With 401 Unauthorized (inferred): Microsoft Entra ID authentication is disabled for the account.

With 403 Forbidden: the request cannot be authorized by a Microsoft Entra ID token in the data plane.

With 403 Forbidden, customer-managed keys: the Microsoft Entra ID service is unavailable.

With 403 Forbidden, customer-managed keys: Azure Cosmos DB cannot get the Microsoft Entra ID access token for the Key Vault.

With 401 Unauthorized (inferred): the Microsoft Entra ID token has expired.

With 401 Unauthorized (inferred): the groups of the Microsoft Entra ID token could not be expanded.

With 401 Unauthorized (inferred): the Microsoft Entra ID token has an invalid audience.

With 401 Unauthorized (inferred): the Microsoft Entra ID token has an invalid format.

With 401 Unauthorized (inferred): the Microsoft Entra ID token has an invalid issuer.

With 401 Unauthorized (inferred): the Microsoft Entra ID token has an invalid scope.

With 401 Unauthorized (inferred): the Microsoft Entra ID token has an invalid signature.

With 401 Unauthorized (inferred): the Microsoft Entra ID token has an invalid signing key.

With 401 Unauthorized (inferred): the Microsoft Entra ID token has no object identifier.

With 401 Unauthorized (inferred): the Microsoft Entra ID token is not valid yet.

With 401 Unauthorized (inferred): the Microsoft Entra ID token was revoked.

With 429 Too Many Requests: the AE queue is full.

With 503 Service Unavailable: the aggregated health state is an error.

With 503 Service Unavailable (inferred): an allocation failed.

With 400 Bad Request: another throughput replace operation is in progress.

With 503 Service Unavailable (inferred): the application health state is an error.

With 410 Gone: the archival partition is not present.

With 429 Too Many Requests: the archival partition has not caught up yet.

With 429 Too Many Requests: throttled by an asynchronous reader-writer lock.

With 404 Not Found: the authorization token is not found in the cache.

With 409 Conflict: incremental backup to the Azure Backup vault is paused.

With 409 Conflict: restore from an incremental Azure Backup vault backup is disabled.

With 449 Retry With: the Azure role-based access control access decision is unavailable.

With 503 Service Unavailable: the barrier request was throttled.

With 413 Request Entity Too Large: the batch response size is exceeded.

With 429 Too Many Requests: the Bw-tree term count limit is exceeded.

With 429 Too Many Requests: throttled by the Bw-tree I/O rate limiter.

With 429 Too Many Requests: throttled by back pressure from a full Bw-tree log.

With 412 Precondition Failed: the in-account restore lock cannot be acquired.

With 412 Precondition Failed: the log store load balance lock cannot be acquired.

With 412 Precondition Failed: the master partition access lock cannot be acquired.

With 412 Precondition Failed: the offer owner lock cannot be acquired.

With 412 Precondition Failed: the partition key range lock cannot be acquired.

With 412 Precondition Failed: the partition key ranges lock cannot be acquired.

With 412 Precondition Failed: the partition lock cannot be acquired.

With 429 Too Many Requests: throttled by back pressure from the checkpoint queue depth.

With 503 Service Unavailable: the client failed to connect and all retries failed.

With 503 Service Unavailable: the client machine's CPU is overloaded.

With 403 Forbidden: the client id does not match.

With 503 Service Unavailable: an operating system I/O error occurred on the client.

With 429 Too Many Requests: the client TCP channel is full.

With 503 Service Unavailable: the client machine's thread pool is starved.

With 503 Service Unavailable: the client timed out and all retries failed.

With 503 Service Unavailable (inferred): the cluster health is empty.

With 429 Too Many Requests: the container quota is exceeded.

With 429 Too Many Requests: the container quota of an autoscale (autopilot) container is exceeded.

With 400 Bad Request: the container resource id does not match the one the client cached, for example after the container was re-created with the same name.

With 412 Precondition Failed: the container state changed.

