---
title: "Messages and what they mean — Clock Clerk user guide"
description: "Every message Clock Clerk shows when it refuses something, word for word, grouped by screen, with why it happens and what to do about it."
url: "https://clockclerk.com/guide/troubleshooting/messages"
---

Troubleshooting

# Messages and what they mean

Every message Clock Clerk shows when it refuses something, word for word, with why it happens and what to do about it. They are grouped by where you meet them; to find one, search this page for a few words of what the app said.

Words in *italics* stand for what the app fills in: a date, a name, an invoice number. Some messages come in more than one form, for the whole week or part of it, say, and each form is listed. The code under each one is what to quote when you ask your administrator or Clock Clerk's support for help. The questions people ask most are answered in [Common questions](https://clockclerk.com/guide/troubleshooting/index.md).

## Your week sheet

> The *days* part of this week has been submitted for approval. Reopen it before changing anything on it.

> This week has been submitted for approval. Reopen it before changing anything on it.

**Why:** You tried to change hours, a comment or a line on a week, or on the part of a week in one month, that has already been submitted for approval. A submitted week is read-only until it is reopened. You usually see this when the week was submitted in another tab or on another device while this one was still open.

**What to do:** If you have the **Can reopen a submitted week** permission and the week is not approved yet, choose **Reopen week** on My Week (or **Reopen** on the month's band), give a reason, make the change and submit again. Otherwise ask the person who reviews your time to **Send back…** the week. See [Reopening a week yourself](https://clockclerk.com/guide/workflows/record-your-week.md).

Code `period_submitted`

> This week already carries that task on the same billing role and activity. Put the hours on the line that is already there.

**Why:** A week has one line per task, billing role and activity. You added a line, or changed a line's task, billing role or activity, so that it would match a line already on the week.

**What to do:** Type the hours into the line that is already there instead. If the work really was different, pick another billing role or activity for this line. See [Add a line](https://clockclerk.com/guide/workflows/record-your-week.md).

Code `duplicate_line`

> The billing role “*role*” has been archived, so no new work can be booked as it. Pick another role.

**Why:** You chose a billing role, for a new line or on an existing one, that Finance or an administrator has archived. An archived role keeps the hours already booked under it, but no new work can be booked as it.

**What to do:** Pick another of your billing roles for the line. If none of your roles on the project fits, ask whoever runs the project to turn on an active one for you; Finance or an administrator can also restore the role under **Billing rates**. See [Billing roles](https://clockclerk.com/guide/screens/finance.md).

Code `role_archived`

> That billing role is not assigned to you on this project. Pick one of your assigned roles, or ask whoever runs the project.

**Why:** You can only book time on a project under the billing roles turned on for you on that project's team. The role you picked for the line is not one of them.

**What to do:** Pick one of your own roles in the line's **Billing role** list. If the role you need is missing, ask an administrator or whoever runs the project to turn it on for you on the project's team, where each person has a chip per billing role. See [The team and billing roles](https://clockclerk.com/guide/screens/projects.md).

Code `role_not_assigned`

> Your organization has no default activity, so time on a project that doesn't ask for one has nowhere to go. Ask an administrator to add an activity under Activities.

**Why:** You added, changed or moved a line on a project that doesn't ask for an activity. Time on such a project is recorded under your organization's default activity, without anybody picking it, and your organization has none. That happens while its **Activities** catalog has no active, billable activity to be the default, such as while it is empty.

**What to do:** Ask an administrator to add an activity under **Activities**. The first active, billable activity they add becomes the default, and you can then try the line again. See [Activities](https://clockclerk.com/guide/screens/admin-activities.md).

Code `no_default_activity`

> These hours are on invoice *invoice number*. Void it before changing them.

**Why:** The hours you tried to change, move or remove are on a client's invoice, a draft included. Billed hours are locked for everyone, so the invoice and your timesheet cannot disagree.

**What to do:** Ask someone in Finance or an administrator to remove the hours' line from the draft, discard the draft, or void the invoice. The lock lifts as soon as the hours leave the invoice. See [Why billed hours are locked](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `hours_invoiced`

> These hours are on acceptance protocol *protocol number*. Ask for it to be returned before changing them.

**Why:** The hours you tried to change, move or remove are on a contractor's acceptance protocol: the month has been submitted on My Month and its hours are frozen while it is reviewed.

**What to do:** If it is your month and it is still **Awaiting sign-off**, choose **Withdraw** on My Month. Once it has been countersigned, ask your engagement manager, Finance or an administrator to **Return to contractor**. Either one releases the hours. See [What the contractor lock freezes](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `hours_on_protocol`

> These hours are on acceptance protocol *protocol number*, which has been paid. They are final.

> These hours are on acceptance protocol *protocol number*, which has been approved for payment. They are final.

**Why:** The hours are on a contractor's acceptance protocol that has been approved for payment or paid. From that point the month cannot be withdrawn or returned, so its hours can never change.

**What to do:** Nothing in Clock Clerk unlocks these hours. If something on them is wrong, raise it with Finance or an administrator so it can be handled outside this month. See [What the contractor lock freezes](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `hours_protocol_final`

> Attach the receipt for this expense before submitting: *date* *description* (*amount*).

**Why:** You tried to submit a week (or, as a contractor, a month) with an expense claim dated in it that is above the receipt threshold and has no receipt. A claim can wait for its receipt while you record, but not past submitting.

**What to do:** Open **My Expenses** (or **Expenses this week** on My Week), find the claim marked **Receipt needed**, choose **Attach receipt**, then submit again. See [Attach the receipt](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `receipt_missing`

> Attach the missing receipts before submitting (*number*): *expenses*.

**Why:** You tried to submit a week (or, as a contractor, a month) while several expense claims dated in it are above the receipt threshold and have no receipt. The message names each of them.

**What to do:** On **My Expenses**, choose **Attach receipt** on every claim marked **Receipt needed**, then submit again. See [Attach the receipt](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `receipts_missing`

> You are not allowed to reopen a submitted week. Ask an administrator.

**Why:** You tried to reopen a week you submitted, but you do not have the **Can reopen a submitted week** permission. It is on by default, but an administrator has turned it off for you, and only an administrator turns it back on.

**What to do:** Ask the person who reviews your time to **Send back…** the week, which opens it for you to change. If you should be able to do it yourself, ask an administrator to turn on the permission on your page under **Settings → People**. See [Permissions for one person](https://clockclerk.com/guide/roles.md).

Code `reopen_not_allowed`

> The *days* part of this week has hours or expenses on invoice *invoice number*. Void the invoice first — reopening it afterwards is the right order.

> This week has hours or expenses on invoice *invoice number*. Void the invoice first — reopening it afterwards is the right order.

**Why:** You, or a reviewer, tried to reopen a week or send it back while some of its hours or expense claims are on a client's invoice. Reopening would unlock hours the client has already been billed for.

**What to do:** Ask someone in Finance or an administrator to remove those lines from the draft, discard the draft, or void the invoice (**Void invoice**). Then reopen the week or send it back. See [Why billed hours are locked](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `reopen_invoiced`

> The *days* part of this week has expenses on acceptance protocol *protocol number*. Withdraw or return the protocol first — reopening it afterwards is the right order.

> The *days* part of this week has hours on acceptance protocol *protocol number*. Withdraw or return the protocol first — reopening it afterwards is the right order.

> This week has expenses on acceptance protocol *protocol number*. Withdraw or return the protocol first — reopening it afterwards is the right order.

> This week has hours on acceptance protocol *protocol number*. Withdraw or return the protocol first — reopening it afterwards is the right order.

**Why:** You, or a reviewer, tried to reopen a week or send it back while its hours, or expense claims paid back with them, are on a contractor's acceptance protocol that is still under review.

**What to do:** Take the month off first: the contractor chooses **Withdraw** on My Month while it is **Awaiting sign-off**, or the engagement manager, Finance or an administrator chooses **Return to contractor**. Then reopen the week. See [What the contractor lock freezes](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `reopen_on_protocol`

> The *days* part of this week has expenses on acceptance protocol *protocol number*, which has been paid. They are final.

> The *days* part of this week has expenses on acceptance protocol *protocol number*, which has been approved for payment. They are final.

> The *days* part of this week has hours on acceptance protocol *protocol number*, which has been paid. They are final.

> The *days* part of this week has hours on acceptance protocol *protocol number*, which has been approved for payment. They are final.

> This week has expenses on acceptance protocol *protocol number*, which has been paid. They are final.

> This week has expenses on acceptance protocol *protocol number*, which has been approved for payment. They are final.

> This week has hours on acceptance protocol *protocol number*, which has been paid. They are final.

> This week has hours on acceptance protocol *protocol number*, which has been approved for payment. They are final.

**Why:** You, or a reviewer, tried to reopen a week or send it back, but its hours or expense claims are on a contractor's acceptance protocol that has been approved for payment or paid. Such a month can no longer be withdrawn or returned.

**What to do:** The week cannot be reopened, by anyone. If something on it is wrong, raise it with Finance or an administrator so it can be handled outside this month. See [What the contractor lock freezes](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `reopen_protocol_final`

> The *days* part of this week has been approved. Ask your manager to reopen it.

> This week has been approved. Ask your manager to reopen it.

**Why:** You tried to reopen a week, or one month's part of it, that has already been approved. Once a week is approved, only a reviewer can undo that, so its hours cannot drift from what was signed off.

**What to do:** Ask your reviewer (a manager over your projects, Finance or an administrator) to choose **Reopen week** on the **Decided** tab of Approvals and then **Send back…**, so the week opens for you. See [Changing your mind](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `reopen_approved`

> Say why you are reopening this week — the comment is kept on the week's history.

**Why:** You chose **Reopen week** without saying why. The reason is required, because it is kept on the week's submission history.

**What to do:** Write what you need to change under **Why are you reopening this week?** and choose **Reopen week** again. See [Reopening a week yourself](https://clockclerk.com/guide/workflows/record-your-week.md).

Code `reopen_comment_required`

> Keep the comment to *maximum* characters or fewer.

**Why:** The reason you gave for reopening the week is longer than the limit the message names (1,000 characters).

**What to do:** Shorten the reason and choose **Reopen week** again. See [Reopening a week yourself](https://clockclerk.com/guide/workflows/record-your-week.md).

Code `reopen_comment_too_long`

> The Free plan is for up to *limit* people, and your organization has *number*. Move to the Team plan to add anybody else, or set an end date on somebody who has left.

> The Free plan holds up to *limit* active projects, and your organization has *number*. Mark one Complete to make room, or move to the Team plan.

> The Free plan holds up to *limit* clients, and your organization has *number*. Archive one to make room, or move to the Team plan.

> The Starter plan is for up to *limit* people logging time each billing period, and *number* already have since *date*. Entering or changing hours on any day counts as logging time in the period it is done in. Ask an administrator to move to the Team plan.

> The Starter plan is for up to *limit* people logging time each month, and *number* already have in *month*. Ask an administrator to move to the Team plan.

**Why:** Your organization's plan has a cap, and this would go past it. On the Free plan: adding a person, a project that is not Complete, or an active client beyond its limits, or bringing one back. On the Starter plan: someone entering or changing hours when the plan's number of people logging time this billing period (or month) has already been reached. People already logging time are never stopped.

**What to do:** An administrator can move the organization to the Team plan from **Choose a plan** on the Plans page, or **Switch to Team** on the Organization tab. On Free you can also make room: set a **Left** date on somebody who has left, mark a project **Complete**, or archive a client. See [What each plan includes](https://clockclerk.com/guide/screens/trial.md).

Code `plan_limit`

> The Free plan holds up to *limit* people, and your organization has *number*. Give the people who have left an end date, then choose Free again.

> The Free plan holds up to *limit* active projects, and your organization has *number*. Mark the finished ones Complete, then choose Free again.

> The Free plan holds up to *limit* clients, and your organization has *number*. Archive the ones you no longer work for, then choose Free again.

**Why:** You chose Free on the Plans page, but your organization has more people who have not left, projects that are not Complete, or clients that are not archived than the Free plan holds. Moving to Free never takes anything away, so it is refused instead.

**What to do:** Make room first: set a **Left** date on somebody who has left, mark a finished project **Complete**, or archive a client you no longer work for. Then [choose Free](https://clockclerk.com/guide/screens/trial.md) again. Or pick a paid plan, which has no such limits. See [What each plan includes](https://clockclerk.com/guide/screens/trial.md).

Code `plan_free_over_limit`

> Your subscription has ended, and moving to Free doesn’t reopen your organization. Ask support for the Free plan instead.

**Why:** Your organization paid for a plan and that subscription has ended or gone unpaid. Choosing Free only ends a free trial. It does not lift the read-only lock a lapsed subscription puts on the organization.

**What to do:** Reload the Plans page. **Choose Free** there then sends support a message, and they move you to Free. You can also pay again under **Organization → Plan & billing**.

Code `plan_free_lapsed`

> Your organization is not on a free trial, so support moves it to Free. Reload the page to ask them.

**Why:** Choosing Free moves an organization straight onto it only from a free trial. Yours is not on one, so its plan is changed by support.

**What to do:** Reload the Plans page and choose Free again. The button then sends support a message instead.

Code `plan_free_no_trial`

> Your organization signs in through its identity provider, and the Free plan signs in with passwords only. Switch back to passwords on the Organization tab, or ask support to, then choose Free again. Or pick a paid plan, which keeps your sign-in.

**Why:** Single sign-on, through Okta, Google Workspace, Microsoft or another OpenID Connect provider, comes with every paid plan and the trial, not with Free. Your organization signs in that way, and moving it to Free would leave people with no way in, because many of them have no Clock Clerk password. So the move waits until it signs in with passwords. Nothing has changed.

**What to do:** To stay on your provider, choose Starter, Team or Enterprise instead. To move to Free, first switch back to passwords: an organization that switched itself to Okta, Google Workspace or another provider does that with **Switch back to passwords** on the Sign-in card of the Organization tab; where support set up your sign-in, or it is Microsoft, ask support. Then choose Free again. See [Switching back to passwords](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `plan_free_sign_in`

> This is the organization Clock Clerk is run from, and the Free plan would cap it. Its plan is set on the operations screen.

**Why:** On a deployment you run yourself, the organization the operators sign in to cannot be put on the Free plan, because its limits would cap the people running it.

**What to do:** Nothing needs choosing here. An operator sets this organization's plan on the operations screen.

Code `plan_free_home`

## Expenses

> *days* has been submitted for approval, and its expenses with it. Reopen it before changing them.

**Why:** You tried to add, change or delete an expense claim, or attach, replace or remove its receipt, and the claim is dated in a week (or part of a week) that has been submitted. A claim is submitted with the week it is dated in, and is read-only with it.

**What to do:** Reopen the week on My Week with **Reopen week**, if you have the permission and it is not approved yet, or ask the person who reviews your time to send it back. Then change the claim and submit the week again. See [Why an expense cannot be changed](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `expense_period_submitted`

> This expense is on invoice *invoice number*. Void it before changing the expense.

**Why:** The claim has been billed: it is a line on a client's invoice, a draft included. A billed claim cannot change, nor can a reviewer decline or allow it.

**What to do:** Ask someone in Finance or an administrator to remove the claim's line from the draft, discard the draft, or void the invoice. The claim goes back among the unbilled ones and can be changed. See [Discarding and voiding](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `expense_invoiced`

> This expense is on acceptance protocol *protocol number*. Ask for it to be returned before changing the expense.

**Why:** The claim is a contractor's, paid back on their month's acceptance protocol, which has been submitted and is still under review. While it is on the protocol it cannot be changed, declined or allowed.

**What to do:** The contractor chooses **Withdraw** on My Month while the month is **Awaiting sign-off**; after that, the engagement manager, Finance or an administrator chooses **Return to contractor**. See [Contractors' expenses](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `expense_on_protocol`

> This expense is on acceptance protocol *protocol number*, which has been paid. It is final.

> This expense is on acceptance protocol *protocol number*, which has been approved for payment. It is final.

**Why:** The claim is on a contractor's acceptance protocol that has been approved for payment or paid. Such a month can no longer be withdrawn or returned, so the claim is settled for good.

**What to do:** Nothing in Clock Clerk reopens it. If the claim was wrong, raise it with Finance or an administrator. See [What the contractor lock freezes](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `expense_protocol_final`

> This expense was paid back in reimbursement batch *batch number*. It is final.

**Why:** The claim has already been paid back to its claimant in a reimbursement run, the batch the message names. Finance or an administrator exported that run, and nothing undoes it.

**What to do:** Nothing in Clock Clerk changes it now. If the amount was wrong, sort it out with Finance directly. The claim's week can still be reopened for its hours. See [Pay it back](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `expense_reimbursed`

> This expense was sent to *ERP*, which may have paid it. Change it in *ERP* instead.

**Why:** Your organization sends approved, reimbursable claims to its ERP, and this one has gone there, so the ERP may already have paid it. Changing, deleting, declining or allowing it in Clock Clerk is refused, so the two cannot disagree.

**What to do:** Make the correction in the ERP the message names, or ask Finance to. See [What is sent, and when](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `expense_sent_to_erp`

> A receipt can be up to 5 MB.

