exits with `2`. With an invalid `DEVO_RDM_SOURCE` environment variable, the commands that select a workspace exit with `1`. `devo secretspec` also reports it, with exit code `2`.	Use `sqlite`, `cloud`, `cloud:<context>`, `server`, or `server:<context>`. Check `DEVO_RDM_SOURCE` if you didn't pass `--source`. See Global options and Environment variables.
`usageSuggestion`	2	Not an error on its own: it comes with `usageError` in JSON and YAML output, and its message is a correction Devolutions CLI suggests, such as the command or option you probably meant.	Run the suggested command if it's what you meant.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`cloudAuthenticationFailed`	1 or 3	Devolutions Cloud refused the sign-in of the context: the application key or application secret is invalid, the application was denied, or your account's key couldn't open the protected data of the organization. Exit code `1` with `devo login`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Check the application key and secret, then sign in again with `devo login <name> --cloud <url>`. See Sign-in fails or the session expired.
`cloudAuthenticationRequired`	1 or 3	The Devolutions Cloud context has no usable sign-in: you didn't sign in, or the context has no application key. Exit code `1` with `devo admin` and `devo secret` commands, `3` with vault, entry, user, and group commands.	Sign in again with `devo login <name> --cloud <url>`. See Sign in to Devolutions Cloud.
`cloudContextNotFound`	1 or 4	No Devolutions Cloud context has that name, or no Devolutions Cloud context is the current one. Exit code `1` with `devo admin` and `devo secret` commands, `4` with vault, entry, user, and group commands.	Check the name with `devo context list`, or sign in with `devo login <name> --cloud <url>`. See Sign-in fails or the session expired.
`cloudHealthFailed`	1 or 3	Devolutions CLI couldn't get the health information of the Devolutions Cloud instance. It checks it with `devo info` and at each sign-in. The message may give the HTTP status returned. Exit code `1` with `devo info`, `devo login`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Check the Devolutions Cloud URL of the context and your network connection. See Use Devolutions CLI behind a firewall or proxy.
`cloudLoginFailed`	1 or 3	Devolutions Cloud refused the sign-in request. The message may give the HTTP status returned. Exit code `1` with `devo login`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Check your credentials and sign in again with `devo login`. See Sign-in fails or the session expired.
`cloudOAuthAccountKeyMissing`	1 or 3	The Devolutions Cloud session has no account key, so it can't open vault data. A sign-in with `--use-device-code` never gets one. Exit code `1` with `devo secret` commands, `3` with vault and entry commands.	Sign in again with `devo login <name> --cloud <url> --oauth`, without `--use-device-code`. See Sign in to Devolutions Cloud.
`cloudOAuthAuthorizationExpired`	1	`devo login --oauth`: the sign-in wasn't completed in the browser or with the device code before it expired.	Run `devo login` again and complete the sign-in sooner.
`cloudOAuthAuthorizationFailed`	1	`devo login --oauth`: Devolutions Account didn't authorize the session, for example because the sign-in was declined, or it couldn't start the device-code sign-in.	Run `devo login` again and accept the request. See Sign-in fails or the session expired.
`cloudOAuthDiscoveryFailed`	1 or 3	Devolutions CLI couldn't find the sign-in endpoints of Devolutions Account, while signing in with `--oauth` or while renewing the session. Exit code `1` with `devo login`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Check your network connection and try again. See Use Devolutions CLI behind a firewall or proxy.
`cloudOAuthInvalidResponse`	1 or 3	Devolutions Account returned an answer that Devolutions CLI couldn't read, while signing in with `--oauth` or while renewing the session. Exit code `1` with `devo login`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Try again. If it persists, check whether a proxy changes the traffic, and contact support. See Collect diagnostics for support.
`cloudOAuthLoopbackUnavailable`	1	`devo login --oauth`: Devolutions CLI couldn't start the local listener that receives the browser redirect, for example because no local port in its range is free.	Close what uses those local ports and try again. `--use-device-code` avoids the redirect, but its session has no account key and can't open vault data.
`cloudOAuthLoopbackUnsupported`	1	`devo login --oauth`: Devolutions Account doesn't offer the browser sign-in.	Add `--use-device-code`, as the message says. Its session has no account key and can't open vault data: to read secrets, sign in with an application key instead.
`cloudOAuthRefreshBusy`	1 or 3	Another `devo` process was still renewing the Devolutions Cloud session after 60 seconds. Exit code `1` with `devo admin` and `devo secret` commands, `3` with vault, entry, user, and group commands.	Wait for the other process to finish, then run the command again.
`cloudOAuthRefreshFailed`	1 or 3	The Devolutions Cloud session expired and couldn't be renewed. Exit code `1` with `devo admin` and `devo secret` commands, `3` with vault, entry, user, and group commands.	Sign in again with `devo login <name> --cloud <url> --oauth`. See Sign-in fails or the session expired.
`cloudOAuthSecureStoreRequired`	1 or 3	Signing in to Devolutions Cloud with `--oauth` needs a secure store of the operating system, and none is available. Exit code `1` with `devo login`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Make the secure store of the operating system available, or sign in with an application key instead. See Sign in to Devolutions Cloud.
`cloudOAuthSessionExpired`	1 or 3	The Devolutions Cloud session expired and can't be renewed. Exit code `1` with `devo admin` and `devo secret` commands, `3` with vault, entry, user, and group commands.	Sign in again with `devo login <name> --cloud <url> --oauth`. See Sign-in fails or the session expired.
`cloudOAuthSessionInvalid`	1 or 3	The Devolutions Cloud session stored in the secure store of the operating system is invalid. Exit code `1` with `devo admin` and `devo secret` commands, `3` with vault, entry, user, and group commands.	Sign in again with `devo login <name> --cloud <url> --oauth`.
`cloudOAuthSessionMissing`	1 or 3	The Devolutions Cloud session of the context isn't in the secure store of the operating system anymore. Exit code `1` with `devo admin` and `devo secret` commands, `3` with vault, entry, user, and group commands.	Sign in again with `devo login <name> --cloud <url> --oauth`.
`cloudOAuthStorageFailed`	1 or 3	Devolutions CLI couldn't read, store, or remove the Devolutions Cloud session in the secure store of the operating system. Exit code `1` with `devo login`, `devo logout`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Check that the secure store of the operating system is unlocked and reachable, then try again. See Collect diagnostics for support.