With 409 Conflict (inferred): truncating a container is not allowed during a merge.

With 412 Precondition Failed: the containers in the partition were updated.

With 410 Gone: a partition migration is completing.

With 503 Service Unavailable: a partition migration was still completing after the SDK retry limit.

With 410 Gone: a partition split is completing.

With 503 Service Unavailable: a partition split was still completing after the SDK retry limit.

With 503 Service Unavailable: the compute federation is not found.

With 403 Forbidden: an internal compute error occurred.

With 409 Conflict: a configuration with the name already exists.

With 500 Internal Server Error: the configuration name is not empty.

With 500 Internal Server Error: the configuration operation was cancelled.

With 409 Conflict (inferred): the operation conflicts with another operation in the user transaction.

With 409 Conflict: the operation conflicts with a control plane operation.

With 503 Service Unavailable: the connection was interrupted or terminated unexpectedly.

With 429 Too Many Requests: throttled by the connection rate limiter.

With 404 Not Found: the container create operation is still in progress; retry the read until it succeeds.

With 400 Bad Request: a transaction across containers is not supported.

With 400 Bad Request: the cross-partition query cannot be served.

With 403 Forbidden (inferred), customer-managed keys: the customer key was rotated.

With 403 Forbidden: the database account is not found.

With 409 Conflict: a database with the name already exists.

With 500 Internal Server Error: the distributed transaction coordinator account configuration failed.

With 449 Retry With: a distributed transaction coordinator race conflict occurred.

With 500 Internal Server Error: the distributed transaction coordinator dispatch failed.

With 500 Internal Server Error: the distributed transaction coordinator ledger failed.

With 500 Internal Server Error: the distributed transaction coordinator rolled the operation back.

With 409 Conflict (inferred): the retriable write request is a duplicate.

With 403 Forbidden (inferred): Microsoft Fabric: authorization failed.

With 503 Service Unavailable (inferred): the health of the fabric nodes is an error.

With 403 Forbidden (inferred): Microsoft Fabric: the operation is not supported.

With 401 Unauthorized (inferred): Microsoft Fabric: the token could not be validated.

With 401 Unauthorized (inferred): the Microsoft Entra ID token could not be obtained.

With 500 Internal Server Error: the federation does not exist or is locked.

With 429 Too Many Requests: the gateway throttled the request.

With 503 Service Unavailable: the global strong write barrier is not met.

With 503 Service Unavailable: a gone exception was not resolved by retries.

With 503 Service Unavailable (inferred): the health state is an error.

With 429 Too Many Requests: a hot partition key is throttled.

With 400 Bad Request: the HTTP listener failed.

With 409 Conflict (inferred): the initial request of a retriable write has already completed.

With 503 Service Unavailable: there are not enough bindable partitions.

With 503 Service Unavailable: the capacity is insufficient.

With 403 Forbidden (inferred): Microsoft Fabric: the permissions are insufficient.

With 500 Internal Server Error: the account configuration is invalid.

With 412 Precondition Failed: the account status is invalid.

With 401 Unauthorized (inferred): the authorization header has an invalid format.

With 401 Unauthorized (inferred): Microsoft Fabric: the application id is invalid.

With 401 Unauthorized (inferred): Microsoft Fabric: the artifact id is invalid.

With 401 Unauthorized (inferred): Microsoft Fabric: the tenant id is invalid.

With 403 Forbidden, customer-managed keys: internal server error, the input bytes are not in the base64 format.

With 403 Forbidden (inferred), customer-managed keys: the Key Vault certificate URL is invalid.

With 403 Forbidden (inferred), customer-managed keys: the Key Vault key and certificate URLs are invalid.

With 403 Forbidden, customer-managed keys: the Key Vault key URL is invalid, for example it includes the key version.

With 403 Forbidden (inferred), customer-managed keys: the Key Vault secret URL is invalid.

With 403 Forbidden: the throughput cap value is invalid.

With 400 Bad Request: the topology change request is invalid.