**Why:** The file you picked for a receipt is bigger than 5 MB, the most a receipt can be.

**What to do:** Take a smaller photo, or save the receipt as a PDF, and choose **Attach receipt** (or **Replace**) again. See [Attach the receipt](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `receipt_too_large`

> A receipt is a photo (JPEG, PNG or HEIC) or a PDF.

**Why:** The file you picked is not a photo (JPEG, PNG or HEIC) or a PDF. Clock Clerk checks what the file actually contains, not only its name, so renaming a file does not get it through.

**What to do:** Save or export the receipt as a PDF, or take a photo of it, and attach that instead. See [Attach the receipt](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `receipt_type`

## Approvals

> There is nothing to approve — the *days* part of this week has not been submitted.

> There is nothing to approve — this week has not been submitted.

**Why:** You chose to approve a week, or one month's part of it, that is no longer submitted. Usually the person reopened it, or another reviewer sent it back, while you had it open.

**What to do:** Nothing to do for now. The week comes back to **Pending** on Approvals when the person submits it again. See [When something goes wrong](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `nothing_to_approve`

> There is nothing to send back — the *days* part of this week has not been submitted.

> There is nothing to send back — this week has not been submitted.

**Why:** You chose to send back a week, or one month's part of it, that is not submitted. Usually the person reopened it while you had it open, or it was never submitted. A week another reviewer has already sent back is not refused: sending it back again goes through, and your reason replaces theirs.

**What to do:** Nothing to do: the week is already open for the person to change. It comes back to **Pending** when they submit it again. See [Or send it back](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `nothing_to_send_back`

> Say what needs to change — the reason is what the week is sent back with.

**Why:** You chose **Send back** without a reason. The reason is required, because it is what the person reads above their week (and in their email) to know what to change.

**What to do:** Write what needs to change under the reason in the **Send back for changes** dialog, or start from one of the ready-made reasons above it, and choose **Send back** again. See [Or send it back](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `send_back_reason_required`

> Keep the reason to *maximum* characters or fewer.

**Why:** The reason you wrote for sending the week back, or for **Edit reason**, is longer than the limit the message names (1,000 characters).

**What to do:** Shorten the reason and choose **Send back** again. See [Or send it back](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `send_back_reason_too_long`

> You cannot review your own week.

**Why:** You tried to approve or reopen your own week. Nobody reviews their own work, except an administrator, who has nobody above them. Finance sees their own week in the queue, marked **Your week**, but cannot decide it.

**What to do:** Another reviewer decides it: someone else in Finance, an administrator, or a manager over all of its projects. See [Your own week](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `own_week`

> You cannot send your own week back — withdraw the submission from your own sheet instead.

**Why:** You tried to send back your own week. Nobody can send their own week back, whatever their role, an administrator included.

**What to do:** To change a week you submitted, choose **Reopen week** on My Week, if you have the **Can reopen a submitted week** permission and the week is not approved, or ask your own reviewer to send it back. See [Reopening a week yourself](https://clockclerk.com/guide/workflows/record-your-week.md).

Code `own_week_send_back`

> Part of this period is booked to projects you do not oversee, so it is not yours alone to decide. Somebody who oversees all of it — or an administrator — has to.

**Why:** You tried to approve, send back or reopen a week that also has hours on projects you do not manage. A Manager sees and decides only the hours on the projects their grants cover, so this week is not theirs alone to decide. The week says how many lines are not shown.

**What to do:** Ask someone who oversees all of it: Finance, an administrator, or a manager whose grants cover every project on the week. If you should oversee those projects too, an administrator changes your grants under **Settings → People**. See [Who reviews whose time](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `period_withheld`

> These hours were being queued for export at the same moment, so nothing was saved. Please try again.

**Why:** Your organization exports approved hours to an ERP. You approved a week (or countersigned a contractor's month) at the very moment the export was queuing the same hours, so nothing was saved.

**What to do:** Try again; it goes through on the second attempt. See [What is sent, and when](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `export_race`

> You cannot decline or allow your own expense.

**Why:** You tried to decline or allow one of your own expense claims. Nobody decides their own claims, at any role, an administrator included, so **Decline** is not offered on them.

**What to do:** Another reviewer of the week decides it. If you would not claim it, change or delete it yourself while its week is still open. See [Review the claims](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `own_expense`

> This expense has not been submitted yet, so it is still its owner's to change.

**Why:** You tried to decline or allow a claim whose week has not been submitted, or has been reopened since. Until then it is still the claimant's draft, which they can change themselves.

**What to do:** Wait for the person to submit the week; the claim can be decided on Approvals then. See [Review the claims](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `expense_not_submitted`

> *name* decided this expense, and only Finance or an administrator can change their decision.

**Why:** You are a Manager, and the last decision on this claim was made by someone in Finance or an administrator, named in the message. Their decisions rank above a manager's, because an expense is money.

**What to do:** If you think it should change, ask the person named, or anyone else in Finance or an administrator, to choose **Decline** or **Allow**. See [Review the claims](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `expense_overruled`

> This expense is already declined.

**Why:** You chose **Decline** on a claim that is already declined, usually because someone else declined it, or you did in another tab, while this page was open.

**What to do:** Nothing to do. Reload the week to see who declined it and why. See [Review the claims](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `expense_already_declined`

> This expense is not declined.

**Why:** You chose **Allow** on a claim that is not declined, usually because someone else allowed it, or you did in another tab, while this page was open.

**What to do:** Nothing to do. Reload the week to see its current state. See [Review the claims](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `expense_not_declined`

> This expense's month went out on acceptance protocol *protocol number* without it. Ask for the month to be returned before declining or allowing the expense.

**Why:** The claim is a contractor's and is dated in a month that has been submitted on an acceptance protocol without it, for example because it was declined at the time. A month pays back the claims that stood when it was submitted, so deciding this one now would change nothing that gets paid.

**What to do:** Have the month returned first: the engagement manager, Finance or an administrator chooses **Return to contractor**. Then decide the claim, and the contractor submits the month again. See [Sending a month back](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `expense_month_frozen`

> This expense's month went out on acceptance protocol *protocol number* without it, which has been paid. It is final.

> This expense's month went out on acceptance protocol *protocol number* without it, which has been approved for payment. It is final.

**Why:** The claim is a contractor's, dated in a month that went out on an acceptance protocol without it, and that month has since been approved for payment or paid. It can no longer be returned, so the decision on this claim is final.

**What to do:** Nothing in Clock Clerk changes it now. If the contractor is owed it, raise it with Finance. See [Contractors' expenses](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md).

Code `expense_month_final`

## Team

> You cannot remind yourself about your own week.

**Why:** You tried to send a reminder about your own week. Nobody can remind themselves, whatever their role, so the reminder button is never shown on your own week and **Remind all** leaves you out.

**What to do:** Submit the week yourself on My Week with **Submit week**. See [Your own week](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `own_week_remind`

> There is nothing to remind about — the *days* part of this week has been submitted.

> There is nothing to remind about — this week has been submitted.

**Why:** You chose **Email reminder** for a week, or one month's part of it, that the person has submitted in the meantime.

**What to do:** Nothing to do: the week is now under **Pending** on Approvals, ready to decide. See [Reminding someone who has not submitted](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `nothing_to_remind`

> *name* was not here for the *days* part of this week.

> *name* was not here for this week.

**Why:** You tried to remind someone about a week, or part of one, that falls before their start date or after their last day. Nobody is asked for weeks outside their time with the organization.

**What to do:** No reminder is needed. If the dates are wrong, an administrator corrects **Started** or **Left** on the person's page under **Settings → People**. See [When somebody leaves](https://clockclerk.com/guide/screens/admin-people.md).

Code `not_here`

> *name* has not signed in yet, so there is nothing to remind them about.

**Why:** You tried to remind someone who has been added to the organization but has never signed in. They show as **Not signed in yet** and have no reminder button, because what they need first is their invitation.

**What to do:** Ask an administrator to send it again with **Resend invitation**, or **Copy invitation**, on the person's page under **Settings → People**. See [The invitation](https://clockclerk.com/guide/screens/admin-people.md).

Code `never_signed_in`

## Your profile and password

> The billing role “*role*” has been archived, so it cannot be your default. Pick another role.

**Why:** On My profile, you chose a **Default billing role** that Finance or an administrator has archived. No new work can be booked as an archived role, so it cannot be what your new lines start with. A default you chose before the role was archived stays until you change it.

**What to do:** Pick another role under **Default billing role**. See [Set your timesheet defaults](https://clockclerk.com/guide/workflows/your-account.md).

Code `default_role_archived`

> That activity is not in the catalog, or is no longer active.

**Why:** On My profile, you chose a **Default activity** that an administrator has deactivated or removed from the catalog since your page loaded. Only active activities can be a default, because only they are offered for new lines.

**What to do:** Reload My profile and pick one of the activities in the list. If the one you need is gone, ask an administrator; they can **Activate** it again under **Activities**. See [Deactivating an activity](https://clockclerk.com/guide/screens/admin-activities.md).

Code `default_activity_unavailable`

> A daily target must be between *minimum* and *maximum* hours.

**Why:** The **Daily target hours** you set on My profile is outside the range the message names (from 1 to 24 hours).

**What to do:** Choose a value within that range. See [Set your timesheet defaults](https://clockclerk.com/guide/workflows/your-account.md).

Code `daily_target_range`

> A scroll step must be between *minimum* and *maximum* hours.

**Why:** The **Hours per scroll notch** you set on My profile is outside the range the message names.

**What to do:** Choose one of the values in the list: 0.1, 0.25, 0.5 or 1. See [Set your timesheet defaults](https://clockclerk.com/guide/workflows/your-account.md).

Code `scroll_step_range`

> Your current password is wrong

> Check it and try again. After several wrong passwords in a row an account is locked for a while; if you have forgotten yours, reset it.

**Why:** You chose **Change password** on My profile, but what you typed under **Current password** is not your password. Each wrong try counts: five in a row lock the password for 15 minutes. The page an emailed unlock link opens says *That password is wrong* for the same reason.

**What to do:** Type your current password again, carefully. If you have forgotten it, choose **Forgot your current password?**, which emails you a link to set a new one. See [Change your password](https://clockclerk.com/guide/workflows/your-account.md), or [A locked account](https://clockclerk.com/guide/signing-in.md) for the unlock link.

Code `current_password_wrong`

> Choose a different password

> This password has appeared in a known data breach, so it is one of the first an attacker would try. Choose a different one.

**Why:** The new password you chose, when changing it, resetting it, accepting an invitation or signing up, meets the rules but is on the list of passwords leaked from other websites' breaches, which attackers try first. It does not mean your account was breached, or that anybody knows the password is yours. Clock Clerk checks it with the Have I Been Pwned service by sending only the first five characters of a scrambled form of the password, never the password itself, so nothing that identifies it leaves Clock Clerk.

**What to do:** Choose a different password and try again; the link or form still works. One you use nowhere else, such as a few unrelated words together, is the safest. If you use the refused password on another website, change it there too. See [Change your password](https://clockclerk.com/guide/workflows/your-account.md).

Code `password_breached`

> Your password is locked for now

> There were several wrong passwords in a row. Wait a few minutes and try again.

**Why:** There were five wrong passwords in a row for your account, at sign-in or when changing it, so it is locked for 15 minutes. While it is locked even the right password is refused.

**What to do:** Wait 15 minutes and try again, or sign in at once with the link in the email *Your Clock Clerk password is locked for now* (see [A locked account](https://clockclerk.com/guide/signing-in.md)). If you have forgotten your password, reset it with **Forgot your current password?** on My profile, or **Forgot password?** on the sign-in page. See [Forgotten password](https://clockclerk.com/guide/signing-in.md).

Code `password_locked`

> Choose a different password

> A password must be at least *minimum* characters long.

> A password must be at most *maximum* characters long.

> A password must not be your email address.

> A password must contain at least one number.

> A password must contain at least one special character, such as ! or #.

**Why:** The new password you chose, when changing it, resetting it, accepting an invitation or signing up, breaks one of the rules, and the message names which. A password needs at least 8 characters, at least one number and one special character, and must not be your email address.

**What to do:** Choose a password that meets the rule named and try again. The hint under the new password says what is still missing as you type. See [Change your password](https://clockclerk.com/guide/workflows/your-account.md).

Code `password_policy`

> Two-step sign-in here is only for accounts that sign in with a password. Yours signs in with your identity provider, which asks for a second step itself if it is set to.

**Why:** Two-step sign-in, an authenticator app asked for beside your password, is offered to organizations whose people sign in to Clock Clerk with a password. Yours signs in with Microsoft, Okta or another identity provider, which checks who you are before Clock Clerk ever sees you.

**What to do:** Nothing in Clock Clerk. If you want a second step at sign-in, ask whoever looks after your organization’s identity provider; it is set up there. See [Two-step sign-in](https://clockclerk.com/guide/signing-in.md).

Code `second_factor_password_only`

> That code is wrong, or has already been used. Enter the code your authenticator app shows now.

**Why:** The six-digit code you typed is not one your authenticator app gives for your account at the moment, or it is one you have already used: each code works once, and a code from your app is good for about a minute and a half. Where a recovery code is accepted, as it is when you sign in, the one you typed is not one of yours, or you have already used it. Each wrong code counts: five in a row lock two-step sign-in for 15 minutes, and at sign-in they count toward your account’s lock as wrong passwords do.

**What to do:** Type the code your app shows now, for this account, and wait for the next one if it is about to change. If your phone’s clock is wrong, set it to update automatically. If you have lost the app, use one of your unused recovery codes: at sign-in, choose **Use a recovery code instead** (see [Recovery codes](https://clockclerk.com/guide/signing-in.md)).

Code `second_factor_code_wrong`

> There were several wrong codes in a row. Wait a few minutes and try again.

**Why:** Five wrong codes in a row were typed for your two-step sign-in, so for 15 minutes every code is refused, even the right one. At sign-in you see this too when your account is locked after several wrong passwords or codes, even though your password was right.

**What to do:** Wait 15 minutes, then type the code your authenticator app shows at that moment. If your account was locked, the email it sends you has a link that unlocks it (see [A locked account](https://clockclerk.com/guide/signing-in.md)); you are still asked for a code after it. If you did not type the wrong codes yourself, somebody else may know your password: change it once you are signed in.

Code `second_factor_locked`

> Two-step sign-in is already on. Turn it off first to set up a different app.

**Why:** You started setting up an authenticator app, but two-step sign-in is already on for your account with another one. You can have one at a time.

**What to do:** To move to a new phone or app, choose **Turn off** on [My profile](https://clockclerk.com/guide/screens/profile.md) with a code from the old app or a recovery code, then **Set up an authenticator app** again with the new one.

Code `second_factor_already_on`

> Two-step sign-in is not on for your account. If you were setting it up, start again.

**Why:** You tried to finish setting up two-step sign-in, turn it off or get new recovery codes, but it is not on for your account: it was turned off, perhaps in another browser, or the setup you were finishing was never started there.

**What to do:** If you were setting it up, start again from the beginning: you will get a new key for your authenticator app. Otherwise there is nothing to turn off.

Code `second_factor_off`

> Your organization requires two-step sign-in, so it can't be turned off. To move it to a new phone, ask an administrator to reset it, then set it up again when you next sign in. If you are an administrator yourself, ask another one, or Clock Clerk support if you are the only one.

**Why:** An administrator has made two-step sign-in a requirement for everybody in your organization, on the **Organization** tab, so nobody there can sign in with a password alone, and nobody can turn their own off.

**What to do:** Keep it on. To move it to a new phone, ask an administrator to reset your two-step sign-in on the **People** tab; the next time you sign in, Clock Clerk asks you to set it up again with the new phone. If you are an administrator yourself, you cannot reset your own: ask another administrator, or Clock Clerk support if you are the only one. See [When your organization requires it](https://clockclerk.com/guide/signing-in.md).

Code `second_factor_required`

> You can't reset your own two-step sign-in. Ask another administrator to reset it, or Clock Clerk support if you are the only one. If your organization doesn't require two-step sign-in, you can also turn it off on your profile with a code from your app or a recovery code.

**Why:** An administrator can reset somebody else’s two-step sign-in, but not their own. Otherwise a session left open on a shared computer would be enough to take the second step off an administrator’s account.

**What to do:** Ask another administrator in your organization to reset it for you on the **People** tab, or, if you are the only one, contact Clock Clerk support. If your organization does not require two-step sign-in, you can also turn it off yourself on your **Profile**, with a code from your authenticator app or one of your recovery codes; where it is required, that is refused. See [If you lose your phone](https://clockclerk.com/guide/signing-in.md).

Code `second_factor_reset_own`

> Sign in again

> This sign-in can't go on: it was already finished, it took more than a few minutes, or your password or two-step sign-in changed in the meantime. Sign in again.

**Why:** With two-step sign-in on, your password alone does not sign you in: Clock Clerk asks for a code next, and keeps your place for five minutes. The code was typed after that, or in a tab where you had already finished signing in. It also happens when your password was reset or two-step sign-in was turned off in the meantime.

