Auth0 Actions - The Value of "error" in the Error Response has been Changed from "unauthorized" to "access_denied"

Last Updated: Sep 10, 2025

Overview

This article explains why, after converting rules to actions, there is 1 difference in Force Email Verification:

the value of "error" in the error response has been changed from "unauthorized" to "access_denied"

The result of the action is:

{
  "error": "access_denied",
  "error_description": "Please verify your email before logging in."
}

The result of the rule is:

{
  "error": "unauthorized",
  "error_description": "Please verify your email before logging in."
}

Applies To

Actions

Cause

The api.access.deny function will always return an access_denied error code. There is no way to return a different error code.

Solution

A possible workaround would be to provide the error code as part of the message. One example is to encode the error code and actual error message into JSON and pass it as the message. The application can then decode the object and retrieve the code and message individually.