With 400 Bad Request: the transaction id is invalid.

With 403 Forbidden (inferred), customer-managed keys: the key is disabled or expired.

With 403 Forbidden, customer-managed keys: the Key Vault does not grant Azure Cosmos DB access, or the key is disabled.

With 403 Forbidden, customer-managed keys: the Key Vault DNS name cannot be resolved.

With 403 Forbidden, customer-managed keys: the Key Vault returned an internal service error.

With 403 Forbidden, customer-managed keys: the key is not found in the Key Vault.

With 403 Forbidden (inferred), customer-managed keys: the Key Vault is not found.

With 403 Forbidden (inferred), customer-managed keys: a network security perimeter denies outbound access to the Key Vault.

With 403 Forbidden, customer-managed keys: the Key Vault service is unavailable.

With 403 Forbidden, customer-managed keys: the Key Vault cannot wrap or unwrap the key.

With 403 Forbidden: the partition is leaked.

With 410 Gone: the lease is not found.

With 401 Unauthorized (inferred): key-based (local) authentication is disabled for the account.

With 429 Too Many Requests: throttled by back pressure from the log flush queue depth.

With 429 Too Many Requests: the log store has no free segments.

With 400 Bad Request (inferred): generated by the .NET SDK: the continuation token is malformed.

With 403 Forbidden (inferred), customer-managed keys: the master service is unavailable.

With 412 Precondition Failed: merging is disabled.

With 429 Too Many Requests: the Microsoft Fabric capacity unit budget is exceeded.

With 412 Precondition Failed: the container resource ids do not match on a migrate partition request during a migration.

With 204 No Content: the replica has not reached the target global committed LSN of a head request.

With 204 No Content: the replica is more than 100 global committed LSNs behind the target of a head request.

With 204 No Content: the replica is more than 1000 global committed LSNs behind the target of a head request.

With 204 No Content: the replica is more than 10000 global committed LSNs behind the target of a head request.

With 204 No Content: the replica has not reached the target LSN of a head request.

With 204 No Content: the replica is more than 100 LSNs behind the target of a head request.

With 204 No Content: the replica is more than 1000 LSNs behind the target of a head request.

With 204 No Content: the replica is more than 10000 LSNs behind the target of a head request.

With 401 Unauthorized (inferred): the authorization header is missing.

With 412 Precondition Failed: the partition resource is missing when aborting a migration.

With 412 Precondition Failed: the partition resource is missing when completing a migration.

With 403 Forbidden (inferred), customer-managed keys: a request parameter is missing.

With 503 Service Unavailable: the n-region commit write barrier is not met.

With 410 Gone: the client's name cache is stale.

With 503 Service Unavailable: the name cache stayed stale after the SDK retry limit.

With 503 Service Unavailable: no valid store response was received.

With 403 Forbidden (inferred): a network security perimeter denies the inbound request.

With 403 Forbidden: replacing the throughput of an autoscale offer is disabled.

With 412 Precondition Failed: the throughput offer was scaled up by the user.

With 412 Precondition Failed: the throughput offer validation failed.

With 500 Internal Server Error: the operation was cancelled without a rollback.

With 429 Too Many Requests: the operation log is too big.

With 500 Internal Server Error: the operation manager dequeue pump stopped.

With 503 Service Unavailable: the operation is paused.

With 503 Service Unavailable (inferred): the operation result is null.

With 503 Service Unavailable (inferred): the operation result is unexpected.

With 404 Not Found: the owner resource, a database or container, does not exist.

With 500 Internal Server Error: a partition failover failed.

With 400 Bad Request: the partition key definition is missing for an autoscale (autopilot) container.

With 400 Bad Request: the partition key definition is not specified.

With 403 Forbidden: the limit of delete-by-partition-key requests is exceeded.

With 409 Conflict: the partition key hash collides for the id.

With 400 Bad Request: the partition key does not match the item or the container's partition key definition.