`cloudOAuthUserInfoFailed`	1	`devo login --oauth`: Devolutions CLI couldn't fetch your Devolutions Account profile after the sign-in.	Run `devo login` again.
`cloudPreLoginFailed`	1 or 3	The first step of the sign-in to Devolutions Cloud failed. The message may give the HTTP status returned. Exit code `1` with `devo login`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Check the Devolutions Cloud URL and your network connection, then try again. See Sign-in fails or the session expired.
`cloudRequestTimeout`	1 or 3	Devolutions Cloud or Devolutions Account didn't answer in time. Exit code `1` with `devo login`, `devo info`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Check your network connection and try again. The timeout of a context is set with `devo login --timeout`, from 3 to 600 seconds. See Use Devolutions CLI behind a firewall or proxy.
`cloudUnavailable`	1 or 3	Devolutions CLI couldn't reach Devolutions Cloud or the Devolutions Account service. Exit code `1` with `devo login`, `devo info`, `devo admin`, and `devo secret` commands, `3` with vault, entry, user, and group commands.	Check the URL of the context, your network connection, and your proxy settings. See Use Devolutions CLI behind a firewall or proxy.
`contextAmbiguous`	1	The context name exists for more than one workspace type, for example as a Devolutions Cloud context and as a local profile context, so Devolutions CLI can't tell which one you mean. Produced by `devo context use`, `inspect`, `delete`, and `devo logout`.	Delete one of them with `devo context delete <name> --kind <kind>`, as the message shows, or pass `--kind`. See Switch between workspaces.
`contextKindMismatch`	1	The selected context is the wrong type for this command: for example a local profile context given to a command that works only with Devolutions Cloud or Devolutions Server, or `devo logout` on a local profile context, which has no sign-in.	Select a context of the type the message names with `--context`. Check the types with `devo context list`. See Switch between workspaces.
`contextNotFound`	1	No context has that name, no context name was given, or no current context is set. Produced by `devo context use`, `inspect`, `delete`, and `devo logout`. A name given with the global `--context` option that doesn't exist is reported as `unexpectedError` with the message "Context '<name>' was not found."	Check the names with `devo context list`. Sign in again with `devo login` if the context was deleted. See Switch between workspaces.
`contextSelectionConflict`	1 or 2	The context given as an argument and the one given with `--context` are different. Exits with `2` with `devo secret set` on Devolutions Server, and `1` with the commands that work only with Devolutions Cloud or Devolutions Server.	Give the context only once, or make both values name the same context.
`secretReferenceUnavailable`	Depends on the command	A sign-in secret saved in the context points at an environment variable that isn't set for the background process, or at a file it can't read. Usually `3`; `1` with `devo secret` commands.	Set the variable before the background process starts, then run `devo daemon restart`, or fix the file. See Sign-in fails or the session expired.
`serverAuthenticationFailed`	1 or 3	Devolutions Server rejected the sign-in, or refused a request with an authorization error. With `devo login`, the username and password, the API key, or the OAuth session weren't accepted. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Check the credentials or the API key, then sign in again with `devo login <name> --server <url>`. Check that the account still exists and is enabled. See Sign-in fails or the session expired.
`serverAuthenticationRequired`	1 or 3	The selected Devolutions Server context has no stored sign-in, for example after `devo logout`. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Sign in with `devo login <name> --server <url>`. See Sign in to Devolutions Server.
`serverContextNotFound`	1 or 4	No Devolutions Server context has that name, or no current Devolutions Server context is set. The exit code is 4 with the vault, entry, and user commands that run in the background process, and 1 with `devo logout`, `devo info --private`, `devo secret set`, and the `devo admin` commands of Devolutions Server.	Check the name with `devo context list`, or create the context with `devo login <name> --server <url>`. See Sign-in fails or the session expired.
`serverInvalidResponse`	1 or 3	Devolutions Server returned an answer that Devolutions CLI couldn't read, such as invalid JSON. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Check that the URL points at Devolutions Server and not at a proxy or a sign-in page, then try again. If it persists, run `devo doctor` and contact support. See Collect diagnostics for support.
`serverLogoutFailed`	1	`devo login` with a username and password: Devolutions Server accepted the credentials, but the session Devolutions CLI opened to check them couldn't be closed. The context isn't saved.	Run `devo login` again. If it persists, check the state of Devolutions Server.
`serverOAuthAuthorizationExpired`	1	`devo login --oauth`: the browser or device code sign-in wasn't completed in time.	Run `devo login` again and finish the sign-in sooner. See Sign-in fails or the session expired.
`serverOAuthAuthorizationFailed`	1	`devo login --oauth`: Devolutions Server didn't authorize the session, couldn't start the device code sign-in, or refused to issue the session.	Run `devo login` again and approve the sign-in. Check that the account may sign in with OAuth on this Devolutions Server. See Sign in to Devolutions Server.
`serverOAuthDiscoveryFailed`	1 or 3	Devolutions CLI couldn't find the OAuth sign-in addresses of Devolutions Server, at sign-in or when it renews the session. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Check the Devolutions Server URL and that OAuth sign-in is available on it. Otherwise, sign in with another method. See Sign in to Devolutions Server.
`serverOAuthInvalidResponse`	1 or 3	Devolutions Server returned an OAuth answer that Devolutions CLI couldn't use, at sign-in or when it renews the session. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Try again. Check that the URL points at Devolutions Server and not at a proxy. If it persists, sign in with another method and contact support.
`serverOAuthLoopbackUnavailable`	1	`devo login --oauth`: Devolutions CLI couldn't start the local listener that receives the browser's answer.	Try again, or add `--use-device-code`. See Sign-in fails or the session expired.
`serverOAuthLoopbackUnsupported`	1	`devo login --oauth`: Devolutions Server doesn't offer the browser sign-in.	Add `--use-device-code` to `devo login`. See Sign-in fails or the session expired.
`serverOAuthRefreshBusy`	1 or 3	Another `devo` process has been renewing the same Devolutions Server OAuth session for more than 60 seconds. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Wait for the other command to finish, then try again.
`serverOAuthRefreshFailed`	1 or 3	The Devolutions Server OAuth session expired and couldn't be renewed. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Sign in again with `devo login <name> --server <url> --oauth`. See Sign-in fails or the session expired.