**What to do:** Sign in again with your email and password, then type the code your authenticator app shows, or one of your recovery codes, straight away. See [Signing in with it](https://clockclerk.com/guide/signing-in.md).

Code `second_factor_challenge_ended`

> That passkey didn't work. Try again, or use a code from your authenticator app instead.

**Why:** Your browser's answer did not prove the passkey: it is not one added to your account here, it was made on a different site, the browser took longer than a few minutes, or the same key was already added. When adding one, it also happens if you start on one tab and finish on another.

**What to do:** Try again. At sign-in, if it keeps happening, type a code from your authenticator app or a recovery code instead. On your profile, choose **Add a passkey** again; if your browser says the key is already registered, it is already in your list. See [Passkeys](https://clockclerk.com/guide/signing-in.md).

Code `passkey_refused`

> You already have as many passkeys as one account may. Remove one you no longer use first.

**Why:** Each person can have up to ten passkeys.

**What to do:** On your profile, choose **Remove** beside a passkey you no longer use, then add the new one. See [Passkeys](https://clockclerk.com/guide/signing-in.md).

Code `passkey_limit`

> Passkeys can't be added here yet: this Clock Clerk has no public address for them to belong to. Ask whoever runs it to set one.

**Why:** A passkey belongs to the address it was made on, and this deployment of Clock Clerk has not been told its public address. The card normally hides **Add a passkey** in that case; you see this if it was taken away while the page was open.

**What to do:** Keep using your authenticator app. Whoever runs this Clock Clerk sets its public address (`App:PublicUrl`), and then passkeys can be added.

Code `passkeys_unavailable`

## Plans, the trial and the demo

> *feature* are not part of the *plan* plan. An administrator can move the organization to *plan* to use them.

> *feature* are not part of your plan. An administrator can move the organization to *plan* to use them.

*feature* is one of: Contractor protocols and payments, Invoices, Cost cards, Reminders and the weekly digest, Your logo and brand color, Holiday schedules, Task imports from other tools, Exports to an ERP, Exports to SAP, Oracle, NetSuite, Dynamics 365, Sage Intacct, Acumatica and Workday, Threads shared with your clients, SCIM tokens for your identity provider, Sign-ins through Okta, Google Workspace, Microsoft or another identity provider.

*plan* is one of: any paid plan, the Enterprise plan, the Team plan.

**Why:** Your organization's plan does not include the feature you tried to use, named in the message. Screens a plan leaves out are not in the menu, so you usually meet this through an old link, or after the organization moved to a smaller plan. Anything entered before is kept.

**What to do:** Only an administrator can change the plan, to the one the message names: from **Choose a plan** on the Plans page, or from the Plan & billing card on the Organization tab. See [What each plan includes](https://clockclerk.com/guide/screens/trial.md).

Code `plan_feature`

> An administrator has turned Expenses off for this organization. Everything already in it is kept, and comes back when it is turned on again.

> An administrator has turned Boards off for this organization. Everything already in it is kept, and comes back when it is turned on again.

> An administrator has turned Messages off for this organization. Everything already in it is kept, and comes back when it is turned on again.

> An administrator has turned this feature off for this organization. Everything already in it is kept, and comes back when it is turned on again.

**Why:** Your organization's plan includes the feature, but an administrator has chosen not to use it, so it is hidden and closed for everybody in the organization. Only Expenses, Boards and Messages can be turned off this way; time tracking always stays on. Nothing is deleted: everything entered before is kept as it was. You usually meet this through an old link or bookmark, or on a screen that was already open when the feature was turned off.

**What to do:** If you need the feature, ask an administrator to turn it back on for the organization. Everything comes back as it was. Reload the page to see the menu as it is now.

Code `feature_off`

> Clock Clerk is read-only for your organization until a plan is chosen. Everything already recorded is still here and can still be read, reported on and exported.

**Why:** Your organization's free trial has ended without a plan being chosen, so Clock Clerk is read-only for everybody. Nothing is deleted: you can still sign in, read every screen, run and download reports and change your own profile settings, but nothing can be added or changed.

**What to do:** Ask an administrator to choose a plan with **Choose a plan** in the notice at the top. If the trial has not been extended before, they can also ask for more days once on the Plans page. See [When the trial ends](https://clockclerk.com/guide/screens/trial.md).

Code `trial_expired`

> Clock Clerk is read-only for your organization until the subscription is paid for again. An administrator can choose a plan, or pay through Manage billing, on the Organization tab. Everything already recorded is still here and can still be read, reported on and exported.

**Why:** Your organization's paid subscription has ended, so Clock Clerk is read-only for everybody. That happens in one of two ways: its last payment was never made, or it was canceled and has run out. Nothing is deleted, and everything can still be read, reported on and exported.

**What to do:** Ask an administrator to look at the **Plan & billing** card on the Organization tab, which says which of the two it is. If a payment was never made, they pay the open invoice with **Pay now** or **Manage billing**; a plan can't be chosen while that subscription is still open, and the organization opens again once the payment goes through. If the subscription was canceled, there is nothing left to pay: they choose a plan to start a new one. See [When the organization is read-only](https://clockclerk.com/guide/roles.md).

Code `subscription_lapsed`

> Your organization is being deleted on *date*, so Clock Clerk is read-only for it until then. An administrator can undo the deletion on the Organization tab; everything recorded can still be read and downloaded.

**Why:** One of your organization's administrators has asked for it to be deleted. Until the day it goes, nothing new can be recorded or changed, but everybody can still sign in and read everything.

**What to do:** If the organization should be kept, ask an administrator to choose **Undo deletion** on the [Delete organization](https://clockclerk.com/guide/screens/admin-organization.md) card before that day; it then works as before. Otherwise, take what you need: an administrator can still [download your data](https://clockclerk.com/guide/screens/admin-organization.md).

Code `org_removal_pending`

> *name* is one of the demo's personas, so their role, dates and access stay as they are for whoever signs in as them next. Try it on anybody else.

> This is the live demo, so nobody is sent an invitation. Add the person without one.

> This is the live demo, which everybody shares, so this is switched off here.

**Why:** You are in the live demo, a sample organization every visitor shares and that resets every hour. Anything that would outlive your visit or reach real people is switched off there, for example sending invitations, writing to support, setting or resetting passwords, renaming the organization, integrations, and changing the role, dates or access of the three demo personas other visitors sign in as.

**What to do:** Try the same thing on another of the sample people, or add a person without an invitation. To try everything with your own data, start your own free trial from **Start your own trial** in the demo's banner. See [Start your trial](https://clockclerk.com/guide/screens/setup.md).

Code `demo_read_only`

> Choose one of: *personas*.

**Why:** The live demo was asked to sign you in as a persona it does not have, for example from a mistyped or outdated link. The demo has three: an administrator, a manager and an employee.

**What to do:** On the demo's sign-in page, choose one of the cards: **Explore as Administrator**, **Explore as Manager** or **Explore as Employee**.

Code `unknown_persona`

> Somebody else’s visit changed this account. The demo resets every hour; try another persona meanwhile.

**Why:** Something another visitor did in the live demo has left this persona unable to sign in for now. The demo puts everything back when it resets, which it does every hour.

**What to do:** Choose another persona for now, and try this one again after the next hourly reset.

Code `persona_unavailable`

## Signing in

> Check them and try again. After several wrong passwords in a row an account is locked for a while; if you have forgotten yours, reset it.

**Why:** You signed in with an email address and password, and they did not match an account here. The page gives the same answer whatever was wrong, so it never reveals whether an address has an account. Five wrong passwords in a row lock the account for 15 minutes, and a locked account refuses even the right password.

**What to do:** Check the address and the password, and that you are not typing your Microsoft password into an organization that signs in with a password. If you have forgotten it, choose **Forgot password?** on the sign-in page; see [Forgotten password](https://clockclerk.com/guide/signing-in.md). If you have been locked out, you have been emailed a link that signs you in with your password straight away, whoever is typing wrong ones (see [A locked account](https://clockclerk.com/guide/signing-in.md)); or wait 15 minutes and try again.

Code `invalid_credentials`

> Your session has ended

> Sign in again.

**Why:** Your password sign-in can no longer be renewed. That happens when you have not used Clock Clerk on that browser for 14 days, when you chose **Sign out everywhere** or changed or reset your password in another browser, or when your **Left** date in the organization passed while you were signed in.

**What to do:** Sign in again; you go back to the page you were on. See [Signing in with a password](https://clockclerk.com/guide/signing-in.md). If your **Left** date has passed, signing in is refused too; see [When somebody leaves](https://clockclerk.com/guide/screens/admin-people.md).

Code `session_ended`

> Your access has ended

> Your time with this organization has ended. If you should still have access, ask its administrator.

**Why:** Your **Left** date in this organization has passed. An administrator sets that date on the People tab when someone leaves, and if your organization adds people from its identity provider, deactivating you there sets it too. After it you can no longer sign in, whether with a password, Microsoft, Okta or your organization's own sign-in, and if you were still signed in, you are turned away at your next step.

**What to do:** If you should still have access, ask an administrator of the organization to clear or move your **Left** date on the **People** tab. See [People: when someone leaves](https://clockclerk.com/guide/screens/admin-people.md).

Code `tenure_ended`

> It has been used, has expired or has been replaced by a newer one. Sign up again for a new one.

> It has been used, has expired or has been replaced by a newer one. Ask for a new one — from the sign-in screen, or from your administrator.

**Why:** You followed a link from an email that no longer works: an invitation, a password reset, a locked account's unlock link or a sign-up link. Each works once and for a limited time (an invitation 7 days, a reset an hour, an unlock link or a sign-up link 24 hours), and asking for a new one cancels the old.

**What to do:** Ask for a new link. For a reset, choose **Forgot password?** on the sign-in page; for an invitation, ask whoever invited you to send it again; for a sign-up, use **Sign up again**. An unlock link is replaced by the next one the account is sent, and the lock it was for lifts by itself after 15 minutes. Then use the newest email. See [Accepting an invitation](https://clockclerk.com/guide/signing-in.md).

Code `link_invalid`

> Your organization has not been set up yet

> Clock Clerk does not serve your organization yet. A Microsoft Entra administrator of it has to grant consent before anybody can sign in.

**Why:** You signed in with Microsoft from an organization Clock Clerk does not serve yet. Before anyone from it can sign in, one of its Microsoft Entra administrators has to grant admin consent. Your own account is fine.

**What to do:** If you are a Microsoft Entra administrator, choose **Grant admin consent**; you become the organization's first Clock Clerk administrator. Otherwise choose **Copy these instructions** and send them to one. See [Admin consent](https://clockclerk.com/guide/screens/setup.md).

Code `tenant_not_onboarded`

> Your organization’s access has been suspended

> Clock Clerk has stopped serving your organization. Your account and its data are untouched — ask whoever runs this deployment to restore access.

**Why:** Whoever runs this deployment has stopped serving your organization, so nobody in it can sign in. Nothing has been deleted, and granting admin consent again does not reopen it.

**What to do:** Ask your organization's administrator, or whoever runs this deployment, why access was stopped and to restore it. Once they have, reload the page and Clock Clerk opens as usual. See [Admin consent](https://clockclerk.com/guide/screens/setup.md).

Code `tenant_suspended`

> You have not been invited yet

> Your administrator hasn't added you yet. Ask one of your organization's administrators to add you to Clock Clerk with the email address your Okta account uses, then sign in again.

**Why:** Your organization signs in with Okta, and Okta signed you in, but no one was added to Clock Clerk with the email address your Okta account uses. Okta organizations get no invitation email. Only people added on the People tab can sign in, and the first time you sign in, Clock Clerk finds you by that address. It has to be exactly the address an administrator added you with; only uppercase and lowercase may differ. Most often you were added under a different address, such as one used before your organization switched to Okta, or one that is spelled differently from your Okta account's.

**What to do:** Find the email address on your Okta account, and ask one of your organization's Clock Clerk administrators to check the address you were added with on the **People** tab. A sign-in address cannot be edited there. If yours differs, the way that always works is for your Okta administrator to change the address on your Okta account to the one you were added with. If you have never signed in to Clock Clerk in any way, not even with a password or Microsoft before your organization switched to Okta, and have not been sent messages, a Clock Clerk administrator can instead **Remove** you and add you again with your Okta address. Until one or the other happens, every sign-in is refused. If the person added under the wrong address is your organization's only administrator, nobody can sign in to fix it, so ask whoever runs Clock Clerk. Then sign in again with **Continue to Okta**. See [Accepting an invitation](https://clockclerk.com/guide/signing-in.md) and [People](https://clockclerk.com/guide/screens/admin-people.md).

Code `not_invited`

> Your organization signs in another way

> Your organization signs in to Clock Clerk another way. Sign out, then enter your work email to be sent to the sign-in your organization uses.

**Why:** You signed in a way your organization does not use, for example with Microsoft when it signs in with Okta or with a password. Each organization signs in one way only, and whoever runs this deployment sets it. It also happens just after an organization has changed how it signs in.

**What to do:** Sign out, then enter your work email on the sign-in page and choose **Continue**; it offers the right way in. If your organization has only just switched and that is a mistake, ask whoever runs this deployment. See [The sign-in page](https://clockclerk.com/guide/signing-in.md).

Code `sign_in_method_mismatch`

> Your organization signs in at another address

> Your organization signs in to Clock Clerk at its own address, not this one. Sign in there instead — a session started here does not carry over.

**Why:** Your organization signs in at an address of its own, such as `yourcompany.clockclerk.com`, or at the main address, and you signed in at the other one. A session lives in the browser at the address it was started on, so it cannot be carried over.

**What to do:** Sign in at your organization's address; the page offers it as a link where it knows it. If it does not, ask whoever runs this deployment which address is yours. See [The sign-in page](https://clockclerk.com/guide/signing-in.md).

Code `wrong_sign_in_host`

> That Google account isn’t in your organization’s Google Workspace. Sign in with your work Google account instead — a personal Gmail account can’t sign in here.

**Why:** Your organization signs in with Google Workspace, and Google signed you in with an account outside it: a personal Gmail account, or an account of another company's Workspace. Every Google account goes through the same Google sign-in, so Clock Clerk accepts only accounts Google says belong to your organization's Workspace domain.

**What to do:** Sign in again and, at Google, choose your work account, or use **Use another account** to add it. If you did use your work account, ask your Google Workspace administrator to check which domain it belongs to, and whoever runs this deployment which domain your organization is set up with. See [Signing in with Google Workspace](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `hosted_domain_mismatch`

> That’s a personal Microsoft account. Sign in with your work or school Microsoft account instead — a personal account can’t sign in to an organization here.

**Why:** You chose **Sign in with Microsoft**, and Microsoft signed you in with a personal Microsoft account, such as an Outlook.com or Xbox account, rather than a work or school account. A personal account belongs to no organization's directory, so Clock Clerk has no organization to sign it in to.

**What to do:** Sign in again and, at Microsoft, choose your work or school account, or use **Use another account** to add it. If your organization doesn't use Microsoft 365, sign in with your work email instead. See [The sign-in page](https://clockclerk.com/guide/signing-in.md).

Code `microsoft_personal_account`

> No organization signs in to Clock Clerk with your Microsoft work or school account yet. Sign in with your work email instead, or ask your administrator how your organization signs in.

**Why:** Microsoft signed you in with a work or school account, but no organization in Clock Clerk signs in through that account's Microsoft directory. Your organization may sign in another way, with email and password or another identity provider, or may not use Clock Clerk yet.

**What to do:** Enter your work email on the sign-in page to be sent to the way your organization signs in. If that doesn't find it either, ask your administrator whether your organization uses Clock Clerk. If it doesn't yet, start it: where the sign-in page offers **Start a free trial for your organization** beneath the message, choose it, then **Continue with Microsoft** (see [Signing up with Microsoft](https://clockclerk.com/guide/screens/setup.md)), or sign up with your work email. See [The sign-in page](https://clockclerk.com/guide/signing-in.md).

Code `microsoft_directory_not_served`

## Signing up

> That doesn't look like an email address.

**Why:** On the sign-up form, what you typed in **Work email** is not an email address. The contact form says the same of the address you gave it.

**What to do:** Check for a missing `@` or domain, or a stray space, and choose **Create workspace** again. See [Start your trial](https://clockclerk.com/guide/screens/setup.md).

Code `invalid_email`

> Addresses from alias, relay and throwaway mail services can't start an organization. Use your work email at your organization's own domain.

**Why:** You signed up with an address from an alias, forwarding relay or throwaway mail service. A new organization is tied to its email domain, so it has to start from an address at that domain.

**What to do:** Sign up with your work email at your organization's own domain. See [Start your trial](https://clockclerk.com/guide/screens/setup.md).

Code `anonymous_mail`

> An account is for an organization, so it starts from an address at your organization's own domain.

**Why:** You signed up with a personal address, such as one from a free webmail service. An organization in Clock Clerk is identified by its email domain, so it starts from an address at that domain.