With 403 Forbidden: the logical partition reached its maximum size.

With 410 Gone: the partition key range is gone, for example after a split.

With 503 Service Unavailable: the partition key range stayed gone after the SDK retry limit.

With 404 Not Found: the container of a migrating partition was deleted.

With 409 Conflict: the document counts of the source and target partitions of a partition migration do not match.

With 409 Conflict: the document counts of the target partition replicas of a partition migration do not match.

With 404 Not Found: a partition migration failed to update DNS.

With 404 Not Found: the partition resource is not found during a partition migration.

With 404 Not Found: the partition of a shared throughput database is not found during a partition migration.

With 404 Not Found: the source partition of a partition migration was deleted in the master partition.

With 412 Precondition Failed: the partition is not in the migrating status for a migrate partition request.

With 429 Too Many Requests: the partitioned resource quota is exceeded.

With 403 Forbidden: the condition of a conditional patch is not met.

With 429 Too Many Requests: the prepare time limit is exceeded.

With 403 Forbidden: the provisioning limit is reached.

With 503 Service Unavailable: the quorum is not met.

With 429 Too Many Requests: a quota is exceeded.

With 449 Retry With: the Microsoft Entra ID group of role-based access control is unavailable.

With 500 Internal Server Error: role-based access control is disabled because of the Azure Resource Manager path.

With 403 Forbidden (inferred): role-based access control has no action for the request.

With 403 Forbidden (inferred): role-based access control has no user id for the request.

With 403 Forbidden (inferred): role-based access control did not authorize the request.

With 403 Forbidden (inferred): role-based access control cannot resolve the resource id.

With 403 Forbidden (inferred): role-based access control does not authorize the metadata request.

With 403 Forbidden (inferred): role-based access control does not authorize the name-based data request.

With 403 Forbidden (inferred): role-based access control does not authorize the resource-id-based data request.

With 503 Service Unavailable: the read quorum is not met.

With 404 Not Found: the read session is not available for the session token.

With 403 Forbidden: the container definition in the request is the same as the existing one.

With 403 Forbidden: the database definition in the request is the same as the existing one.

With 429 Too Many Requests: the replication queue is full.

With 408 Request Timeout: the request was preempted.

With 412 Precondition Failed: the resource is not found.

With 403 Forbidden: the resource is soft-deleted.

With 449 Retry With (inferred): the response of a retriable write request expired in the primary cache.

With 429 Too Many Requests: throttled by the RNTBD client channel.

With 503 Service Unavailable: the routing map snapshot is inconsistent.

With 429 Too Many Requests: the request units per second budget is exceeded.

With 429 Too Many Requests: the request units per second budget of the master partition is exceeded.

With 429 Too Many Requests: the request units per minute limit of the partition is exceeded.

With 429 Too Many Requests: the shared request units per minute budget is exceeded.

With 401 Unauthorized (inferred): SAS token authentication is disabled for the account.

With 400 Bad Request: the schema hash or id does not match.

With 400 Bad Request: the schema owner id does not match.

With 400 Bad Request: a stored procedure, trigger or user-defined function failed to compile.

With 503 Service Unavailable: a 410 Gone from the service that SDK retries did not resolve.

With 503 Service Unavailable: a 503 Service Unavailable from the service.

With 503 Service Unavailable: the service is offline.

With 429 Too Many Requests: throttled by a service module.

With 403 Forbidden: the number of containers in a shared throughput database is exceeded.

With 403 Forbidden: the number of shared throughput databases is exceeded.

With 403 Forbidden: the quota of containers in a shared throughput database is exceeded.

With 403 Forbidden: the shared throughput offer does not need to grow.

With 429 Too Many Requests: a sink partition value does not match its expected bound.

With 412 Precondition Failed: splitting is disabled.

With 500 Internal Server Error: a partition split timed out.

With 429 Too Many Requests: the staleness exceeded its bound.

With 412 Precondition Failed: a storage split conflicts with an n-way throughput split.