`serverOAuthSecureStoreRequired`	1 or 3	Devolutions Server OAuth sign-in needs the secure store of the operating system, and none is available on this computer. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Make the operating system's secure store available to your user account, or sign in with another method, such as an API key. See Sign in to Devolutions Server.
`serverOAuthSessionInvalid`	1 or 3	The stored Devolutions Server OAuth session is invalid or unreadable. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Sign in again with `devo login <name> --server <url> --oauth`. See Sign-in fails or the session expired.
`serverOAuthSessionMissing`	1 or 3	The context uses OAuth, but no Devolutions Server OAuth session is stored for it on this computer. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Sign in again with `devo login <name> --server <url> --oauth`. See Sign-in fails or the session expired.
`serverOAuthStorageFailed`	1 or 3	The Devolutions Server OAuth session couldn't be saved, read, or removed in the operating system's secure store, for example with `devo login` or `devo logout`. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Check that the secure store of your user account is unlocked and working, then try again.
`serverPrivateInformationFailed`	1	`devo info --private`: Devolutions Server didn't return its private information.	Check that the context is signed in and that the account may see this information, then try again.
`serverPublicInformationFailed`	1 or 3	Devolutions Server didn't return its public information, which Devolutions CLI reads with `devo info`, at sign-in and before some requests. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Check the Devolutions Server URL and that the server is running, then try again.
`serverRequestFailed`	1 or 3	A request to Devolutions Server failed. The message gives the HTTP status that Devolutions Server returned, or the cause. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Read the message. Check the URL and that the item exists, then try again.
`serverRequestTimeout`	1 or 3	Devolutions Server didn't answer in time. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Check that you can reach the server from this computer, for example through a VPN or a proxy. If the server is slow, raise `--timeout` of `devo login`. See Sign-in fails or the session expired.
`serverUnavailable`	1 or 3	Devolutions CLI couldn't reach Devolutions Server. The exit code is 3 with the vault, entry, and user commands that run in the background process, and 1 with the other commands.	Check the URL, the network, the VPN, or the proxy, and that the server is running. See Network and proxy.
`windowsAuthenticationUnsupported`	1 or 3	The Devolutions Server context uses Windows authentication (`--windows-auth`), which works only on Windows, and the command runs on another operating system. `devo admin` commands exit with `1`; vault and entry commands exit with `3`.	Run the command on Windows, or sign in again with `devo login` using a user name and password or an application key. See Sign in to Devolutions Server.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`cloudEncryptedEntryGetFailed`	1 or 3	Devolutions CLI couldn't retrieve a Devolutions Cloud entry to read one of its fields. The message may give the HTTP status returned. Exit code `1` with `devo secret` commands, `3` with entry commands.	Check that your account can access the entry, then try again. See A secret reference doesn't resolve.
`cloudEncryptedEntryUnavailable`	1 or 3	The Devolutions Cloud entry holds no protected connection data, so it has no secret field to read. Exit code `1` with `devo secret` commands, `3` with entry commands.	Check that the reference points at the right entry. See A secret reference doesn't resolve.
`cloudEntryDecryptionFailed`	1 or 3	Devolutions CLI couldn't decrypt the Devolutions Cloud entry. Exit code `1` with `devo secret` commands, `3` with entry commands.	Sign in again with `devo login`, then try again. If it persists, contact support. See Collect diagnostics for support.
`cloudEntryKeyFailed`	1	Devolutions CLI couldn't get the key needed to decrypt the requested field of a Devolutions Cloud entry.	Check that your account is allowed to view the secrets of the entry, then try again.
`cloudEntryPasswordKeyFailed`	1	Devolutions Cloud didn't return the key that protects the password of the entry. The message may give the HTTP status returned.	Check that your account is allowed to view the password of the entry, then try again.
`cloudEntrySensitiveKeyFailed`	1	Devolutions Cloud didn't return the key that protects the sensitive fields of the entry. The message may give the HTTP status returned.	Check that your account is allowed to view the secrets of the entry, then try again.
`cloudSecretFieldNotSupported`	1	Devolutions CLI can't read that field from a Devolutions Cloud entry.	Use a field the entry exposes: `devo entry references <entry>` lists them. See Secret reference syntax.
`cloudSecretFieldUnavailable`	1	The Devolutions Cloud entry has no value for the requested field, even after following the credentials it's linked to.	Check the field name, or set a value on the entry. See A secret reference doesn't resolve.
`cloudSecretNotFound`	1 or 4	Devolutions Cloud says the entry doesn't exist in that vault, or your account can't see it. Exit code `1` with `devo secret` commands, `4` with entry commands.	Check the vault and entry of the reference with `devo entry list`. See A secret reference doesn't resolve.
`cloudSecretResolutionFailed`	1	Devolutions CLI couldn't read the requested field of a Devolutions Cloud entry, without a more precise reason.	Try again. If it persists, run `devo doctor` and contact support. See Collect diagnostics for support.
`cloudVaultSelectionRequired`	1 or 3	No vault was given and no vault is the current one, so entries can't be read. This code is also returned for a Devolutions Server workspace. Exit code `1` with `devo secret` commands, `3` with entry commands.	Name the vault in the reference or with `--vault-name` or `--vault-id`, or set the current vault with `devo vault use <vault>`.
`customFieldSelectorAmbiguous`	1	Local profile: the custom field named in the reference matches more than one custom field of the entry. Produced when reading a secret, for example with `devo secret read` or `devo secret inject`.	Rename the custom fields in Devolutions Remote Desktop Manager so each name is unique, then read the field again. See A secret reference doesn't resolve.
`inputReadFailed`	1	`devo secret inject` couldn't read the file given with `--in-file`, for example because of permissions.	Check that the file exists and that you can read it. See Fill a configuration file from a template.
`invalidConnectionData`	1	Local profile: the entry's stored data couldn't be read, so its secret can't be returned. The message says the entry contains unsupported connection data. Produced when reading a secret, for example with `devo secret read` or `devo secret inject`.	Open the entry in Devolutions Remote Desktop Manager to check it, or use another entry. If it persists, run `devo doctor` and contact support. See Collect diagnostics for support.