**What to do:** Use your work email instead. If your organization already uses Clock Clerk, the emailed link tells you so and offers **Ask to join**. See [Start your trial](https://clockclerk.com/guide/screens/setup.md).

Code `free_mail`

> That name is too long. Shorten it, or leave it as your sign-up had it.

> Your full name, as your colleagues will see it. That one is too long.

**Why:** The name you gave is too long: **Full name** on the sign-up form, or **Your name** on the form that asks support to review a domain already taken.

**What to do:** Shorten it, then try again. On the review form you can also clear it, and the name you signed up with is used. See [The emailed link](https://clockclerk.com/guide/screens/setup.md).

Code `invalid_name`

> That message is too long. Tell us what you need in fewer words.

**Why:** On the **Ask us to review it** form, the message under **Why should we take another look?** is longer than the form takes.

**What to do:** Shorten the message and choose **Send for review** again. See [The emailed link](https://clockclerk.com/guide/screens/setup.md).

Code `invalid_message`

> Digits, spaces and + - ( ) . only — or leave it blank.

**Why:** On the **Ask us to review it** form, **Phone number (optional)** holds something other than digits, spaces and `+ - ( ) .`, has fewer than five digits, or is too long.

**What to do:** Correct the number, or leave the field blank, and choose **Send for review** again. See [The emailed link](https://clockclerk.com/guide/screens/setup.md).

Code `invalid_phone`

> Email *support address* instead.

> Ask whoever runs this deployment for help.

**Why:** Your domain already has an organization, and you chose **Ask to join** or **Ask us to review it**, but this deployment cannot pass messages on: it has no support address or no way to send mail, or sending just failed.

**What to do:** Email the support address shown instead, or, where none is shown, ask whoever runs this deployment for help. To join, you can also ask your organization's administrator directly to add you. See [The emailed link](https://clockclerk.com/guide/screens/setup.md).

Code `support_unavailable`

> To start an organization, tick the box to agree to the Terms and acknowledge the Privacy notice.

**Why:** An organization was about to be created, at the emailed link or by admin consent, but the request did not say the Terms were accepted. The button stays disabled until the box is ticked, so this usually means the page was out of date, a test sign-in with Okta came back after the link was asked for again, or a different Microsoft Entra administrator granted admin consent from copied instructions, in a browser where nobody ticked the box.

**What to do:** At the emailed link, tick **I agree to the Terms and acknowledge the Privacy notice** and choose the button again; your link still works. On the admin consent page, tick the box and choose **Grant admin consent** again, which takes you through Microsoft once more. See [Accepting the terms](https://clockclerk.com/guide/screens/setup.md).

Code `terms_not_accepted`

> This domain has already subscribed to Clock Clerk. If you do not have access to this subscription, please fill out the contact form so we can reach out to assist you.

**Why:** A Microsoft Entra administrator granted admin consent to set up an organization, but someone on the same email domain already has an organization in Clock Clerk. One domain holds one organization, and the message deliberately does not say whose.

**What to do:** Ask colleagues who already use Clock Clerk to have their administrator add you. If you think the organization is not yours, write to Clock Clerk using **Contact** at the foot of this site's pages. See [Admin consent](https://clockclerk.com/guide/screens/setup.md).

Code `domain_claimed`

## Writing to Clock Clerk

> Choose what your message is about from the list.

**Why:** On the contact form, no reason was chosen, or the one sent is not on the list. The reason decides who at Clock Clerk reads your message.

**What to do:** Choose the reason closest to what you need, or **Other**, and send the message again.

Code `invalid_contact_reason`

> Enter your name, so we know who to reply to — at most *number* characters.

**Why:** On the contact form, your name is blank or longer than the form takes.

**What to do:** Enter your name, shortened if need be, and send the message again.

Code `invalid_contact_name`

> Your organization's name can be at most *number* characters. Shorten it, or leave it blank.

**Why:** On the contact form, the organization you write for has a longer name than the form takes. The field is optional.

**What to do:** Shorten the name or clear the field, and send the message again. If you are signed in, Clock Clerk already knows which organization you are in.

Code `invalid_contact_organization`

> Tell us what you need, in at most *number* characters.

**Why:** On the contact form, the message is blank or longer than the form takes.

**What to do:** Write what you need, in fewer words if it was too long, and send it again. You can add more once we reply.

Code `invalid_contact_message`

> We can't take messages here right now. Email *support address* instead.

> We can't take messages here right now. Ask whoever runs this deployment for help.

**Why:** The contact form cannot pass messages on from here: this deployment has no contact address set, or no way to send mail. Nothing you wrote was kept.

**What to do:** Email the support address shown instead, or, where none is shown, ask whoever runs this deployment for help.

Code `contact_unavailable`

> This deployment can't send email, so it can't confirm a subscription.

**Why:** You asked for Clock Clerk's newsletter, but this deployment has no way to send mail, so it can't send the link that confirms your address. Nothing was kept.

**What to do:** Try again later, or [sign up from Clock Clerk's website](https://clockclerk.com/index.md).

Code `newsletter_unavailable`

> The wording has changed since you agreed to it. Read the new wording and sign up again.

**Why:** The sentence you agreed to when you asked for Clock Clerk's newsletter has changed since then, either before you pressed **Subscribe** or before you followed the link in the confirmation email. Your agreement only counts for the wording you actually read, so you weren't subscribed.

**What to do:** If you pressed **Subscribe**, the new sentence is already on the page: read it, and press **Subscribe** again if you still want the newsletter. If you followed the link in the email, press **Sign up again** beneath the message, read the new sentence, and press **Subscribe**. Either way, a new confirmation email will follow.

Code `newsletter_wording`

> This confirmation link has expired or isn't complete. Sign up again for a new one.

**Why:** The link in the email that confirms a newsletter subscription works for a week. This one is older than that, or your mail app cut part of it off. You weren't subscribed.

**What to do:** Press **Sign up again** beneath the message, enter your address, and follow the link in the new email within a week.

Code `newsletter_link_expired`

> No data processing agreement has been uploaded yet, so there is nothing to send. Upload one under Communications → DPA, then send it.

**Why:** Only the team running Clock Clerk sees this. No version of the data processing agreement has been uploaded, so there is no link to send. The Queries panel shows this message in place of a working **Send DPA** button. Nothing is emailed.

**What to do:** Under **Communications → DPA**, upload the approved agreement as a PDF with a label such as its date, then open the query again and choose **Send DPA**. If you are a customer who asked for the agreement, nothing is needed from you: we'll send it once it's ready.

Code `dpa_missing`

## Reaching another service

> The source refused the key. Check that it is right and has not expired.

**Why:** Clock Clerk reached the tool, but it turned the connection's key down, usually because the token was mistyped, has expired or was revoked. You see it from **Test connection** or in **Last test** on the Integrations tab, and a manager may meet it while importing tasks or Finance while reading an ERP's records.

**What to do:** An administrator creates a new key in the tool, then on **Settings → Integrations** chooses **Edit** on the connection, **Replace** beside the key, pastes it, saves and chooses **Test connection**. Managers and Finance users ask an administrator. See [Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_key_refused`

> The source accepted the key, but it does not have the access this needs. Check its scopes.

**Why:** The tool accepted the key, but the key, or the account it belongs to, is not allowed to read what Clock Clerk asks for: a missing scope such as Work Items (Read), or no access to the project, board or database.

**What to do:** In the tool, give the key the scope listed for that source, or give its owner access to what your managers import from; then test the connection again on **Settings → Integrations**. See [What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_key_forbidden`

> The source has nothing at that address. Check the URL and the organization or project name.

**Why:** The tool answered, but has nothing at the address the connection holds, or at the organization, project or board it names. Usually the URL has a typo, or names a project instead of the organization.

**What to do:** An administrator chooses **Edit** on the connection, checks the URL against the help under the field (for Azure DevOps Services, `https://dev.azure.com/your-organization` without a project), saves and tests again. See [What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_not_found`

> The source is limiting requests from this key. Try again in a few minutes.

**Why:** The tool is throttling requests from this key and kept doing so after Clock Clerk retried. This is the tool's own limit, often shared with everything else that uses the same key.

**What to do:** Nothing needs changing: wait a few minutes and try again. If it keeps happening, give Clock Clerk a key of its own. See [The connections](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_rate_limited`

> The source answered, but not as expected. Check that the URL points at the service itself.

**Why:** Something answered at the connection's address, but not the way the tool's API does, for example a sign-in page, a proxy or a different site.

**What to do:** An administrator chooses **Edit** and checks the URL points at the tool itself, such as your Jira site or Azure DevOps collection, not at a page in front of it, then tests again. See [Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_bad_response`

> The source has more items than one query can read. Narrow the filter.

**Why:** While importing tasks or linking a project, the filter you used matches more items than the tool will return to one query.

**What to do:** Narrow the list with the filters above it, such as a state, a sprint or a changed-since date, and try again. See [Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `integration_too_broad`

> The source couldn't be reached. Check the URL: it has to be an https address that is reachable from the internet.

**Why:** Clock Clerk could not reach the tool at all: the address is wrong, not https, not reachable from the internet (for example a server inside your own network), or the tool was down.

**What to do:** An administrator checks the URL is a full `https://` address reachable from the internet, with a publicly trusted certificate, and tests the connection again. If the address is right, try again later. See [Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_unreachable`

> Microsoft needs this connection to be signed in again. Reconnect it.

**Why:** An Azure DevOps Services connection that signs in with Microsoft has stopped working because Microsoft will no longer renew the sign-in, for example because the person who signed it in left, or it went unused for 90 days.

**What to do:** On **Settings → Integrations**, the connection's **Key** column reads *Not signed in · was …*. An administrator chooses **Sign in with Microsoft** on that row and signs in. Managers ask an administrator. See [Signing in with Microsoft](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_sign_in_lapsed`

> Sign in with Microsoft to finish setting up this connection.

**Why:** An Azure DevOps Services connection is set to sign in with Microsoft, but nobody has completed that sign-in yet, so it has nothing to test or import with.

**What to do:** An administrator chooses **Sign in with Microsoft** on the connection's row on **Settings → Integrations**. See [Signing in with Microsoft](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_not_signed_in`

> Microsoft needs consent to read Azure DevOps work items for this account. Sign in again, or ask a directory administrator to consent.

**Why:** Microsoft would not let the connection read Azure DevOps work items for the account that signed in, because nobody has agreed to that permission in your Microsoft directory.

**What to do:** An administrator chooses **Reconnect** on the connection's row on **Settings → Integrations** and accepts the permission when Microsoft asks; managers, who meet this while importing, ask an administrator to. If Microsoft says an administrator must approve it, ask one of your Microsoft Entra administrators to consent. See [Signing in with Microsoft](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_consent_required`

> Microsoft sign-in isn't set up correctly on this server. Ask whoever runs it to check its app registration.

**Why:** Microsoft refused this deployment's own app registration when the connection tried to sign in. That is a server setting, not something about your connection or account.

**What to do:** Nothing you change in Clock Clerk fixes it: ask whoever runs this deployment to check its Microsoft app registration and its credential. Until then, a connection can use a personal access token instead. See [What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_sign_in_misconfigured`

> Intuit needs this connection to be signed in to a QuickBooks Online company. Sign in with Intuit.

**Why:** A QuickBooks Online connection has no working Intuit sign-in: it was never signed in to a company, or Intuit stopped accepting the sign-in it had.

**What to do:** An administrator chooses **Sign in with Intuit** or **Reconnect** on the connection's row under ERP on **Settings → Integrations**, and picks the company. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `integration_intuit_sign_in_lapsed`

> This server's Intuit app isn't set up correctly. Ask whoever runs it to check its client id and secret.

**Why:** Intuit refused this deployment's own Intuit app while connecting QuickBooks Online. That is a server setting, not your QuickBooks company or account.

**What to do:** Ask whoever runs this deployment to check its Intuit app's client id and secret. See [Integrations: ERP](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_intuit_sign_in_misconfigured`

> Intuit couldn't finish the sign-in. Start again.

**Why:** You came back from Intuit's sign-in, but it could not be completed: the sign-in was interrupted, took too long, or Intuit could not be reached.

**What to do:** Start again with **Sign in with Intuit** or **Reconnect** on the connection's row, and finish choosing the company in one go. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `integration_intuit_sign_in_failed`

> This deployment has no public address for Intuit to send you back to, so it can't sign in to QuickBooks Online. Ask whoever runs it to set App:PublicUrl.

**Why:** You tried to sign a QuickBooks Online connection in to Intuit, but this deployment has not been told its own public web address, so Intuit would have nowhere to send you back to.

**What to do:** Only whoever runs this deployment can fix it, by setting `App:PublicUrl`. Until then QuickBooks Online cannot be connected here. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `integration_intuit_sign_in_no_address`

> The stored key can't be read any more. Enter it again and save the connection.

**Why:** The key stored for this connection can no longer be decrypted, usually because the deployment's encryption keys were changed or lost. The connection's other settings are fine.

**What to do:** An administrator chooses **Edit** on the connection on **Settings → Integrations**, enters the key again (or reconnects a Microsoft or Intuit sign-in), saves and tests it. See [Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_key_unreadable`

> The test failed unexpectedly. Try again, and if it keeps failing, contact support.

**Why:** Testing or reading from the connection failed in a way Clock Clerk did not expect, so it has no more specific reason to give.

**What to do:** Try again. If it keeps failing, contact support, and say which source and which button you used. See [The connections](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `integration_unexpected`

## People

> That person is no longer in the directory.

**Why:** An administrator of an organization that signs in with Microsoft added someone, but the directory has nobody with that Microsoft Entra object id: the person left the directory after being picked, or the id typed under **Add by hand** is wrong.

**What to do:** Search the directory again under **New person**, or copy the object id afresh from the person's page in the Microsoft Entra admin center. See [Adding somebody](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_not_in_directory`

> *name* is already in Clock Clerk.

**Why:** You tried to add someone from your Microsoft directory who already has a record in Clock Clerk, either added earlier or created when they first signed in. It also happens when another administrator added them at the same moment.

**What to do:** Nothing to add: find them in the list on the **People** tab and choose **Open** to set their role, grants and projects. See [The list](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_already_added`

> *name* is already in Clock Clerk at *email address*.

**Why:** You tried to add someone with an email address that another person in your organization already has. In an organization that signs in with a password or with Okta, the address is how a person signs in, so no two people can share it.

**What to do:** Open the existing person on the **People** tab instead; if they had left, clear their **Left** date. If the address was a mistake, use the right one. See [Adding somebody](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_email_taken`

> *name* is already a guest at *email address*. Convert the guest as you add them, so their messages stay theirs.

**Why:** The address you are adding belongs to one of your organization's client guests. Adding them as a separate person would make one person two authors in the same conversations.

**What to do:** Add them again and choose **Convert guest**, which the **New person** dialog offers for that address: their guest messages become theirs as a person, and their guest sign-in stops. See [Adding somebody](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_is_guest`

> The guest you chose to convert is no longer a guest at this address. Check the address and add them again.

**Why:** You chose **Convert guest**, but by the time you saved, the guest at that address was no longer there, for example because another administrator had already converted them, or the address had changed.

**What to do:** Close the dialog, check the **People** list for them, and if they are not there, open **New person** and add them again. See [Adding somebody](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_guest_gone`

> *name* has signed in, so their record cannot be removed. Change their role instead.

**Why:** You chose **Remove** for someone who has already signed in. Remove only takes back an invitation; once someone has signed in, their record may hold time and history that must stay.

**What to do:** Change their role instead, or, if they have left, set their **Left** date on the **People** tab. See [When somebody leaves](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_remove_signed_in`

> *name* has been sent messages, so their record cannot be removed. Set an end date for them instead.

**Why:** You chose **Remove** for someone who has never signed in, but colleagues have already written to them in Messages. Those messages are the senders' record too, so the person stays.

**What to do:** Set their **Left** date with **Edit** on the **People** tab instead. See [When somebody leaves](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_remove_has_messages`

> *name* was a guest in your shared threads and keeps that history, so their record cannot be removed. Set an end date for them instead.

**Why:** You chose **Remove** for someone who was converted from a client guest. Their guest history in your shared conversations now belongs to their record, so it cannot be deleted.

**What to do:** Set their **Left** date with **Edit** on the **People** tab instead. See [When somebody leaves](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_remove_was_guest`

> *name* was not added from the directory, so their record may hold recorded time and cannot be removed.

**Why:** You tried to remove someone whose record shows neither that it was added on the People tab nor that they ever signed in, such as a record older than Clock Clerk's keeping of those dates, or one brought in from an earlier system. Clock Clerk cannot be sure such a record holds no recorded time, so it is never deleted.

**What to do:** Set their **Left** date, or change their role, on the **People** tab instead. See [When somebody leaves](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_remove_not_added`

> You cannot give up your own administrator role. Ask another administrator.

**Why:** You tried to change your own role away from Admin. Only an administrator can make someone an administrator, so giving up your own role could leave nobody able to give it back.

**What to do:** Ask another administrator to change your role on the **People** tab. If there is none, make someone else an administrator first. See [A person's page](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_own_admin_role`

> The end date is before the start date.

