Air-Gapped Devin Error Code Reference

This documentation is for the federal deployments of Devin. Back to Devin Docs

Every failure the air-gapped CLI and Desktop can diagnose is reported with a stable code of the form XXXnnn. Codes appear at the start of the error message on the terminal, in devin airgap doctor output, in Desktop diagnostics, and in the error_code field of auth audit events. The number identifies the condition, not the wording, so you can key support runbooks and SIEM alerts on it.

Namespace	Covers	Detailed page
`LIC`	License file validation	License
`MDL`	Models file validation	Models file
`IDP`	SSO and identity provider	SSO
`NET`	Endpoint reachability, TLS, HTTP probing	Network and certificates
`CFG`	Local paths, configuration, environment	Network and certificates, Models file

`LIC` License

Printed as LIC00n: <message>, followed by the path that was checked and how to override it (DEVIN_LICENSE_FILE).

Code	Meaning	What to do
`LIC001`	License file missing or unreadable at `/etc/devin/license.devin-onprem-license` (`C:\ProgramData\Devin\license.devin-onprem-license` on Windows), or at the `DEVIN_LICENSE_FILE` path. On Windows, also returned when a standard user tries to replace an administrator-owned license from Desktop.	Install the file at the default path or set `DEVIN_LICENSE_FILE`; check read permission for the user running Devin.
`LIC002`	Malformed file: not a valid EdDSA JWT, or no `kid` in the header.	Re-download the license from the portal; transfer it byte-for-byte (no added newline, wrapping, or encoding change).
`LIC003`	Signature verification failed.	The payload was altered after signing. Re-download the license.
`LIC004`	Unknown `kid`: no matching public key is embedded in this build.	Run the `kid` check. The license was issued by a different environment, or your build predates a key rotation; install the current release.
`LIC005`	Expired beyond the 24-hour grace period.	Renew the license through the portal.
`LIC006`	Not yet valid: issued more than 24 hours in the future.	Check the host clock; if it is correct, contact your support team.
`LIC007`	Wrong `product` claim (not `devin-onprem`).	The file is not an air-gapped Devin license. Re-download it from the portal.

`MDL` Models file

Reported by devin models validate, devin airgap doctor, Desktop’s models settings, and at agent startup. Each diagnostic names the model entry it applies to.

Code	Meaning	What to do
`MDL001`	File is not valid JSON for schema v0, including unknown fields.	Fix the JSON; remove fields not in the schema.
`MDL002`	Unsupported `schema_version`.	Set `"schema_version": 0`.
`MDL003`	`models` is empty.	Add at least one model entry.
`MDL004`	A model has an empty `name`.	Give every entry a unique `name`.
`MDL005`	Duplicate model `name`.	Rename one of the entries.
`MDL006`	Empty `base_url`.	Set the endpoint URL.
`MDL007`	Empty `api_key.env`.	Name the environment variable that holds the key.
`MDL008`	`max_context_tokens` is zero.	Set the model’s context window.
`MDL009`	More than one model marked `default`.	Leave `default: true` on exactly one entry.
`MDL010`	`base_url` is not an `https://` URL with a host (`http://` is accepted only for loopback addresses).	Use `https://`, or a loopback address for a same-host server.
`MDL011`	`max_output_tokens` exceeds `max_context_tokens`.	Lower `max_output_tokens`.
`MDL012`	File exists but could not be read (permissions or invalid UTF-8).	Fix read permission for the user running Devin; save the file as UTF-8.
`MDL013`	`max_output_tokens` is zero.	Remove the field or set a positive value.
`MDL014`	File is owned by another user, so Desktop refuses to replace it.	Edit the file on disk as its owner, or point `DEVIN_MODELS_FILE` at a file you own.

`IDP` SSO and identity provider

Reported by devin auth login, devin auth status, at agent startup, and by the Desktop sign-in flow. IDP004 and IDP005 are also written to the audit log on sso_login_denied events, and any IDP code can appear on sso_revalidation_failed.

Code	Meaning	What to do
`IDP001`	The auth file is unreadable or invalid.	Fix `/etc/devin/auth.json` (`C:\ProgramData\Devin\auth.json` on Windows), or the file at the `DEVIN_AUTH_FILE` path; the message names the offending field.
`IDP002`	No cached login for the configured issuer.	Run `devin auth login`.
`IDP003`	The login is invalid or expired and could not be silently refreshed (including an IdP `invalid_grant` response).	Run `devin auth login` again.
`IDP004`	Logged in, but the user is not a member of `required_group`.	Add the user to the group at the IdP, or correct `required_group` / `groups_claim` in the auth file.
`IDP005`	The IdP could not be reached, returned an error, or returned an ID token that failed validation.	Check network reachability, TLS trust (`DEVIN_CA_BUNDLE`), the `issuer` value, and the IdP’s own logs.
`IDP006`	The local SSO token cache is unreadable, malformed, or not private to the current user.	Run `devin auth login`; a fresh login rewrites the cache with owner-only permissions.