`invalidSecretReference`	2 or 1	The `devo://` reference isn't written correctly; the message says what's wrong. With Devolutions Server, a named reference that leads to an entry without a vault and entry ID also gives this error. It can also mean that a sign-in secret saved in a context doesn't start with `env:` or `file:`. Exit code `2` with `devo secret read`, `devo secret get`, and `devo secret shell`; `1` with `devo secret inject` and `devo secret run --check`.	Fix the reference using the messages in Secret reference syntax. To get a correct reference, run `devo entry references <entry>`. See A secret reference doesn't resolve.
`missingSecretReferenceVariable`	1 or 2	A reference in a template or an environment file uses an environment variable that isn't set or is empty, or a `${…}` expression is invalid or isn't closed with `}`. Exit code `1` with `devo secret inject`; `2` with `devo secret run --env-file`.	Set the variable, or give it a default with `${NAME:-default}`. See References inside a text and Set the variables the reference uses.
`outputWriteFailed`	1	The file given with `--out-file` couldn't be written, for example because of permissions or because it's in use. Commands: `devo secret read`, `devo secret get`, `devo secret inject`.	Check that you can write to the folder and that no other program holds the file, then run the command again.
`secretFieldNotFound`	4 or 1	The entry exists, but it doesn't have the field the reference names. Exit code `4` with `devo secret read`, `devo secret get`, and `devo secret shell enter`; `1` with `devo secret inject` and `devo secret run`.	List the entry's fields with `devo entry references <entry>` and use one of them. See Check that the entry and the field exist.
`secretFieldRequiresRuntimeDecryption`	1	On a local profile, the field is encrypted and Devolutions CLI can't decrypt it.	Read the value in Devolutions Remote Desktop Manager, or use a field that isn't encrypted. See Protected profiles and entries.
`secretFieldUnsupported`	1	The local profile can't read the field the reference names. An entry protected by a shared passphrase returns the `password` field only.	Use a field the workspace can read. See Use a field the workspace can read and Protected profiles and entries.
`secretReadFailed`	1	The secret couldn't be read, and no more precise error was returned. Commands: `devo secret read`, `devo secret get`, `devo secret inject`, `devo secret run`.	Run the command again. If it keeps failing, check the reference with `devo secret run --check` and see A secret reference doesn't resolve.
`secretSectionUnsupported`	1	On a local profile, the reference names a section that Devolutions CLI can't read. The message is "The requested secret field is not supported."	Remove the section, or use `connection` or `credentials`. To get a correct reference, run `devo entry references <entry>`.
`secretTextOutputRequired`	2	`devo secret get` with `--passphrase-env` or `--passphrase-file` was asked for JSON or YAML output without `--out-file`. This read writes the value as plain text only.	Remove `--json`, `--yaml`, or `--output`, or add `--out-file`.
`sensitiveAuditMetadataRequired`	3 or 1	Reading this secret value requires audit information, such as a comment and a ticket number, that wasn't provided.	Read the value in Devolutions Remote Desktop Manager, where you can give the comment and ticket number.
`sensitiveInputPermissionsInvalid`	1 or 2	The file that holds the secret value or passphrase can be read by other users. On Windows, only its owner and trusted system accounts may access it; on Linux and macOS, only its owner. Same commands and exit codes as `sensitiveInputUnavailable`.	Restrict the file's permissions, for example with `chmod 600 <file>` on Linux or macOS. See Local profiles: the workspace passphrase.
`sensitiveInputTooLarge`	1 or 2	The secret value or passphrase read from the variable or the file is larger than Devolutions CLI accepts. Same commands and exit codes as `sensitiveInputUnavailable`.	Check that the variable or the file holds only the value, not a whole document.
`sensitiveInputUnavailable`	1 or 2	A secret value or passphrase given with an `--…-env` or `--…-file` option couldn't be read: the environment variable isn't set, or the file doesn't exist, isn't a regular file, or can't be read. Exit code `1` on a local profile, for example with `devo secret set` or `devo secret get --passphrase-file`; `2` with `devo secret set` on Devolutions Server.	Check the variable name or the file path, and that the variable is set in the same shell. See Update a secret from a script.
`sensitiveResolutionRequestInvalid`	1	The request to read a secret value was incomplete, so the background process refused it.	Run the command again. If the error persists, run `devo doctor` and contact support. See Collect diagnostics for support.
`sensitiveUnauthenticatedCaller`	1	The background process refused to return a secret value because the request didn't come from an authenticated session.	Run the command again. If the error persists, restart the background process with `devo daemon restart`. See The background process won't start.
`sensitiveValueNotAllowed`	1	The background process is set to block secret values, such as passwords, one-time passwords, and private keys, or the way the value would be delivered doesn't allow a plain-text value.	Read the value with a `devo secret` command. If the error persists, restart the background process with `devo daemon restart`.
`sensitiveValueNotSupported`	3 or 1	The workspace can show the entry's details but can't return this secret value. On a local profile, this applies to values such as one-time passwords and private keys, and local entry updates never write passwords or secret references. Exit code `3` with entry commands; `1` with `devo secret` commands.	To change a password, use `devo secret set`. To read the value, use a workspace type that supports it. See A command says the workspace doesn't support it.
`serverSecretNotFound`	1 or 4	Devolutions Server didn't find the vault, the entry, or the field, or the field isn't available to this account. With `devo secret read`, `devo secret get`, `devo secret run`, `devo secret inject`, `devo secret shell`, and `devo secret set`, the exit code is 1; with the entry commands that run in the background process, it's 4.	Check the vault ID, the entry ID, and the field name, and that your account can see the entry. See A secret reference doesn't resolve.
`serverSecretPamUnsupported`	1	`devo secret set`: Devolutions Server can't write a secret of an entry in a privileged access (PAM) vault.	Change this secret in Devolutions Server. See Update a secret from a script.
`serverSecretReadFailed`	1	Devolutions Server couldn't read the requested secret, with `devo secret read`, `devo secret get`, `devo secret run`, `devo secret inject`, `devo secret shell`.	Try again. Check the reference and that your account can read the entry. See A secret reference doesn't resolve.
`serverSecretUnauthorized`	1	Devolutions Server refused access to the secret: the sign-in was rejected or has expired, or the account isn't allowed to read or change it.	Sign in again with `devo login`, and check the permissions of the account on the entry. See Sign-in fails or the session expired.
`serverSecretWriteFailed`	1	Devolutions Server couldn't update the secret, with `devo secret set`.	Check the vault ID, the entry ID, and the field, and that your account may change the entry, then try again. See Update a secret from a script.