**Why:** A person's **Left** date is earlier than their **Started** date. Dates that way round would mean no week was ever asked of them.

**What to do:** Correct one of the dates under **Time here** on their page, or in **Edit**, and save again. Either can be left blank. See [A person's page](https://clockclerk.com/guide/screens/admin-people.md).

Code `person_tenure_backwards`

> *name* countersigns for *contractors*. Name another engagement manager on those contractor profiles first.

**Why:** You tried to change the role of someone named as engagement manager on contractor profiles, or to turn off their **Can countersign contractor months**, so they could no longer countersign. Their contractors' months would then wait for a countersignature nobody could give.

**What to do:** On **Contractor profiles**, choose **Edit** on each contractor named and pick another **Engagement manager**, then change the role again. See [Contractor profiles](https://clockclerk.com/guide/screens/admin-contractors.md).

Code `person_still_countersigns`

> *name* has already signed in, so there is no invitation to copy.

**Why:** You chose **Copy invitation** or **New link** for someone who has already signed in. An invitation only exists until the first sign-in.

**What to do:** Nothing to send. If they have lost their password, they can choose **Forgot password?** on the sign-in page. See [Forgotten password](https://clockclerk.com/guide/signing-in.md).

Code `invitation_copy_signed_in`

> *name*’s tenure has ended, so there is no invitation to copy.

**Why:** You chose **Copy invitation** or **New link** for someone whose **Left** date has passed. A link would only end at a refusal, because people who have left cannot sign in.

**What to do:** If they should have access, clear or move their **Left** date with **Edit** on the **People** tab, then copy the invitation. See [When somebody leaves](https://clockclerk.com/guide/screens/admin-people.md).

Code `invitation_copy_tenure_ended`

> This deployment cannot send mail. Use Copy invitation instead, and ask whoever runs the deployment to configure a mail provider.

**Why:** You chose to email an invitation, but this deployment has no mail provider set up, or no public address for the link to point to, so it cannot send one.

**What to do:** Choose **Copy invitation** on the person's page and send the message yourself. To have invitations emailed, ask whoever runs this deployment to configure mail. See [The invitation](https://clockclerk.com/guide/screens/admin-people.md).

Code `invitation_mail_off`

> *name* has already signed in, so there is no invitation to send.

**Why:** You chose **Send invitation** or **Resend invitation** for someone who has already signed in, so there is nothing left to invite them to.

**What to do:** Nothing to send: they are already in. If they cannot sign in now, see [When it does not work](https://clockclerk.com/guide/signing-in.md), or check their invitation on the [People](https://clockclerk.com/guide/screens/admin-people.md) tab.

Code `invitation_signed_in`

> *name* has no email address on their record, so there is nowhere to send it. Use Copy invitation instead.

**Why:** You chose to email an invitation to someone with no email address on their record, such as a person added by hand from a Microsoft directory without one.

**What to do:** Choose **Copy invitation** and send the message to them yourself. See [The invitation](https://clockclerk.com/guide/screens/admin-people.md).

Code `invitation_no_address`

> During the trial, invitations are only emailed to addresses at *domain*. Use Copy invitation and send *name* the link yourself.

**Why:** During the trial, invitations are only emailed to addresses at your organization's own domain, and this person's address is elsewhere. In a password organization that is the domain it signed up with; in a Microsoft organization, the domain of your own sign-in name.

**What to do:** Choose **Copy invitation** on the person's page and send them the link yourself. The limit lasts only as long as the trial. See [The invitation](https://clockclerk.com/guide/screens/admin-people.md).

Code `invitation_trial_domain`

> During the trial, invitations are only emailed to the domain this organization signed up with, and it has none on record. Use Copy invitation instead.

**Why:** During the trial, invitations are only emailed to the domain a password organization signed up with, and your organization has no such domain on record, so none can be emailed.

**What to do:** Choose **Copy invitation** on the person's page and send the message yourself. See [The invitation](https://clockclerk.com/guide/screens/admin-people.md).

Code `invitation_trial_no_domain`

> During the trial, invitations are only emailed by an administrator who is a member of this organization’s directory. Use Copy invitation instead.

**Why:** During the trial of an organization that signs in with Microsoft, invitations go only to the domain of the inviting administrator's own sign-in, and your sign-in does not come from the organization's directory, so no domain can be vouched for.

**What to do:** Choose **Copy invitation** and send the message yourself, or ask an administrator who signs in with the organization's own Microsoft account to send it. See [The invitation](https://clockclerk.com/guide/screens/admin-people.md).

Code `invitation_trial_no_directory`

> Invitations from this organization are limited to *number* a minute and *number* a day. Wait a moment, or use Copy invitation.

**Why:** Your organization has emailed as many invitations as it may for now: 5 a minute and 50 a day, counted for the whole organization, whoever sends them. Invitations to guests in shared threads count toward the same limits. In an organization that signs in with a password, **Copy invitation** counts too, because it makes a new sign-in link each time.

**What to do:** Wait a minute and try again, or, if the day's limit is used up, try again tomorrow. In an organization that signs in with Microsoft, **Copy invitation** still works, and you can send the rest yourself. See [The invitation](https://clockclerk.com/guide/screens/admin-people.md).

Code `invitation_rate_limited`

> The directory could not be searched: this deployment could not get a Microsoft Graph token on your behalf. The usual cause is that admin consent for User.ReadBasic.All has not been granted on the API’s app registration; the other is that the API’s own credential has expired.

**Why:** An administrator searched the Microsoft directory under **New person**, or chose **Check again**, and Clock Clerk was not allowed to read it. Usually nobody has yet given the permission to read basic profiles (`User.ReadBasic.All`), which only a Microsoft Entra administrator can give; less often the deployment's own credential has expired.

**What to do:** Open **Set up search** in the **New person** dialog, or the setup guide on the Organization tab, and have your Microsoft Entra administrator follow its steps. Meanwhile use **Add by hand**. If the steps are done and it still fails, ask whoever runs this deployment. See [The directory setup guide](https://clockclerk.com/guide/screens/setup.md).

Code `directory_consent`

> The directory could not be searched: Microsoft Graph answered *status*.

**Why:** Searching or reading your Microsoft directory failed because Microsoft Graph answered with an error, shown as its status code. This is usually a temporary problem on Microsoft's side.

**What to do:** Try again in a few minutes. Meanwhile you can use **Add by hand** in the **New person** dialog. If it keeps failing, ask whoever runs this deployment. See [Adding somebody](https://clockclerk.com/guide/screens/admin-people.md).

Code `directory_unreachable`

> These steps only go to an address on your organization’s own domain, and your organization has not proved one yet. Copy a link to them instead and send it from your own email or chat.

**Why:** You chose **Email these steps** in the directory setup guide, but the steps are only emailed to an address on your organization's own domain, and no domain has been proved for it yet.

**What to do:** Choose **Open in your email app** under the message to write to that address from your own mailbox, with a link to the steps already in it. Or choose **Copy a link for your IT administrator** and send the link from your own email or chat. See [The directory setup guide](https://clockclerk.com/guide/screens/setup.md).

Code `directory_setup_no_domain`

> These steps only go to an address on your organization’s own domain (*domains*), so that this can’t be used to email anybody else. For anybody outside it, copy a link to them instead and send it from your own email or chat.

**Why:** You chose **Email these steps** with an address outside your organization's own domains. The steps only go to those domains, so the button cannot be used to email anybody else.

**What to do:** Enter your IT administrator's address at one of the domains listed. If they work somewhere else, choose **Open in your email app** under the message to write to them from your own mailbox, with a link to the steps already in it, or choose **Copy a link for your IT administrator** and send the link from your own email or chat. See [The directory setup guide](https://clockclerk.com/guide/screens/setup.md).

Code `directory_setup_other_domain`

> Copy these instructions and send them yourself instead.

**Why:** You chose **Email these steps**, but this deployment has no way to send email.

**What to do:** Choose **Copy these instructions** and send them yourself. See [The directory setup guide](https://clockclerk.com/guide/screens/setup.md).

Code `directory_setup_unavailable`

> *address* can’t be sent these steps.

**Why:** You chose **Email these steps**, and Clock Clerk will not send them to that address, for example because your organization is not active.

**What to do:** Choose **Copy these instructions** and send them yourself. See [The directory setup guide](https://clockclerk.com/guide/screens/setup.md).

Code `directory_setup_not_sendable`

> This directory setup link is not valid. It may have expired or been replaced by a newer one. Ask whoever sent it for a new link.

**Why:** You opened a link to an organization's directory setup steps that no longer works. A link lasts a week, and making a new one cancels the one before, so it has either expired or been replaced. A link that was copied incompletely looks the same.

**What to do:** Ask the person who sent you the link to send a new one. Only an administrator of their organization can make it. See [The directory setup guide](https://clockclerk.com/guide/screens/setup.md).

Code `directory_setup_link_invalid`

> The organization this link is for no longer needs these steps: it has stopped signing in to Clock Clerk with Microsoft Entra ID, or its account is no longer active. Ask whoever sent it what has changed.

**Why:** You opened a link to an organization's directory setup steps, but since the link was made the organization has stopped signing in with Microsoft Entra ID, or its access to Clock Clerk has been suspended. Either way there is nothing left to set up in its directory.

**What to do:** Nothing in your directory needs to change. Ask the person who sent you the link what has changed. See [The directory setup guide](https://clockclerk.com/guide/screens/setup.md).

Code `directory_setup_link_closed`

## Clients, projects, tasks and boards

> This client still has projects (*number*). Delete them first.

**Why:** An administrator deleted a client that still has projects under it, whatever their status, including ones with nothing in them yet. Deleting a client never takes its projects with it, so that nobody loses a project's tasks, rates and discussions by deleting something else.

**What to do:** Delete each project on the client's page first, then delete the client. A project with time logged against it can't be deleted; if the client has one, **Archive** the client instead. See [Archiving a client](https://clockclerk.com/guide/screens/clients.md).

Code `client_has_projects`

> Time has been logged against this client. Archive it instead, so its history stays on the record.

> This client has been invoiced. Archive it instead, so its history stays on the record.

> A contractor’s hours for this client have been protocolled. Archive it instead, so its history stays on the record.

> People from this client have been guests in a conversation. Archive it instead, so its history stays on the record.

> Email has been sent to people from this client. Archive it instead, so its history stays on the record.

> Something on the record names this client. Archive it instead, so its history stays on the record.

**Why:** An administrator deleted a client that has no projects but still has history: time logged against it, an invoice, a contractor's protocol with its hours, people from it invited into a conversation as guests, or email sent to them. The message says which. The last form means something came to name the client while it was being deleted. Nothing was deleted.

**What to do:** **Archive** the client instead. It leaves the register and the pickers, keeps its history, and can be restored later. See [Archiving a client](https://clockclerk.com/guide/screens/clients.md).

Code `client_has_history`

> This client is archived and takes no new projects. Restore it first.

**Why:** You added a project to a client that is archived. An archived client takes no new projects, so **New project** on an archived client only says so; this usually means an administrator archived the client while the dialog was open.

**What to do:** An administrator restores the client with **Restore client** on its page, or **Restore** on [Clients](https://clockclerk.com/guide/screens/clients.md), and then adds the project.

Code `project_client_archived`

> An archived client takes no new projects. Choose an active one.

**Why:** You copied a project into a client that is archived. An archived client takes no new projects, so **Copy project** only offers active clients; this usually means an administrator archived the client while the dialog was open.

**What to do:** Pick an active client under **Client** in **Copy project**. If the copy has to go under the archived client, an administrator restores it first with **Restore** on [Clients](https://clockclerk.com/guide/screens/clients.md).

Code `project_copy_client_archived`

> This project has *number* h logged against its tasks. Mark it Complete instead, so its history stays on the record.

> This project has time logged against one of its tasks. Mark it Complete instead, so its history stays on the record.

**Why:** You deleted a project with time logged against it: a line on somebody's week for one of its tasks. The message gives the hours in all; the second form means the lines have no hours in them yet, which still counts. Recorded time is never deleted with its project, so the project has to stay. Nothing was deleted.

**What to do:** Mark the project **Complete** instead with **Edit project**: it leaves the register but keeps its hours. See [Projects](https://clockclerk.com/guide/screens/projects.md).

Code `project_has_time`

> This project is on an invoice. Mark it Complete instead, so its history stays on the record.

> This project is in a contractor’s protocol. Mark it Complete instead, so its history stays on the record.

> Expenses have been claimed against this project. Mark it Complete instead, so its history stays on the record.

> Something on the record names this project. Mark it Complete instead, so its history stays on the record.

**Why:** You deleted a project that something other than its time keeps on the record: hours or expenses on an invoice, even a draft; a contractor's protocol with its hours or expenses; or an expense claimed against it. The message says which. The last form means something came to name the project, a line or an expense, while it was being deleted. Nothing was deleted.

**What to do:** Mark the project **Complete** instead with **Edit project**: it leaves the register but keeps its history. See [Projects](https://clockclerk.com/guide/screens/projects.md).

Code `project_has_history`

> That person is not on this project's team.

**Why:** You assigned a billing role to somebody who is not ticked on the project's team. Roles are only given to team members, and the person was probably taken off the team while your screen was open.

**What to do:** Reload the project's page and tick the person under **Team**. If the role is not already on, press its dashed chip again; pointing at it reads **Assign** and the role's name. See [The team and billing roles](https://clockclerk.com/guide/screens/projects.md).

Code `project_not_on_team`

> The billing role “*role*” has been archived, so it cannot be assigned. Pick another role.

**Why:** The billing role you picked has been archived by Finance or an administrator. An archived role cannot be newly assigned to anybody on a project, and no new line on a week can be booked as it. Lines and assignments that already carry it keep it.

**What to do:** Pick another billing role. If the role should still be used, a Finance user or administrator restores it under **Archived roles** on [Billing rates](https://clockclerk.com/guide/screens/finance.md).

Code `project_role_archived`

> This task has time logged against it and cannot be deleted.

**Why:** You deleted a task that is on a line of somebody's week, even a line with no hours in it yet. Recorded time is never deleted with its task, so the task has to stay.

**What to do:** Set the task's **Status** to **Done** with **Edit** instead, or move its card to a Done column. See [Tasks](https://clockclerk.com/guide/screens/projects.md).

Code `task_has_time`

> This project's board has no column for that status.

**Why:** You saved a task with a **Status** that none of the board's columns has. A task's status is always its column's category, so the board needs a column of that category, such as Blocked, for the task to sit in.

**What to do:** Choose another **Status**, or add a column of that category with **+ Add column** on the project's board first. See [Set up the columns](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `task_no_column`

> A task can only be restricted to users who are members of its project.

**Why:** Under **Task visibility** you chose **Selected users**, and one of them is not on the project's team. Only team members can be selected, and somebody may have been taken off the team while the form was open.

**What to do:** Reload the project's page and choose the people again from the team, or tick the person under **Team** first. See [Tasks](https://clockclerk.com/guide/screens/projects.md).

Code `task_restricted_to_non_member`

> A task can only be owned by a member of its project.

**Why:** The task's **Owner** is not on the project's team. A task is owned by one of the project's members, and the person may have been taken off the team while the form was open.

**What to do:** Pick an owner from the team, or **Nobody**, or tick the person under **Team** first. See [Tasks](https://clockclerk.com/guide/screens/projects.md).

Code `task_owner_not_member`

> A restricted task can only be owned by somebody it is visible to.

**Why:** The task is restricted to **Selected users**, and its **Owner** is not one of them. A restricted task's owner has to be somebody who can see it, and naming an owner never widens who sees it.

**What to do:** Tick the owner under **Selected users** too, pick an owner who is already ticked, or set **Task visibility** to **All project members**. See [Tasks](https://clockclerk.com/guide/screens/projects.md).

Code `task_owner_cannot_see`

> This board already has a column with that name.

**Why:** You added or renamed a column, and the board already has a column with that name. Names are unique on a board, ignoring capitals, so "Review" and "review" clash.

**What to do:** Choose another name. See [Set up the columns](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `stage_name_taken`

> A board needs at least one Done column, so this one cannot be deleted.

> A board needs at least one Done column, so this one has to stay Done.

**Why:** You deleted the board's only Done column, or used **Change category…** to make it something else. A board always keeps at least one Done column, because that is how a task is marked done and how open tasks are counted.

**What to do:** Add another column of category **Done** with **+ Add column** first, then delete or change this one. See [Set up the columns](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `stage_last_done`

> A board needs at least one column, so its last one cannot be deleted.

**Why:** You deleted the board's last column. A board always keeps at least one column, for its cards to sit in, and at least one Done column, so its last column is always a Done one.

**What to do:** Rename it with **Rename…** instead. Or add another column with **+ Add column**, with its **Category** set to **Done**, and then delete this one. See [Set up the columns](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `stage_last_column`

> The new order has to list each of this board's columns exactly once.

**Why:** You reordered the columns, but the board on your screen is out of date: somebody else added or deleted a column since it was loaded. Nothing was moved.

**What to do:** Reload the board and drag the column again, or use **Move left** and **Move right** in its **⋯** menu. See [Set up the columns](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `stage_order_stale`

> Cards can only be moved to another column of the same board.