`NET` Network

Reported by devin airgap doctor endpoint probes and by inference and IdP requests. Each NET failure includes the underlying error chain.

Code	Meaning	What to do
`NET001`	DNS resolution of the endpoint host failed.	Check the hostname in the models file or auth file, and DNS on the workstation.
`NET002`	TCP connection could not be established (refused, reset, or unroutable).	Check that the endpoint is listening on the port and that firewalls or proxy rules allow the workstation to reach it.
`NET003`	TLS handshake failed: untrusted, expired, or mismatched certificate. `devin airgap doctor` prints the certificate the server presented (subject, issuer, expiry) when obtainable, and whether `DEVIN_CA_BUNDLE` was in effect.	Trust the private CA with `DEVIN_CA_BUNDLE`, or fix the server certificate (name, chain, expiry).
`NET004`	Endpoint returned a non-success HTTP status other than 401/403. A `404` on `GET {base_url}/models` is reported as a warning, since some OpenAI-compatible servers do not implement `/models`.	Check the endpoint’s own logs and the `base_url` path (for example a missing `/v1`).
`NET005`	Request timed out (10 s for doctor probes, 30 s for IdP requests, 30 s connect / 300 s read for inference).	Check load on the endpoint and any intermediate proxy; see timeouts.
`NET006`	Endpoint rejected the configured credentials (HTTP 401/403).	Check the value in the `api_key.env` variable and that the key is valid for the endpoint.

`CFG` Configuration

Reported by devin airgap doctor and at startup.

Code	Meaning	What to do
`CFG001`	A required config or state directory is missing or not writable (`~/.config/devin`, `~/.local/share/devin`, or the `cli-federal` product directory; on Windows, `%APPDATA%\devin` or its `cli-federal` subdirectory).	Create the directory or fix its ownership and permissions for the user running Devin.
`CFG002`	An environment variable referenced by configuration (a model’s `api_key.env`) is not set in the agent’s environment.	Export the variable, or set it through Desktop’s `devin.acp.agentEnv` setting; see API key environment variables.
`CFG003`	The models file could not be found at `/etc/devin/models.json` (`C:\ProgramData\Devin\models.json` on Windows) or the `DEVIN_MODELS_FILE` override.	Install the models file; see Models file.
`CFG004`	The `DEVIN_CA_BUNDLE` file is missing, unreadable, or contains no valid PEM certificates.	Fix the path or the file contents; see Network and certificates.
`CFG005`	A custom subagent definition (`agents/**/AGENT.md`, or a flat `agents/<name>.md`) could not be parsed, most often invalid YAML frontmatter; the profile is skipped. Also reported as a warning when a definition declares frontmatter keys Devin does not read (for example `allowed_tools` instead of `allowed-tools`); the profile still loads.	Fix the named file and the parse error `devin doctor` prints.
`CFG006`	An `OTEL_EXPORTER_OTLP_*` environment variable is set that OTLP export ignores (any field other than `ENDPOINT`, `HEADERS`, `TIMEOUT`, `PROTOCOL`; any `TRACES_` variable; or an unsupported `PROTOCOL`). A warning; the variable name is printed, never its value.	Remove or correct the variable.

CFG005 and CFG006 come from the standard devin doctor checks and are not specific to the air-gapped build.

Reading a failure

A typical validation failure:

devin models validate

/etc/devin/models.json: 1 problem(s) found
  MDL010 [model 'qwen3-vl-32b']: model 'qwen3-vl-32b': `base_url` must be an https:// URL (plain http:// is only allowed for loopback addresses: localhost, 127.0.0.0/8, or [::1])

Find the code in the tables above, apply the action, then re-run devin airgap doctor until every check passes. If a code is not listed here, your build is newer than this page; run devin --version and include the full message in your support request as described in Troubleshooting.

​LIC License

​MDL Models file

​IDP SSO and identity provider

​NET Network

​CFG Configuration

​Reading a failure

`LIC` License

`MDL` Models file

`IDP` SSO and identity provider

`NET` Network

`CFG` Configuration

Reading a failure