AXIAM PHP SDK

SetFailureReason : string

in package

• Application

Why {@see SsfReceiver::verifySet()} refused a Security Event Token — the bracketed reason codes of CONTRACT.md §32.7, one per verification step that can fail.

Table of Contents

Cases

InvalidAudience  = 'invalid_audience'

Step 7: `aud` does not name this receiver.

InvalidIssuer  = 'invalid_issuer'

Step 6: `iss` is not the configured issuer.

InvalidKey  = 'invalid_key'

Steps 3–5: `alg` is not `EdDSA`, the `kid` is not in the JWKS, or the signature fails.

InvalidRequest  = 'invalid_request'

Step 8: `exp` or `sub` present; `jti`, `iat` or `sub_id` missing; not exactly one event.

InvalidType  = 'invalid_type'

Step 2: `typ` is neither `secevent+jwt` nor `application/secevent+jwt`.

Malformed  = 'malformed'

Step 1: not three base64url parts, or a header / payload that is not a JSON object.

Replayed  = 'replayed'

Step 9: the `jti` was already accepted within the replay window. Returned by `poll()`, it is **acknowledged** in the next call's `ack`, never reported in `setErrs` (CONTRACT.md §34.2 P2).

Methods

pushErrorCode()  : string

The RFC 8935 §2.4 `err` to answer a push with (`400 {"err": …}`), and to pass in a poll's `setErrs`.