**Why:** You deleted a column and chose where its cards go, but that column is not on this board any more, usually because somebody deleted it meanwhile. Nothing was deleted.

**What to do:** Reload the board, choose **Delete…** again and pick a column that is there under **Move the cards to**. See [Set up the columns](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `stage_move_elsewhere`

> This column has cards on it. Choose the column they should move to.

**Why:** You deleted a column that has cards on it without saying where they go. Cards are never deleted with their column; they move to another one. Somebody may have added a card since you opened the dialog.

**What to do:** Choose **Delete…** again, pick a column under **Move the cards to**, then choose **Delete column**. The cards land at the bottom of that column and take its category. See [Set up the columns](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `stage_has_cards`

> That column is not on this card's board.

**Why:** You moved a card to a column that is not on that card's board, usually because the column was deleted while your board was open.

**What to do:** Nothing needs fixing: reload the board and move the card again. See [Move cards as the work moves](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `board_card_column_elsewhere`

> That column is not on this board.

**Why:** You added a card to a column that is not on this board, usually because somebody deleted the column while your board was open.

**What to do:** Reload the board and use **+ Add card** under a column that is there. See [Add cards](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `board_column_elsewhere`

> The card to drop below is not in that column.

**Why:** You dropped a card below another card that is no longer in that column, because somebody moved it while your board was open. Nothing was moved.

**What to do:** Nothing needs fixing: reload the board and drop the card again. See [Move cards as the work moves](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md).

Code `board_after_not_in_column`

> Adding and editing tasks on this board needs an administrator's permission.

**Why:** You tried to add a card, or rename or describe one, as a member of the project. Only the project's managers can do that, and members an administrator has given **Can create tasks**.

**What to do:** Ask an administrator to turn on **Can create tasks** for you under **Permissions** on your page in **Settings → People**, or ask a manager of the project to add the task. See [Permissions for one person](https://clockclerk.com/guide/roles.md).

Code `board_may_not_write_cards`

> Only the person who wrote a message can change it.

**Why:** You tried to edit somebody else's message. A message carries its author's name, so only its author can change it, at any role.

**What to do:** Reply in the conversation instead, or ask the author to edit it. See [Write, edit and remove](https://clockclerk.com/guide/workflows/talk-with-your-team-and-clients.md).

Code `conversation_not_author`

> Only the person who wrote a message, or a manager of the project, can remove it.

**Why:** You tried to remove somebody else's message. Only the author can remove a message, and in a project's, card's or shared conversation, the project's managers too. Nobody else can, and in a direct conversation each person removes only their own. A guest can remove only their own messages.

**What to do:** Ask the message's author, or a manager of the project, to remove it. See [Who reads and writes where](https://clockclerk.com/guide/workflows/talk-with-your-team-and-clients.md).

Code `conversation_may_not_remove`

> This message has been removed.

**Why:** The message you were editing, removing, or looking at the earlier versions of was removed meanwhile, by its author or by a manager of the project.

**What to do:** Nothing needs doing. The conversation shows who removed it and when. See [Write, edit and remove](https://clockclerk.com/guide/workflows/talk-with-your-team-and-clients.md).

Code `conversation_message_removed`

> A conversation needs somebody else in it.

**Why:** You tried to start a direct conversation with yourself. A direct conversation is between you and one other person.

**What to do:** Choose somebody else under **New message** on Messages. See [Message one person](https://clockclerk.com/guide/workflows/talk-with-your-team-and-clients.md).

Code `conversation_direct_self`

> That person has left the organization, so they can't be sent new messages.

**Why:** You tried to message, or start a conversation with, somebody whose end date in the organization has passed. People who have left can't be sent new messages. Your earlier conversation with them can still be read.

**What to do:** Write to somebody who is still in the organization instead. If the person is back, an administrator clears their **Left** date on their page under [People](https://clockclerk.com/guide/screens/admin-people.md).

Code `conversation_person_left`

> A guest needs a name and a valid email address.

**Why:** You invited a guest without a **Name**, or with an **Email** that isn't a valid address.

**What to do:** Fill in both in **Invite a guest**, check the address for typos, and choose **Send invitation** again. See [Invite a guest](https://clockclerk.com/guide/workflows/talk-with-your-team-and-clients.md).

Code `guest_invalid`

> *email address* is already a guest for *client*, so they can't be invited for another client.

**Why:** The address you invited is already a guest of your organization for a different client. A guest belongs to one client and is only ever invited into that client's shared threads.

**What to do:** Invite somebody else at this client, or use a different address for this person. See [Invite a guest](https://clockclerk.com/guide/workflows/talk-with-your-team-and-clients.md).

Code `guest_other_client`

> *email address* is one of this organization's people now, so add them to the project instead of inviting them as a guest.

**Why:** The address you invited belonged to a guest who has since been added to your organization as one of its people. They read the project's shared threads by being on the project, not as a guest.

**What to do:** Put them on the project's team under **Team** on its page, or ask whoever runs the project. See [The team and billing roles](https://clockclerk.com/guide/screens/projects.md).

Code `guest_now_user`

> This deployment cannot send mail, so guests can't be invited. Ask whoever runs the deployment to configure a mail provider.

**Why:** Inviting a guest sends an email, and this deployment has no mail provider set up, or no public address for the link to point to. You won't see this on Clock Clerk's own service; it happens on a deployment whose operator hasn't configured email.

**What to do:** Ask whoever runs this deployment to configure a mail provider, then choose **Invite a guest** again. See [Invite a guest](https://clockclerk.com/guide/workflows/talk-with-your-team-and-clients.md).

Code `guest_invitation_mail_off`

> Invitations from this organization are limited to *number* a minute and *number* a day. Wait a moment and invite them again.

**Why:** Your organization has sent as many invitation emails as it may for now: 5 a minute and 50 a day. Invitations to guests and to colleagues count against the same limit.

**What to do:** Wait a minute and invite them again; if the day's limit is reached, try again tomorrow. See [Invite a guest](https://clockclerk.com/guide/workflows/talk-with-your-team-and-clients.md).

Code `guest_invitation_rate_limited`

> This link has expired or has already been used. Ask for a new one to be emailed to you.

**Why:** You opened a guest link that has already been used or has run out. An invitation's link works once, for 14 days, and a sign-in link once, for 30 minutes. It also stops working once you have been removed from every thread you were invited into.

**What to do:** Choose **Email me a new link**, enter the address you were invited at, and open the newest email. If nothing arrives, ask whoever invited you to invite you again. See [Sign in as a guest](https://clockclerk.com/guide/screens/guest.md).

Code `guest_link_invalid`

> This organization doesn't offer news about Clock Clerk to its guests.

**Why:** You ticked the box asking for news from Clock Clerk, but the organization that invited you stopped offering it after your page was opened.

**What to do:** Nothing needs doing; no news will be sent to you. See [The foot of the screen](https://clockclerk.com/guide/screens/guest.md).

Code `guest_news_off`

> The wording beside the box has changed since this page was opened. Reload it and read it again.

**Why:** You ticked the box asking for news from Clock Clerk, but the sentence beside it has changed since your page was opened. Your agreement only counts for the wording you actually read, so nothing was saved.

**What to do:** Reload the page, read the new sentence, and tick the box again if you still want the news. See [The foot of the screen](https://clockclerk.com/guide/screens/guest.md).

Code `guest_news_wording`

> Enter a valid email address.

**Why:** On your profile, under **Conversations shared with you**, you entered something that isn't a valid email address.

**What to do:** Type the full address you were invited at as a guest, then choose **Email me a link**. See [Conversations shared with you](https://clockclerk.com/guide/screens/profile.md).

Code `guest_account_link_email`

> Your account is already linked to *email address*. Unlink it first to link another address.

**Why:** Your account already has a guest address linked to it, and only one can be linked at a time.

**What to do:** Choose **Unlink** on your profile under **Conversations shared with you**, then link the other address. See [Conversations shared with you](https://clockclerk.com/guide/screens/profile.md).

Code `guest_account_link_exists`

> This confirmation link has expired, has already been used, or was asked for by somebody else. Ask for a new one from your profile, signed in as yourself.

**Why:** You opened a link to confirm a guest address, and it has run out, was already used, or was asked for from somebody else's account. The link only works while you are signed in as the person who asked for it. Asking again also replaces an older link.

**What to do:** Sign in as yourself, open your profile, and under **Conversations shared with you** choose **Send it again**, or enter the address and choose **Email me a link**. Open the newest email. See [Conversations shared with you](https://clockclerk.com/guide/screens/profile.md).

Code `guest_account_link_invalid`

> The confirmation couldn't be emailed. Try again later, or ask whoever runs the deployment to check its mail.

**Why:** The confirmation email for linking your guest address couldn't be sent: the deployment has no mail provider or no public address set up, or sending failed.

**What to do:** Try again later. If it keeps failing, ask whoever runs the deployment to check its mail. See [Conversations shared with you](https://clockclerk.com/guide/screens/profile.md).

Code `guest_account_link_mail_failed`

> That address has been sent *number* links this hour. Try again later.

**Why:** That address has already been sent 5 confirmation links in the last hour. The limit stops anybody flooding an inbox with links.

**What to do:** Open the newest link already in that inbox, or wait an hour and ask again. See [Conversations shared with you](https://clockclerk.com/guide/screens/profile.md).

Code `guest_account_link_rate_limited`

> There is already an expense category with that name.

**Why:** You created or renamed an expense category with a name another category already has. Names are unique, ignoring capitals, so inactive categories count too. Only administrators manage categories.

**What to do:** Choose another name, or **Edit** the existing category and tick **Active** again if it was deactivated. See [Adding and changing a category](https://clockclerk.com/guide/screens/admin-expense-categories.md).

Code `category_name_taken`

> Expenses have been claimed under this category. Deactivate it instead, so it stays on them and leaves the picker.

**Why:** You deleted an expense category that expenses have been claimed under. Deleting it would take it off those claims, so it can't go.

**What to do:** Choose **Edit** and clear **Active — offered on the claim form**. The category leaves the claim form and stays on the expenses already recorded. See [Deactivating or deleting a category](https://clockclerk.com/guide/screens/admin-expense-categories.md).

Code `category_in_use`

> The default activity has to be active and billable, because hours on projects that don't ask for an activity are booked on it.

**Why:** Under **Activities**, you deactivated your organization's default activity, made it **Non-billable**, or chose an inactive or non-billable activity as the default. Time on a project that doesn't ask for an activity is recorded under the default without anybody picking it. If the default were inactive, that time would have nothing to be recorded under. If it were non-billable, those hours would drop off the client's bill without anyone noticing.

**What to do:** To retire or stop billing that activity, first make another active, billable activity the default, then change the old one. Any other activity can be deactivated or made non-billable as before. See [Deactivating an activity](https://clockclerk.com/guide/screens/admin-activities.md).

Code `default_activity_protected`

> There is already a holiday on *date*.

**Why:** You added a holiday, or moved one, onto a date that already has a holiday. There is one holiday a day.

**What to do:** Choose another date, or **Edit** the holiday already on that day: rename it, or tick **Half day**. See [Adding, changing and removing a holiday](https://clockclerk.com/guide/screens/admin-holidays.md).

Code `holiday_date_taken`

> Holidays can be kept for *minimum* to *maximum*.

**Why:** You went to a year, or entered a date, outside the years holidays are kept for: 2000 to 2100. A year outside that is almost always a typing mistake.

**What to do:** Check the year in the **Date**, or use **‹** and **›** to stay within the range. See [The year's holidays](https://clockclerk.com/guide/screens/admin-holidays.md).

Code `holiday_year_range`

## Integrations and task imports

> Connected as *name* in *workspace*

> Connected as *name*

**Why:** This is not a refusal: it is what **Test connection** says when the address and key work. It names the account the key belongs to, and the workspace where the source has one, as the source reports them.

**What to do:** Nothing needs doing. Check that the account named is the one you meant: whoever owns the key has to be able to see the projects, boards or databases your managers import from ([Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_connected_as`

> There is already a connection called “*name*”.

**Why:** An administrator added or renamed a connection on **Settings → Integrations** with a name another connection in your organization already has. Connection names are unique, ignoring capitals, because managers pick a connection by its name.

**What to do:** Type a different **Name**, or **Edit** the existing connection instead of adding a second one ([The connections](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_name_taken`

> *service* connections aren't available on this deployment.

**Why:** The deployment you use does not offer this source or ERP, so a connection to it cannot be added, tested, signed in or have its settings changed. On the **Integrations** tab such a connection is marked **Not available here**. Which sources a deployment offers is decided by whoever runs it.

**What to do:** A connection marked **Not available here** can still be renamed, turned off with **Disable**, or deleted. To use the source, ask whoever runs this deployment to offer it ([The connections](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_not_available`

> “*name*” is already enabled as this organization's ERP. Hours go to one ERP at a time, so disable it before enabling another.

**Why:** An administrator tried to turn on an ERP connection, or save a new one turned on, while another ERP connection is already on. Only one ERP connection can be on at a time, so the same hours and cost are never booked twice.

**What to do:** On **Settings → Integrations**, under **ERP**, choose **Disable** on the connection the message names, then enable the new one. [Switching to another ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md) explains what the new connection starts with.

Code `integration_erp_taken`

> Projects import through this connection: *projects* and *number* more. Unlink them first, or disable the connection instead.

> Projects import through this connection: *projects*. Unlink them first, or disable the connection instead.

**Why:** An administrator chose **Delete** on a connection that projects still import through. A project's link points at its connection, so the connection cannot go while any project is linked to it. The message names the projects.

**What to do:** To stop imports but keep everything, choose **Disable** instead. To delete it, you or a manager of each project named opens **Import tasks** on the project's board and chooses **Unlink**; tasks already imported stay ([Importing again](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)). Then delete the connection ([Turning a connection off, and deleting it](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_linked`

> “*name*” has sent records the ERP accepted, and deleting it would delete the record of what was sent, so the same hours could be sent again. Disable the connection, or edit its key, instead.

**Why:** An administrator chose **Delete** on an ERP connection the ERP has already accepted records from. The connection keeps the record of what was sent, which is what stops the same hours being sent twice, so it cannot be deleted.

**What to do:** Choose **Disable** to stop exporting through it, or **Edit** to change its key. To move to another ERP, follow [Switching to another ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `integration_erp_accepted`

> “*name*” has records the ERP may hold that nobody has confirmed yet, so deleting it could lose the record of what the ERP holds. Check them in the ERP and clear them, or disable the connection instead.

**Why:** An administrator chose **Delete** on an ERP connection that has **Unresolved** postings: records whose answer was lost on every try, so the ERP may hold them. Deleting the connection would lose the record of them.

**What to do:** On **ERP export**, open the **Log**, choose **Resolve** on each unresolved posting and record what the ERP holds ([When something goes wrong](https://clockclerk.com/guide/workflows/export-to-your-erp.md)). Finance can do this too. Or choose **Disable** on the connection instead of deleting it.

Code `integration_erp_unresolved`

> “*name*” has records on their way to the ERP whose answer hasn't been recorded, so deleting it could lose the record of what the ERP holds. Wait for the export to finish (enable the connection if it is off), or disable it instead.

**Why:** An administrator chose **Delete** on an ERP connection with postings still **Sending**: sent to the ERP, with its answer not yet recorded. Deleting the connection now could lose the record of what the ERP holds.

**What to do:** Wait for the export to record the answers, which needs the connection to be on: if it is off, choose **Enable** for a while. Or choose **Disable** instead of deleting it ([Follow the export](https://clockclerk.com/guide/workflows/export-to-your-erp.md)).

Code `integration_erp_sending`

> *field* can be up to *maximum* characters.

**Why:** A field in the connection dialog on **Settings → Integrations** holds more characters than a setting can store. The message names the field and its limit.

**What to do:** Check that only the value itself was pasted into the field named, with nothing extra, and save again ([Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_setting_too_long`

> *field* couldn’t be opened with its password. Upload the PKCS#12 file (.pfx or .p12) that holds the certificate and its private key, with the password it was exported with.

**Why:** The client certificate uploaded for an ERP connection, such as SAP S/4HANA on premise, could not be opened with the password given, or it holds no private key. The app checks it when the connection is saved, rather than letting every call fail later.

**What to do:** Upload the PKCS#12 file (`.pfx` or `.p12`) that holds both the certificate and its private key, and type the password it was exported with. If you only changed the password, check it matches the file already stored ([Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md)).

Code `integration_certificate_unreadable`

> *field* must be a full https:// address.

**Why:** An address field in the connection dialog, such as an Organization URL, Site URL or Base URL, is not a full address starting with `https://`. Every connection sends its key with each request, so plain `http` and partial addresses are refused.

**What to do:** Paste the whole address, starting with `https://`. The source has to be reachable from the internet over https ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_setting_not_https`

> *field* must not contain a user name or password.

**Why:** An address field in the connection dialog has a user name or password in it, as in `https://name:password@host`. A key typed into an address would be stored unencrypted and shown back on the form.