`unsupportedSecretAttribute`	2 or 1	The attribute in `?attribute=` or `--attribute` isn't known, or the workspace can't return that attribute as a value: the local profile returns only `value`, and Devolutions Cloud and Devolutions Server don't return a value for `otp`. Exit code `2` with `devo secret read` and `devo secret get`; `1` with `devo secret inject` and `devo secret run`.	Use `value`, `type`, `id`, `title`, or `purpose`. See Attributes.
`unsupportedSecretField`	1	The reference names a section, or a field that isn't an entry data property. Devolutions Cloud reads main entry fields only, such as `password` or `username`; Devolutions Server reads one entry data property, without a section.	Remove the section from the reference and name a main field. See Use a field the workspace can read.
`vaultNotSelected`	1	`devo secret get` received an entry ID (`--id`), but no vault was given and no current vault is selected, so the entry can't be located.	Pass `--vault-id`, or select a vault with `devo vault use`. See Select the vault you work in.
`workspaceSelectorAmbiguous`	1	The workspace named in a secret reference matches more than one workspace of the local profile. Produced while reading a secret, for example with `devo secret read`, `devo secret get`, `devo secret inject`, or `devo secret run`.	Use the workspace ID in the reference instead of its name. See Secret reference syntax and A secret reference doesn't resolve.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`invalidCommand`	2	`devo secret run` has no command to start: nothing follows `--` and no `--manifest` was given.	Add the command after `--`, for example `devo secret run --env-ref ... -- ./deploy.sh`, or use `--manifest`. See Run a command with its secrets.
`invalidEnvironmentFile`	2	A line of the file given with `devo secret run --env-file` isn't in `KEY=value` form. Empty lines and lines that start with `#` are allowed.	Fix the line. See How Devolutions CLI reads the file.
`invalidReceiptFile`	1	The path given with `--receipt-file` is a folder. The command ran, but `devo secret run` exits with `1` instead of the command's exit code.	Give a file path. See Keep a record of the launch.
`invalidSecretEnvironmentName`	2	A variable name in the environment file or the launch manifest isn't valid. Names use letters, digits, and underscores, and can't start with a digit.	Rename the variable. See Run a command with its secrets.
`invalidSecretEnvironmentReference`	2	An `--env-ref` isn't in `NAME=devo://…` form, the name isn't valid, or the value isn't an exact `devo://` reference. In a launch manifest, each value of `environment` must be an exact reference.	Write it as `--env-ref NAME=devo://<workspace>/<vault>/<entry>/<field>`. See Pass several secrets.
`invalidSecretLaunchManifest`	2	The launch manifest isn't valid JSON, doesn't use `schemaVersion` 1, has no `command`, or repeats a property or a variable name.	Fix the manifest. See Use a launch manifest.
`invalidSecretLaunchTimeout`	2	The timeout, from `--timeout-seconds` or `timeoutSeconds` in a launch manifest, is zero or negative.	Give a number of seconds greater than zero. See Limit how long the program runs.
`invalidSecretLaunchWorkingDirectory`	2	The `workingDirectory` of the launch manifest isn't an absolute path.	Use a full path. See Use a launch manifest.
`invalidSecretStdinReference`	2	The value of `--stdin-reference`, or `stdinReference` in a launch manifest, isn't an exact `devo://` reference.	Pass one complete reference. See Send a secret to standard input.
`receiptFileExists`	1	The receipt file already exists, or couldn't be created. A receipt never replaces an existing file. The command ran, but `devo secret run` exits with `1`.	Use a new file name, or delete the old receipt first.
`receiptWriteFailed`	1	You don't have permission to write the receipt file. The command ran, but `devo secret run` exits with `1`.	Write the receipt to a folder you can write to.
`secretEnvironmentConflict`	2	The same variable is set more than once, for example by two `--env-ref`, or by an `--env-ref` and the environment file. Variable names aren't case-sensitive here.	Keep one definition of each variable.
`secretEnvironmentFileReadFailed`	2	The file given with `devo secret run --env-file` exists but couldn't be read, for example because of permissions.	Check that you can read the file.
`secretLaunchArgumentReference`	2	A `devo://` reference was written as an argument of the command to run. Devolutions CLI refuses it, so the value can't appear in the process list.	Pass it with `--env-ref`, `--stdin-reference`, or `--manifest`. See Keep references out of the command line.
`secretLaunchCancelled`	130	`devo secret run` was interrupted, for example with `Ctrl`+`C`, and the command it started was stopped. If the receipt file couldn't be written, the exit code is `1`.	Run it again.
`secretLaunchCommandNotFound`	1	`devo secret run --check` didn't find the command in the working folder or in the `PATH`.	Check the command name, give its full path, or add its folder to `PATH`.
`secretLaunchManifestReadFailed`	2	The launch manifest given with `--manifest` exists but couldn't be read.	Check that you can read the file.
`secretLaunchModeConflict`	2	`devo secret run` got both `--dry-run` and `--check`.	Keep one of them. See Check before you run.
`secretLaunchSourceConflict`	2	`--manifest` was combined with `--env-file`, `--env-ref`, `--stdin-reference`, `--timeout-seconds`, or a command after `--`.	Put everything in the manifest, or don't use `--manifest`.
`secretLaunchStandardInputFailed`	1	The command started by `devo secret run` stopped accepting standard input before it got the value of `--stdin-reference`. The command was stopped.	Check that the command reads its standard input. See Send a secret to standard input.
`secretLaunchStartFailed`	1	The secrets were read, but the command couldn't be started, for example because it doesn't exist or isn't executable.	Check the command with `devo secret run --check`, then run it again.
`secretLaunchTimedOut`	124	The command started by `devo secret run` exceeded `--timeout-seconds` and was stopped. If the receipt file couldn't be written, the exit code is `1`.	Raise the timeout, or find out why the command takes so long. See Limit how long the program runs.
`secretLaunchWorkingDirectoryNotFound`	2	The `workingDirectory` of the launch manifest doesn't exist.	Create the folder or fix the path.
`secretShellMappingInvalid`	2	`devo secret shell enter` got no `--env-ref`, or an `--env-ref` that isn't a unique `NAME=devo://…` pair. Names reserved by Devolutions CLI are refused too.	Pass at least one `--env-ref NAME=<reference>`, with a different name each time. See Enter the scope.