**What to do:** Remove the user name and password from the address, and put the key or token in its own field, which is stored encrypted ([Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_setting_credentials`

> *field* must be an email address.

**Why:** A field that has to hold an email address, such as a Jira Cloud connection's **Account email**, holds something else.

**What to do:** Type the email address of the account the key or API token belongs to ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_setting_not_email`

> This sign-in link has expired or was not started here. Start again.

**Why:** You came back to the app from signing in with Microsoft or Intuit for a connection, but the sign-in had expired, was started for another connection, or was started by somebody else or in another organization. A sign-in has to be finished soon after it is started, by the administrator who started it.

**What to do:** Choose **Back to Integrations** and start again with **Sign in with Microsoft**, **Sign in with Intuit** or **Reconnect** on the connection's row ([Signing in with Microsoft](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_sign_in_state`

> An administrator of your Microsoft directory needs to approve Clock Clerk's Azure DevOps integration before anybody can sign in with it. Send them the link to approve it, then sign in again.

**Why:** An administrator signed in with Microsoft for an Azure DevOps Services connection, but your Microsoft directory requires one of its own administrators to approve Clock Clerk's Azure DevOps integration first. That is a setting of your Microsoft directory, not of Clock Clerk.

**What to do:** Choose **Open the approval link** and send the link to an administrator of your Microsoft directory. Once they have approved it, go **Back to Integrations** and sign in again ([Signing in with Microsoft](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_consent_needed`

> Microsoft couldn't finish the sign-in. Start again.

**Why:** Microsoft signed you in, but the app could not finish the sign-in for the Azure DevOps Services connection: Microsoft could not be reached, or answered in a way the app could not read. The connection was not changed.

**What to do:** Choose **Back to Integrations** and sign in again from the connection's row. If it keeps failing, try again later ([Signing in with Microsoft](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_sign_in_failed`

> Only an Azure DevOps Services connection set to sign in with Microsoft signs in this way.

**Why:** A sign-in with Microsoft was started or finished for a connection that does not sign in that way, usually because it was edited back to a personal access token while the sign-in was under way. Only an Azure DevOps Services connection with **Authentication** set to **Sign in with Microsoft** signs in like this.

**What to do:** Open the connection with **Edit** and check its **Authentication**. To sign in with Microsoft, set it to **Sign in with Microsoft** and choose **Save and sign in with Microsoft** ([Signing in with Microsoft](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_sign_in_not_entra`

> This deployment is not set up for signing in to Azure DevOps with Microsoft. Use a personal access token.

**Why:** An administrator chose **Sign in with Microsoft** for an Azure DevOps Services connection, but this deployment is not set up for signing in to Azure DevOps with Microsoft. Whether it is depends on how whoever runs this deployment set it up.

**What to do:** Set **Authentication** to a personal access token and paste one with the **Work Items (Read)** scope ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)). Or ask whoever runs this deployment to set up the Microsoft sign-in.

Code `integration_sign_in_not_set_up`

> This deployment has no public address for Microsoft to send you back to, so it cannot sign in to Azure DevOps. Ask whoever runs it to set App:PublicUrl.

**Why:** An administrator tried to sign an Azure DevOps Services connection in with Microsoft, but the deployment has no public address configured for Microsoft to send you back to after signing in. Only whoever runs this deployment can set it.

**What to do:** Ask whoever runs this deployment to set `App:PublicUrl` to the address people open the app at. Meanwhile, use a personal access token for the connection ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `integration_sign_in_no_address`

> Organization URL must be https://dev.azure.com/your-organization or https://your-organization.visualstudio.com, without a project.

**Why:** An Azure DevOps Services connection's **Organization URL** is not the address of an organization: it includes a project or other path, a query, or another host.

**What to do:** Use just the organization's address, `https://dev.azure.com/your-organization` or `https://your-organization.visualstudio.com`, with nothing after it. Projects are chosen later, when a manager links a project ([Connect a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_ado_organization_url`

> Collection URL must be the project collection's address, such as https://tfs.example.com/tfs/DefaultCollection, without a project.

**Why:** An Azure DevOps Server (TFS) connection's **Collection URL** is not a project collection's address: it is missing the collection, or has a query or other extras in it.

**What to do:** Use the collection's address, such as `https://tfs.example.com/tfs/DefaultCollection`, without a project after it. The server has to be reachable from the internet over https with a publicly trusted certificate ([Connect a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_ado_collection_url`

> Collection URL is an Azure DevOps Services address. Add an Azure DevOps Services connection for it instead.

**Why:** The **Collection URL** of an Azure DevOps Server (TFS) connection is a `dev.azure.com` or `visualstudio.com` address, which is Azure DevOps Services, Microsoft's hosted service.

**What to do:** Choose **New connection** and pick **Azure DevOps Services** as the **Source**, with that address as its **Organization URL** ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `source_ado_collection_url_hosted`

> API version must be 5.0 or later, such as 5.0, 6.0 or 7.0: Azure DevOps Server 2019 and later are supported.

**Why:** The **API version** of an Azure DevOps Server (TFS) connection is not a version the app supports. Only Azure DevOps Server 2019 and later are supported; TFS 2018 and earlier are not.

**What to do:** Leave **API version** blank, which uses 5.0, or type a version such as 6.0 or 7.0 that your server accepts ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `source_ado_api_version`

> Site URL must be your Jira Cloud site's address, such as https://your-site.atlassian.net.

**Why:** A Jira Cloud connection's **Site URL** is not a Jira Cloud site's address.

**What to do:** Use your site's address, such as `https://your-site.atlassian.net`, with nothing after it. For a Jira server of your own, add a **Jira Data Center** connection instead ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `source_jira_site_url`

> Base URL must be the https address Jira opens at, such as https://jira.example.com, without a query.

**Why:** A Jira Data Center connection's **Base URL** is not a full https address, or has a query in it.

**What to do:** Use the https address Jira opens at, such as `https://jira.example.com`, with no `?` part. It has to be reachable from the internet ([Connect a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_jira_base_url`

> Base URL is a Jira Cloud address. Add a Jira Cloud connection for it instead.

**Why:** The **Base URL** of a Jira Data Center connection is an `atlassian.net` address, which is Jira Cloud.

**What to do:** Choose **New connection**, pick **Jira Cloud** as the **Source**, and use that address as its **Site URL**, with an account email and API token ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `source_jira_base_url_cloud`

> Start date field must be a field id, such as customfield\_10015, or left blank.

**Why:** A Jira connection's **Start date field** holds something other than a field id, such as the field's display name.

**What to do:** Type the field's id, such as `customfield_10015`, or leave it blank, in which case no start dates are imported ([What each source asks for](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `source_jira_start_field`

> Jira couldn't run the search: *what it said*

**Why:** Jira refused the search the import list asked it for, usually because of a filter: most often **Advanced: raw JQL**, or a value Jira does not recognize. The words after the colon are Jira's own.

**What to do:** Correct or clear the filter Jira's reason points at, in the list or in the link's **Default filter** (**Change link**). If Jira's reason is about access, ask an administrator to check the key's permissions ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_jira_search_refused`

> The JQL has a quote that is never closed.

**Why:** The **Advanced: raw JQL** filter on a Jira import list has a quote mark that is never closed, so the app does not send it to Jira.

**What to do:** Add the missing closing quote, or clear the filter ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_jql_unclosed_quote`

> The JQL closes a parenthesis it never opened.

**Why:** The **Advanced: raw JQL** filter on a Jira import list has a closing parenthesis with no opening one before it.

**What to do:** Remove the extra `)`, or add the `(` it closes ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_jql_unopened_parenthesis`

> The JQL opens a parenthesis it never closes.

**Why:** The **Advanced: raw JQL** filter on a Jira import list opens a parenthesis it never closes.

**What to do:** Add the missing `)`, or remove the extra `(` ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_jql_unclosed_parenthesis`

> Leave ORDER BY out of the JQL: the picker orders issues itself, newest first.

**Why:** The **Advanced: raw JQL** filter on a Jira import list contains `ORDER BY`. Your JQL can only narrow the list; the list itself shows issues newest first.

**What to do:** Remove the `ORDER BY` clause and keep the conditions ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_jql_order_by`

> Put a backslash only inside quotes in the JQL.

**Why:** The **Advanced: raw JQL** filter on a Jira import list has a backslash outside a quoted value.

**What to do:** Remove the backslash, or put the value it belongs to inside double quotes ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_jql_backslash`

> Mapping needs attention: the Notion property the link reads the *fields* from is no longer in the database. Open the link and choose another.

*fields* is one of: column, owner, start date, end date, estimate.

**Why:** A project is linked to a Notion database, and a property its mapping reads, such as the column, owner, dates or estimate, has since been deleted or replaced in Notion. The message names which part is affected.

**What to do:** A manager of the project opens **Import tasks**, chooses **Change link**, picks another property under **Fields**, and chooses **Save link** ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_notion_mapping_stale`

> *property* must be a person's id.

**Why:** A filter on a people property of a Notion import list, or in the link's **Default filter**, holds something that is not a Notion person's id.

**What to do:** Pick the person from the filter's list rather than typing a name, or clear the filter. If it comes from the default filter, change it with **Change link** ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_notion_filter_person`

> *property* must be true or false.

**Why:** A filter on a checkbox property of a Notion import list, or in the link's **Default filter**, holds something other than checked or not checked.

**What to do:** Pick **Checked** or **Not checked** for the filter, or clear it ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_notion_filter_checkbox`

> *property* must be a yyyy-MM-dd date.

**Why:** A date filter on a Notion import list, or in the link's **Default filter**, is not written as year-month-day.

**What to do:** Type the date as `yyyy-MM-dd`, such as `2026-03-01`, or clear it ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `source_notion_filter_date`

> This connection needs attention. Ask an administrator.

**Why:** A manager tried to link a project to, or import through, a connection that cannot be used now: an administrator turned it off, it signs in with Microsoft and has to be signed in again, or this deployment no longer offers its source. Managers cannot fix connections themselves.

**What to do:** Ask an administrator. On **Settings → Integrations** they turn the connection on with **Enable**, choose **Reconnect**, or enter a new key with **Edit** ([When something goes wrong](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_connection_needs_attention`

> That connection was deleted just now. Choose another one.

**Why:** You saved a project's link through a connection an administrator deleted while you were filling in **Link a source**.

**What to do:** Pick another connection under **1. Connection** and save the link again. If none is left, ask an administrator to add one ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_connection_gone`

> That connection doesn't exist.

**Why:** The connection you picked in **Link a source** no longer exists, usually because an administrator deleted it after the dialog opened.

**What to do:** Close the dialog, open **Import tasks** again, and pick a connection from the fresh list ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_connection_missing`

> This connection's key can't be read any more. Ask an administrator to enter it again.

**Why:** The key stored for the project's connection can no longer be decrypted, so nothing can be read through it. This can happen when the keys a deployment encrypts with are changed. Managers never see or enter keys.

**What to do:** Ask an administrator to open the connection with **Edit** on **Settings → Integrations**, enter the key again with **Replace**, and save ([Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `import_key_unreadable`

> Tasks have already been imported through this link, so it stays on the board it was made for. Unlink it and link again to import from somewhere else.

**Why:** A manager chose **Change link** and picked another board, project or connection, but tasks have already been imported through this link. A link stays on the board it was made for once anything comes in through it.

**What to do:** Choose **Unlink**, then link again to the new board. Imported tasks stay on the board, and linking the same board again later remembers what was imported ([Importing again](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_link_fixed`

> Somebody else linked this project just now. Reload to see their link.

**Why:** Another manager saved a link for this project at the same moment you did. A project links to one place at a time, so theirs was kept.

**What to do:** Reload the page and open **Import tasks** to see their link. Use **Change link** if it should point somewhere else ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_link_raced`

> A mapping can have up to *maximum* entries in each part.

**Why:** A project's link was saved with more entries in one part of its mapping, such as columns, people, fields or the default filter, than a mapping can hold.

**What to do:** Map fewer entries in that part, leaving some as **Skip** or **No owner**, and choose **Save link** again ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_mapping_too_large`

> Every name in a mapping needs some text, and at most *maximum* characters.

**Why:** A name or value in the link's mapping, such as a default filter value, is blank or longer than a mapping allows.

**What to do:** Shorten or fill in the value, or clear the filter it belongs to, and choose **Save link** again ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_mapping_name_length`

> A column in the mapping is not on this project's board.

**Why:** The link's mapping sends a source column to a board column that is no longer on this project's board, usually because somebody deleted it while you were editing.

**What to do:** Reload, open **Change link**, pick a current column (or **Skip**) under **Columns**, and save ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_mapping_column`

> Each person in the mapping has to be a member of this project.

**Why:** The link's mapping gives a source person's tasks to somebody who is not on this project's team, perhaps because they were taken off it while you were editing. Only members of the project can own its tasks.

**What to do:** Under **People**, pick a project member or **No owner**, or add the person to the project's team on **Projects** first ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_mapping_member`

> This project isn't linked to a source. Link it to a board first.

**Why:** You tried to list or import items for a project that has no link to a source, usually because another manager chose **Unlink** while you had it open.

**What to do:** Open **Import tasks** again, which opens **Link a source**, and link the project ([Link the project to a source](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_not_linked`

> The source couldn't read that filter. Check its values.

**Why:** The filters on the import list, together with the link's default filter, are too many, have a value too long to send to the source, or hold a value the source can't read, such as a stale **Default filter** on the project's link.

**What to do:** Clear some filters or shorten the text you typed, and try again. If the default filter is the problem, a manager corrects it on the project's link ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_filter_unreadable`

> This project's link changed just now. Reload and import again.

**Why:** Another manager changed or removed the project's link while your import was running, so nothing was imported.

**What to do:** Reload the page, check the link in **Import tasks**, and import again ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_link_changed`

> Choose at most *maximum* items at a time.

**Why:** You ticked more items than one import can take. The message gives the limit.

**What to do:** Untick some and import the rest in a second go ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_too_many_items`

> A column chosen for an item is not on this project's board.

**Why:** A ticked item's **Column** is no longer on this project's board, usually because somebody deleted it while you were choosing.

**What to do:** Reload, pick a current column for the item, and import again ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_item_column`

> An owner chosen for an item has to be a member of this project.

**Why:** A ticked item's **Owner** is not on this project's team, perhaps because they were taken off it while you were choosing. Only project members can own its tasks.

**What to do:** Pick a member or no owner for the item, or add the person to the project's team first, then import again ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_item_owner`

> An estimate has to be between *minimum* and *maximum* hours.

**Why:** A ticked item's **Estimate (h)** is negative or larger than an estimate can be.

**What to do:** Correct the estimate, or clear it, and import again ([Pick what to import](https://clockclerk.com/guide/workflows/plan-work-on-a-board.md)).

Code `import_estimate_range`

## The ERP export

> The ERP refused this connection’s key while hours were being exported, so the export is paused and nothing was lost. Enter a new key and enable the connection to resume.

**Why:** While hours were being sent, the ERP refused the key this connection signs in with, for example because it expired or was revoked. Clock Clerk stopped the export and switched the connection off; nothing approved meanwhile is lost. Finance sees this as the **Last problem** on **ERP export**.

**What to do:** An administrator opens **Integrations**, chooses **Edit** on the ERP connection, enters a new key (for QuickBooks Online, chooses **Reconnect** instead), and then **Enable**. What was approved while it was off goes within minutes. See [When something goes wrong](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_export_paused`

> This connection's mappings and postings belong to another QuickBooks Online company. Sign in to that company, or add a new connection for this one.

**Why:** An administrator signed a QuickBooks Online connection in to Intuit again and chose a different company from the one it has been exporting to. Its mappings and its record of what was sent name the first company's records, so it can't be moved to another one.

**What to do:** Choose **Reconnect** on **Integrations** again and pick the original company at Intuit. To export to the other company instead, disable this connection and add a **New ERP connection** for it, as [Switching to another ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md) describes.

Code `erp_quickbooks_company_changed`

> *ERP* takes hours only from Clock Clerk.

**Why:** You chose to send hours and what they cost, but the connected ERP, as it is set up now, takes hours only. Usually the connection's ERP fields changed after you opened **Settings**, such as Workday's **Workday Financials** set to not used.

**What to do:** The settings still hold **Hours and cost** from before, and while the ERP takes hours only, **What is sent** is not on the form to change it, so every save is refused. An administrator sets the connection's ERP fields on **Integrations** back for a moment, so that the ERP takes cost again; you choose **Hours only** and save; then the administrator changes the fields back. If you need cost sent, leave the fields as they were instead. See [The ERPs you can export to](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_cost_not_taken`

> *ERP* doesn’t take vendor bills from Clock Clerk.

**Why:** You turned on **Send contractors' approved months as vendor bills**, but the connected ERP doesn't take bills from Clock Clerk, as with Dynamics 365 Project Operations, or Workday without Financials. The option is normally not on the form for such an ERP, so the form was likely out of date.