`secretShellOutputFailed`	1	`devo secret shell enter` or `leave` couldn't write the shell code to the standard output, for example because the pipe was closed.	Run it again as shown in Use secrets in your current shell.
`secretShellOutputModeConflict`	2	The output format doesn't fit the `devo secret shell` command: `enter` and `leave` write shell code as text, while `status` and `enter --check` need `--output json`.	Remove the output option from `enter` and `leave`; add `--output json` to `status` and `enter --check`. See Use secrets in your current shell.
`secretShellStateInvalid`	1	The `DEVO_SECRET_SHELL_STATE_V1` variable that tracks the loaded secrets is damaged, or was set by another shell, for example a Bash scope seen from PowerShell.	Use the same `--shell` as for `enter`. If the variable is damaged, open a new shell session.
`secretShellUnsupported`	2	The `--shell` value isn't supported.	Use `--shell bash` or `--shell pwsh`.
`secretShellValueUnsupported`	1	A secret contains a NUL character, which a shell variable can't hold. Nothing was loaded.	Use `devo secret run` with `--stdin-reference`, or change the secret.
`secretEnvironmentResolutionFailed`	1	`devo secret run` couldn't resolve the secrets of the command, and no more specific error was reported.	Run the same command with `--check` to find the reference that fails. See A secret reference doesn't resolve.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`secretSpecClaimConflict`	1	`devo secretspec register` found a claim for `devo://` that points at another program.	Check it with `devo secretspec status`. To replace it, add `--force`. See Register Devolutions CLI as the provider.
`secretSpecClaimWriteFailed`	1	`devo secretspec register` couldn't write the claim file, or `devo secretspec unregister` couldn't remove it. The message gives the path and the reason. With `--system`, administrator rights are usually needed.	Run the command as an administrator for `--system`, or check the permissions of the folder. See Where the claim file goes.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`cloudArchivedLogsFailed`	1	`devo admin logs archived`: Devolutions CLI couldn't fetch the archived logs. The message may give the HTTP status returned.	Check the date (`yyyy-MM-dd`) and that your account can view logs. See Review activity logs.
`cloudEntryPermissionGetFailed`	1	`devo entry access get`: Devolutions CLI couldn't fetch the role of the user or group on the entry.	Check the vault and entry IDs and your access, then try again.
`cloudEntryPermissionNotFound`	1	`devo entry access get`: the user or group has no role assigned on the entry.	List the assignments with `devo entry access list`.
`cloudEntryPermissionUpdateFailed`	1	`devo entry access grant` or `revoke`: Devolutions Cloud couldn't change the role on the entry.	Check the IDs and that your account can manage the security of the entry, then try again. See Manage users, groups, and access.
`cloudEntryRoleGetFailed`	1	`devo admin role get --scope entry`: Devolutions CLI couldn't fetch the entry role.	Check the role ID with `devo admin role list --scope entry`, then try again.
`cloudEntryRoleListFailed`	1	Devolutions CLI couldn't fetch the entry roles of Devolutions Cloud, for example with `devo admin role list --scope entry`. The MCP tool that lists security roles can also return it, without an exit code.	Check that your account can view roles, then try again.
`cloudEntryRoleNotFound`	1	`devo admin role get --scope entry`: no entry role has that ID.	Check the role ID with `devo admin role list --scope entry`.
`cloudGatewayDeleteFailed`	1	`devo admin gateway delete`: Devolutions Cloud couldn't delete the gateway. The message may give the HTTP status returned.	Check the gateway ID with `devo admin gateway list` and your permissions, then try again.
`cloudGatewayGetFailed`	1	`devo admin gateway get`: Devolutions CLI couldn't fetch the gateway.	Check the gateway ID with `devo admin gateway list`, then try again.
`cloudGatewayListFailed`	1	`devo admin gateway list`: Devolutions CLI couldn't fetch the gateways.	Check that your account can view gateways, then try again.
`cloudGatewaySettingsGetFailed`	1	`devo admin gateway settings get`: Devolutions CLI couldn't fetch the gateway settings.	Check that your account can view gateways, then try again.
`cloudInvitationDeleteFailed`	1	`devo admin invitation delete`: Devolutions Cloud couldn't delete the invitation.	Check the invitation with `devo admin invitation list`, then try again.
`cloudInvitationGetFailed`	1	`devo admin invitation get`: Devolutions CLI couldn't fetch the invitation.	Check the invitation with `devo admin invitation list`, then try again.
`cloudInvitationListFailed`	1	`devo admin invitation list`: Devolutions CLI couldn't fetch the invitations.	Check that your account can manage invitations, then try again.
`cloudInvitationRemoveEmailFailed`	1	`devo admin invitation remove-email`: Devolutions Cloud couldn't remove the email address from the invitation.	Check the invitation and the email address, then try again.
`cloudOwnerGetFailed`	1	`devo admin owner get`: Devolutions CLI couldn't fetch the owner of the organization.	Check that your account can view this information, then try again.
`cloudOwnerSetFailed`	1	`devo admin owner set`: Devolutions Cloud couldn't change the owner of the organization.	Check the new owner and that your account is allowed to change the owner, then try again.
`cloudSettingsGetFailed`	1	Devolutions CLI couldn't fetch the system settings of Devolutions Cloud, or couldn't read them. Returned by `devo admin settings get` and `update`, and by `devo admin access system` and `system-vault` `grant` and `revoke`, which read the settings before changing them.	Check that your account can manage system settings, then try again.
`cloudSettingsUpdateFailed`	1	`devo admin settings update`: Devolutions Cloud couldn't save the system settings.	Check the values and that your account can manage system settings, then try again.
`cloudSiemLogsFailed`	1	`devo admin logs siem`: Devolutions CLI couldn't fetch the SIEM report logs.	Check that your account can view logs, then try again. See Review activity logs.
`cloudSsoUpdateFailed`	1	`devo admin settings update`: Devolutions Cloud couldn't change the SSO sign-in setting. The message gives the HTTP status returned.	Check the value and that your account can manage system settings, then try again.
`cloudSystemPermissionGetFailed`	1	`devo admin access system get`: Devolutions CLI couldn't fetch the system permissions of the user or group.	Check the user or group ID, then try again.
`cloudSystemPermissionListFailed`	1	`devo admin access system list` or `get`: Devolutions CLI couldn't fetch the system permissions.	Check that your account can manage system permissions, then try again.
`cloudSystemPermissionUpdateFailed`	1	`devo admin access system grant` or `revoke`: Devolutions Cloud couldn't change the system permissions.	Check the permission names and that your account can manage system permissions, then try again. See Manage users, groups, and access.
`cloudSystemVaultPermissionGetFailed`	1	`devo admin access system-vault get`: Devolutions CLI couldn't fetch the system vault role of the user or group.	Check the user or group ID, then try again.
`cloudSystemVaultPermissionListFailed`	1	`devo admin access system-vault list` or `get`: Devolutions CLI couldn't fetch the system vault roles.	Check that your account can manage system permissions, then try again.
`cloudSystemVaultPermissionUpdateFailed`	1	`devo admin access system-vault grant` or `revoke`: Devolutions Cloud couldn't change the system vault role.	Check the role and that your account can manage system permissions, then try again.
`cloudVaultRoleGetFailed`	1	`devo admin role get`: Devolutions CLI couldn't fetch the vault role.	Check the role ID with `devo admin role list`, then try again.
`invalidOperation`	Depends on the command	The change isn't allowed. `devo admin settings auth-modes set` (exit code `2`): at least one primary authentication mode must stay enabled on Devolutions Server. `devo admin user update` (exit code `1`): a Devolutions Cloud user synchronized from your organization directory can't be changed. `devo admin group delete` (exit code `3`): a synchronized Devolutions Cloud group can't be deleted.	Keep at least one authentication mode enabled. Change synchronized users and groups in your organization directory instead. See Manage users, groups, and access.
`serverAuthModesFailed`	1	`devo admin settings auth-modes get` or `set`: Devolutions Server didn't return its authentication modes.	Check that your account is a Devolutions Server administrator, then try again. See Manage users, groups, and access.
`serverAuthModesUpdateFailed`	1	`devo admin settings auth-modes set`: Devolutions Server didn't save the authentication modes.	Read the message, check your administrator rights, then try again.
`serverCacheResetFailed`	1	`devo admin cache reset`: Devolutions Server didn't reset the caches.	Read the message, check your administrator rights, then try again.
`serverDomainListFailed`	1	`devo admin domain list`: Devolutions Server didn't return its Active Directory domains.	Check your administrator rights, then try again.
`serverDomainUserListFailed`	1	`devo admin domain users`: Devolutions Server didn't return the users of the Active Directory domain.	Check the `--domain` name with `devo admin domain list`, then try again.
`serverGatewayRevocationPublishFailed`	1	`devo admin gateway revocation-list publish`: Devolutions Server didn't publish the revocation lists.	Check the `--gateway-id` value and your administrator rights, then try again.
`serverLicenseListFailed`	1	`devo admin license list`: Devolutions Server didn't return its licenses.	Check your administrator rights, then try again.
`serverLicenseSaveFailed`	1	`devo admin license register`: Devolutions Server didn't register the license.	Read the message and check the license serial or JWT, then try again.
`serverLicenseUserAssignmentsFailed`	1	`devo admin license users list`: Devolutions Server didn't return the users assigned to the license.	Check the license serial, then try again.
`serverLogsFailed`	1	`devo admin logs activity`, `administration`, `login-attempts`, `pam`, or `rotation`: Devolutions Server didn't return the logs.	Check the filters and your rights, then try again. See Review activity logs.
`serverPamAccountListFailed`	1	`devo admin pam account list`: Devolutions Server didn't return the privileged accounts.	Check the vault ID and your rights, then try again.
`serverPamProviderGetFailed`	1	`devo admin pam provider get`: Devolutions Server didn't return the privileged access provider.	Check the provider ID with `devo admin pam provider list`, then try again.
`serverPamProviderListFailed`	1	`devo admin pam provider list`: Devolutions Server didn't return the privileged access providers.	Check your rights, then try again.
`serverPermissionSetListFailed`	3	`devo admin access permission-sets`: Devolutions Server didn't return the permission sets.	Check your rights, then try again.
`serverTrialStartFailed`	1	`devo admin license trial start`: Devolutions Server didn't start the trial license.	Read the message, then try again.
`serverTwoFactorConfigurationFailed`	1	`devo admin settings two-factor get` or `devo admin user 2fa set`: Devolutions Server didn't return its two-factor authentication configuration.	Check your administrator rights, then try again.
`serverTwoFactorSaveFailed`	1	`devo admin user 2fa set` or `clear`: Devolutions Server didn't save the user's two-factor authentication.	Read the message, check the user and the `--type`, then try again. See Manage users, groups, and access.
`serverUserCanonicalIdRequired`	3	`devo admin user delete` on Devolutions Server: the user must be given by its ID, and the value isn't a valid user ID.	Pass the user's name, or its exact ID with `id:<value>` or `--id`. Find the ID with `devo admin user list`.
`serverUserCreateFailed`	1	`devo admin user create`: Devolutions Server didn't create the user.	Read the message. Check that the username isn't already used and that the password meets the server's rules.
`serverUserDeleteFailed`	3	`devo admin user delete`: Devolutions Server didn't delete the user.	Read the message and check your administrator rights, then try again.
`serverUserGetFailed`	1 or 3	Devolutions Server didn't return the user that the command works on. The exit code is 1 with `devo admin user update` and 3 with `devo admin user delete`.	Check the user with `devo admin user list`, then try again.
`serverUserListFailed`	3	Devolutions Server didn't return its users, for example with `devo admin user list`, or while finding a user by name.	Check your rights, then try again.
`serverUserPurgeFailed`	1	`devo admin user trash purge`: Devolutions Server didn't permanently delete the user.	Check the ID with `devo admin user trash list`, then try again.
`serverUserRestoreFailed`	1	`devo admin user trash restore`: Devolutions Server didn't restore the user.	Check the ID with `devo admin user trash list`, then try again.
`serverUserTrashListFailed`	1	`devo admin user trash list`: Devolutions Server didn't return the deleted users.	Check your administrator rights, then try again.
`serverUserUpdateFailed`	1	`devo admin user update`: Devolutions Server didn't save the changes to the user.	Read the message, check the values you passed, then try again.
`userNotFound`	4	The user wasn't found, for example with `devo admin user get`, `update`, `delete`, or `groups`.	Check the name, email, or ID with `devo admin user list`. See Users.
`userSelectorAmbiguous`	3	More than one user has the name you gave, so Devolutions CLI won't guess which one to change.	Give the user by ID with `--id`. See Users.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`runtimeUnavailable`	—	Returned by an MCP tool: no background process is available to run the tool. The MCP server keeps running.	Run `devo daemon status`, start or restart the background process with `devo daemon restart`, then call the tool again. See The background process won't start.
`daemonOperationFailed`		An MCP tool that controls the background process failed. It's returned to the AI client as the tool result, not as an exit code.	Run `devo daemon status`, then `devo daemon restart`. See The background process won't start.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`automationSessionNotInitialized`	3	The background process received the command before it finished loading the local profile.	Run the command again. If it keeps failing, run `devo daemon restart`. See The background process won't start.
`invalidRequest`	3	The background process received a request it couldn't read.	Restart the background process with `devo daemon restart` and run the command again. If it persists, see Collect diagnostics for support.
`daemonTimeout`	3	The background process didn't answer in time, or the request was cancelled without an interruption from you.	Run `devo daemon status`, then `devo daemon restart`, and run the command again. See The background process won't start.
`invalidSubmittedSecret`	3	A password or passphrase that Devolutions CLI passed to the background process arrived in an unreadable form.	Run the command again. If it keeps failing, run `devo daemon restart`, then collect diagnostics for support. See Collect diagnostics for support.
`daemonRequestFailed`	—	A request to the background process failed because the connection broke. Reported by MCP tools, and for one session in the output of `devo daemon sessions`, which still succeeds.	Run `devo daemon status`, then `devo daemon restart`. See The background process won't start.
`providerSelectionChanged`	3 or 1	The workspace selected for this command isn't the one the background process was started with, for example after `devo context use` or with `--source`. With Devolutions Cloud, it can also mean that the reference names another workspace than the selected context. Exit code `3` with workspace, vault, and entry commands; `1` with `devo secret` commands.	Run the command again, or run `devo daemon restart`. For a reference, check that its workspace matches the selected context. See Use the right context.
`headlessBootstrapFailed`	Depends on the command	The background process couldn't load the local Devolutions Remote Desktop Manager profile, and no more precise reason was returned. Usually `3`; `1` with `devo secret` commands and `devo config unlock`.	Run `devo daemon restart`. If it keeps failing, run `devo doctor` and see The background process won't start.
`missingSubmittedSecret`	3	A password or passphrase that the command needed, such as a user password, a workspace passphrase, or an entry password, didn't reach the background process.	Run the command again. If it keeps failing, run `devo daemon restart`, then collect diagnostics for support. See Collect diagnostics for support.
`daemonIoError`	3	The connection to the background process broke while the command was running.	Run `devo daemon status`, then `devo daemon restart`, and run the command again. See The background process won't start.
`ipcHandlerError`	3	The background process hit an unexpected error while processing the command.	Run `devo daemon restart` and try again. If it persists, run `devo doctor` and contact support. See The background process won't start.
`daemonUnavailable`	3	The background process couldn't be reached or isn't running, or it was turned off with `--daemon never` for a command that needs it. `devo daemon sessions` also shows it for a session that can't be reached, and the MCP tool that reloads the runtime returns it when no background process is registered.	Run `devo daemon status`, then `devo daemon start` or `devo daemon restart`. Don't use `--daemon never` with this command. See The background process won't start.
`methodNotFound`	3	The background process doesn't know the request it received, for example because it was started by another version of Devolutions CLI.	Run `devo daemon restart`, so the background process matches the `devo` you run.
`daemonRequestTimedOut`	—	The background process didn't answer in time. Reported by MCP tools, and for one session in the output of `devo daemon sessions`, which still succeeds.	Run `devo daemon status`, then `devo daemon restart`. See The background process won't start.
`unauthorized`	3	The background process refused the request: the access token Devolutions CLI uses to talk to it is missing or invalid, for example after the background process was restarted from another session. When Devolutions CLI is allowed to start the background process, it retries on its own and you don't see this code.	Run `devo daemon restart`, then the command again. See The background process won't start.
`headlessBootstrapNotImplemented`	Depends on the command	The background process is running, but no local profile is loaded. It shows in `devo daemon status`, and as the code of commands that need the profile: usually `3`, `1` with `devo secret` commands.	Check the profile folder with `devo config path`, select a workspace, then run `devo daemon restart`. See Use a local Devolutions Remote Desktop Manager profile.
`daemonConfigRootMismatch`	3	The running background process serves a different Devolutions Remote Desktop Manager profile folder than the one this command selects, for example after you changed `RDM_CONFIG_PATH`.	Run `devo daemon restart` so the background process uses the selected folder. See The background process won't start.
`daemonRequestCanceled`	—	A request to the background process was cancelled. Reported by MCP tools.	Run the tool again.

ERROR CODE	EXIT CODE	WHAT IT MEANS	WHAT TO DO
`directoryNotFound`	2, 1, or 4	The folder of the output file given with `--out-file` doesn't exist. The exit code depends on the command: `2` with `devo config export`, `devo daemon profile start`, and `devo generate ssh-key`; `1` with `devo secret read`, `devo secret inject`, and `devo secret get`; `4` with `devo variable export` and `devo logs export`.	Create the folder first, or give a path in an existing folder.
`fileNotFound`	2	`devo generate ssh-key`: the file given with `--passphrase-file` doesn't exist.	Check the path. See Generate passwords and SSH keys.
`environmentVariableMissing`	2	`devo generate ssh-key --passphrase-env` names an environment variable that isn't set or is empty.	Set the variable in the same shell, or use `--passphrase-file`. See Generate passwords and SSH keys.
`unexpectedError`	1	An error Devolutions CLI didn't expect. The message gives the details.	Run `devo doctor` and contact support. See Collect diagnostics for support.
`emptySecret`	2	The file given with `devo generate ssh-key --passphrase-file` is empty.	Write the passphrase in the file, or leave out the option to create a key without a passphrase.
`fileExists`	2 or 1	The output file already exists, and Devolutions CLI doesn't overwrite files unless asked. Exits with `2` with `devo config export`, `devo daemon profile start`, and `devo generate ssh-key`, and with `1` with `devo secret read`, `devo secret inject`, `devo secret get`, `devo variable export`, and `devo logs export`.	Pass `--force` to overwrite the file, or choose another path. With the MCP tool that exports activity logs, set its force argument.