**What to do:** The option is saved from before, and while the ERP doesn't take bills it is not on the form to turn off, so every save is refused. An administrator sets the connection's ERP fields on **Integrations** back for a moment, so that the option shows again; you turn it off and save; then the administrator changes the fields back. Contractors' months are then paid from the payment file on **Contractors** ([Pay contractors](https://clockclerk.com/guide/workflows/pay-contractors.md)).

Code `erp_vendor_bills_not_taken`

> *ERP* doesn’t take expenses from Clock Clerk.

**Why:** You turned on **Send approved reimbursable expenses**, but the connected ERP doesn't take expenses from Clock Clerk as it is set up: SAP takes none, Business Central takes none while hours go to the job journal, and Workday takes none without Financials. The form was likely out of date.

**What to do:** The option is saved from before, and while the ERP doesn't take expenses it is not on the form to turn off, so every save is refused. An administrator sets the connection's ERP fields on **Integrations** back for a moment, so that the option shows again; you turn it off and save; then the administrator changes the fields back. Expenses are then paid back from **Reimbursements** ([Expenses and reimbursements](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md)).

Code `erp_expenses_not_taken`

> *ERP* needs “*field*” on its connection first. An administrator sets it on the Integrations tab.

**Why:** You chose to send something, such as cost, a monthly or annual cost, bills or expenses, that the connection has no account or field for yet. The message names the missing field. Only an administrator can fill in the connection's fields.

**What to do:** Ask an administrator to open **Integrations**, choose **Edit** on the ERP connection, and fill in the named field on the **ERP fields** step. Then save your settings again, or leave that option off. See [Choose what is sent](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_posting_setting_missing`

> Somebody else has just mapped this. Reload and try again.

**Why:** Someone else mapped the same record to the ERP at the same moment you did, so your choice wasn't saved.

**What to do:** Reload **ERP export**, open **Mapping**, and check the row. If their match is wrong, choose **Change**. See [Mapping](https://clockclerk.com/guide/screens/admin-erp.md).

Code `erp_mapping_race`

> Somebody else has just mapped some of these. Reload and try again.

**Why:** Somebody else saved matches for some of the same records at the same instant as you, so none of your ticked matches were saved. Records mapped while you were only checking the proposals are not refused: they are skipped and the rest saved.

**What to do:** Reload **Mapping** and choose **Match automatically** again; it proposes only what is still not mapped. See [Match people and projects](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_matches_race`

> There is no such record to map.

**Why:** The person, project or other record you tried to map has been deleted, or is no longer among the records that kind of mapping lists, since the page was loaded.

**What to do:** Reload **Mapping** on **ERP export** and map what is listed there now ([Mapping](https://clockclerk.com/guide/screens/admin-erp.md)).

Code `erp_no_such_record`

> *service* isn’t available on this deployment.

**Why:** The ERP this connection exports to is no longer offered on this Clock Clerk deployment, so its records can't be searched, mapped or downloaded. The **Status** on the **Overview** says **Not available on this deployment**.

**What to do:** Nothing in the app fixes this: whoever runs this deployment has to set the connector up again. Until then, an administrator can disable the connection on **Integrations** ([ERP](https://clockclerk.com/guide/screens/admin-integrations.md)).

Code `erp_no_connector`

> Only a posting the ERP refused can be retried.

**Why:** You chose **Retry** on a posting that is no longer **Rejected**: someone else retried, released or resolved it, or the export moved it, after your log was loaded. Only a posting the ERP refused can be retried.

**What to do:** Reload the **Log** on **ERP export** and see what state the posting is in now ([Follow the export](https://clockclerk.com/guide/workflows/export-to-your-erp.md)).

Code `erp_not_rejected`

> This month is no longer approved to pay, so its bill won’t be sent to *ERP*.

**Why:** You chose **Retry** on a contractor's bill the ERP rejected, but that month has since been returned and is no longer approved to pay, so the bill isn't sent again.

**What to do:** Once the month is **Approved to pay** again on **Contractors**, it goes as a new bill. See [Pay contractors](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `erp_bill_not_approved`

> This month has been paid since, in a payment file or by hand, so its bill won’t be sent to *ERP*.

**Why:** You chose **Retry** on a contractor's bill the ERP rejected, but the month has since been paid another way, in a payment file or marked paid by hand. Sending the bill too would pay the contractor twice.

**What to do:** Nothing to retry: the month is paid. If it was paid by mistake, sort it out on **Contractors** ([Pay contractors](https://clockclerk.com/guide/workflows/pay-contractors.md)).

Code `erp_bill_paid_otherwise`

> This expense has been paid back since, in reimbursement batch *batch number*, so it won’t be sent to *ERP*.

**Why:** You chose **Retry** on an expense the ERP rejected, but the claim has since been paid back in a reimbursement batch, named in the message. Sending it too would pay it twice.

**What to do:** Nothing to retry: the claim is paid. The batch is listed on **Reimbursements** ([Expenses and reimbursements](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md)).

Code `erp_expense_reimbursed`

> This expense is no longer one to pay back, so it won’t be sent to *ERP*.

**Why:** You chose **Retry** on an expense the ERP rejected, but the claim is no longer one to pay back: it was declined, marked not reimbursable, or now belongs to a contractor, whose claims go on their month's bill.

**What to do:** Nothing to retry. Check the claim on **Approvals** or with its owner if you think it should still be paid back ([Expenses and reimbursements](https://clockclerk.com/guide/workflows/expenses-and-reimbursements.md)).

Code `erp_expense_not_payable`

> This expense’s week has been reopened, so it won’t be sent to *ERP* until it is approved again.

**Why:** You chose **Retry** on an expense the ERP rejected, but the week it falls in has been reopened since, and the claim may have been changed. It waits until the week is approved again.

**What to do:** Wait for the week to be approved again on **Approvals**, then choose **Retry** again. Only a claim that was changed while the week was open goes again by itself, as a new posting. See [Review and approve time](https://clockclerk.com/guide/workflows/review-and-approve-time.md).

Code `erp_expense_reopened`

> Only a held posting can be released.

**Why:** You chose **Release** on a posting that is no longer **Held**: the record it waited for was mapped and it went, or someone else released it, after your log was loaded.

**What to do:** Reload the **Log** on **ERP export** and check its state now ([Follow the export](https://clockclerk.com/guide/workflows/export-to-your-erp.md)).

Code `erp_not_held`

> Only a posting whose answer was lost can be resolved.

**Why:** You chose **Resolve** on a posting that is no longer **Unresolved**, usually because someone else recorded what the ERP holds first.

**What to do:** Reload the **Log** on **ERP export** and check what was recorded ([Follow the export](https://clockclerk.com/guide/workflows/export-to-your-erp.md)).

Code `erp_not_unresolved`

> This posting has just changed. Reload and try again.

**Why:** The export, or someone else, moved this posting, or a posting in this file, while you were deciding, so your choice wasn't saved.

**What to do:** Reload the **Log** or **Downloads** on **ERP export** and decide again on what you see now ([When something goes wrong](https://clockclerk.com/guide/workflows/export-to-your-erp.md)).

Code `erp_posting_changed`

> *ERP* postings are sent to it, not downloaded as a file.

**Why:** You tried to download a file or upload lists for a connection whose ERP Clock Clerk sends postings to directly. Files are only for QuickBooks Desktop; this usually means the page was out of date.

**What to do:** Reload **ERP export**; postings for this ERP go by themselves, and you follow them on the **Overview** and **Log** ([Follow the export](https://clockclerk.com/guide/workflows/export-to-your-erp.md)).

Code `erp_sent_not_downloaded`

> This *ERP* connection is switched off, so nothing is taken into a file. Enable it first.

**Why:** You chose **Download for QuickBooks Desktop** while the connection is off. A file counts as sent, so nothing is taken into one until the connection is on.

**What to do:** Ask an administrator to choose **Enable** on the connection on **Integrations**, then download again. See [QuickBooks Desktop: download a file](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_download_switched_off`

> Only the newest file can be undone: a later one may already have been imported on top of it. Undo that one first.

**Why:** You chose **Undo** on a file that isn't the newest one still standing. A later file may already have been imported on top of it, so undoing this one alone could put records into QuickBooks twice.

**What to do:** On **Downloads**, undo the newer files first, newest first, and only those whose import failed. See [QuickBooks Desktop: download a file](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_download_not_newest`

> This file has already been undone, and its postings are back in the queue.

**Why:** You chose **Undo** on a file that has already been undone, perhaps by someone else; its postings are already back in the queue.

**What to do:** Nothing needs doing: the postings go in the next file you download from **Downloads** ([Downloads](https://clockclerk.com/guide/screens/admin-erp.md)).

Code `erp_download_undone`

> That file holds none of the lists the pickers read: employees, customers and jobs, vendors, items or accounts. In *ERP*, export them from File › Utilities › Export › Lists to IIF Files.

**Why:** The file you chose under **Upload lists from QuickBooks** is empty, or holds none of the lists the pickers on **Mapping** read.

**What to do:** In QuickBooks Desktop, choose **File › Utilities › Export › Lists to IIF Files**, tick the chart of accounts and the customer:job, vendor, employee and item lists, and upload that file. See [QuickBooks Desktop: download a file](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_lists_empty`

> That isn't a lists file *ERP* exported. Export the lists again from File › Utilities › Export › Lists to IIF Files, and upload the file as it was saved.

**Why:** The file you uploaded under **Upload lists from QuickBooks** isn't an IIF lists file as QuickBooks Desktop saves it, for example a different export, or one opened and saved again in a spreadsheet.

**What to do:** Export the lists again from **File › Utilities › Export › Lists to IIF Files** and upload the file without opening it first. See [Mapping](https://clockclerk.com/guide/screens/admin-erp.md).

Code `erp_lists_malformed`

> A lists file can be up to 20 MB.

**Why:** The lists file you uploaded is over 20 MB, the most one upload can be.

**What to do:** Export fewer lists into each file and upload them one after another: each list in a file replaces only that list, and lists the file doesn't hold are left as they were. See [Mapping](https://clockclerk.com/guide/screens/admin-erp.md).

Code `erp_lists_too_large`

> Connected to *ERP* at *address*

**Why:** This isn't a refusal: it is what a passing test says for a Dynamics 365 Project Operations connection, naming the environment address it reached. Administrators see it after **Test passed** in the connection dialog, or in a message after **Test connection** on **Integrations**.

**What to do:** Nothing needs doing if that is the right one. If it isn't, choose **Edit** on the connection, correct its fields and test again. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_connected_at`

> Connected to *ERP* account *account*

**Why:** This isn't a refusal: it is what a passing test says for a NetSuite connection, naming the account it reached. Administrators see it after **Test passed** in the connection dialog, or in a message after **Test connection** on **Integrations**.

**What to do:** Nothing needs doing if that is the right one. If it isn't, choose **Edit** on the connection, correct its fields and test again. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_connected_account`

> Connected to *ERP* company *company* in *environment*

**Why:** This isn't a refusal: it is what a passing test says for a Business Central or QuickBooks Online connection, naming the company it reached, and for Business Central the environment. Administrators see it after **Test passed** in the connection dialog, or in a message after **Test connection** on **Integrations**.

**What to do:** Nothing needs doing if that is the right one. If it isn't: for Business Central, choose **Edit** on the connection, correct its fields and test again; for QuickBooks Online, whose company comes from the Intuit sign-in, sign in with Intuit again and pick the right company. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_connected_company_in`

> Connected to *ERP* company *company*, entity *entity* as *user*

> Connected to *ERP* company *company* as *user*

**Why:** This isn't a refusal: it is what a passing test says for a Sage Intacct connection, naming the company, the entity where one is set, and the Web Services user it signed in as. Administrators see it after **Test passed** in the connection dialog, or in a message after **Test connection** on **Integrations**.

**What to do:** Nothing needs doing if that is the right one. If it isn't, choose **Edit** on the connection, correct its fields and test again. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_connected_company_as`

> Connected to *ERP* at *address*, company code *company*

**Why:** This isn't a refusal: it is what a passing test says for a SAP S/4HANA connection, naming the system address and company code it reached. Administrators see it after **Test passed** in the connection dialog, or in a message after **Test connection** on **Integrations**.

**What to do:** Nothing needs doing if that is the right one. If it isn't, choose **Edit** on the connection, correct its fields and test again. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_connected_company_code`

> Connected to *ERP* at *address*, company code *company*. The client certificate expires on *date*; upload its renewal before then.

**Why:** A test of an SAP S/4HANA connection that signs in with a client certificate passed, but the certificate expires within a few weeks, on the date shown. After that the connection can't sign in.

**What to do:** Before that date, get the renewed certificate from whoever manages it for SAP. An administrator chooses **Edit** on the connection on **Integrations**, uses **Replace** on **Client certificate** (and **Certificate password** if it changed), saves, and tests again. See [Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `erp_connected_certificate_expiring`

> The client certificate expired on *date*. Upload its renewal to connect again.

**Why:** The client certificate this SAP S/4HANA connection signs in with has expired, so the test didn't call SAP at all, and nothing can be sent through the connection.

**What to do:** An administrator chooses **Edit** on the connection on **Integrations**, uses **Replace** to upload the renewed **Client certificate** and its **Certificate password**, saves, and chooses **Test connection**. See [Adding or editing a connection](https://clockclerk.com/guide/screens/admin-integrations.md).

Code `erp_certificate_expired`

> Connected to *ERP* at *address* as *user*, endpoint Default/*version*

**Why:** This isn't a refusal: it is what a passing test says for an Acumatica connection, naming the instance, the user it signed in as and the endpoint version it uses. Administrators see it after **Test passed** in the connection dialog, or in a message after **Test connection** on **Integrations**.

**What to do:** Nothing needs doing if that is the right one. If it isn't, choose **Edit** on the connection, correct its fields and test again. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_connected_endpoint`

> Connected to *ERP* at *address* as client *client*, business unit *unit*

> Connected to *ERP* at *address* as client *client*

> Connected to *ERP* at *address* as *user*, business unit *unit*

> Connected to *ERP* at *address* as *user*

**Why:** This isn't a refusal: it is what a passing test says for an Oracle Fusion connection, naming the pod address, the user or OAuth client it signed in as, and the business unit where one is set. Administrators see it after **Test passed** in the connection dialog, or in a message after **Test connection** on **Integrations**.

**What to do:** Nothing needs doing if that is the right one. If it isn't, choose **Edit** on the connection, correct its fields and test again. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_connected_as`

> Connected to *ERP* tenant *tenant* at *address* as *user*, with Financials, company *company*

> Connected to *ERP* tenant *tenant* at *address*, with Financials, company *company*

> Connected to *ERP* tenant *tenant* at *address* as *user*, hours only

> Connected to *ERP* tenant *tenant* at *address*, hours only

**Why:** This isn't a refusal: it is what a passing test says for a Workday connection, naming the tenant and services host, and whether it exports hours only or with Financials and which company. Administrators see it after **Test passed** in the connection dialog, or in a message after **Test connection** on **Integrations**.

**What to do:** Nothing needs doing if that is the right one. If it isn't, choose **Edit** on the connection, correct its fields and test again. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_connected_tenant`

> Name the company journals and supplier invoices are booked in, or export hours only.

**Why:** The Workday connection is set to use **Workday Financials**, but names no **Company**, so the test can't check where journals, supplier invoices and expense reports would be booked.

**What to do:** Choose **Edit** on the connection on **Integrations** and enter the Company Reference ID under **Company**, or set **Workday Financials** to not used to export hours only. Then test again. See [The ERPs you can export to](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_company_needed`

> *ERP* isn't called: its postings are downloaded as a file for you to import.

**Why:** This isn't a refusal: it is what **Test connection** says for QuickBooks Desktop, which Clock Clerk never calls. Its postings are downloaded as a file that Finance imports.

**What to do:** Nothing needs doing. Finance downloads the files on **ERP export** under **Downloads**; see [QuickBooks Desktop: download a file](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_downloaded_as_file`

> Directory (tenant) ID must be a GUID or a domain such as contoso.onmicrosoft.com.

**Why:** An administrator saving a Dynamics 365 connection on **Integrations** entered **Directory (tenant) ID** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the tenant ID from Microsoft Entra (a GUID), or the tenant's domain, such as `contoso.onmicrosoft.com`. Each field's help in the dialog says where to find the value in Dynamics 365. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_entra_tenant_id`

> Application (client) ID must be the app registration’s GUID.

**Why:** An administrator saving a Dynamics 365 connection on **Integrations** entered **Application (client) ID** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Copy the **Application (client) ID** GUID from the app registration's overview in Microsoft Entra, not its name or secret. Each field's help in the dialog says where to find the value in Dynamics 365. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_entra_client_id`

> Environment must be the environment’s name, letters, digits, - and \_ only, such as Production.

**Why:** An administrator saving a Business Central connection on **Integrations** entered **Environment** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the environment's name exactly as Business Central shows it, such as `Production`, not its URL. Each field's help in the dialog says where to find the value in Business Central. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_bc_environment`

> Company must be the company’s name, at most 30 characters, or its ID.

**Why:** An administrator saving a Business Central connection on **Integrations** entered **Company** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the company's name (at most 30 characters) or its ID, as Business Central shows it. Each field's help in the dialog says where to find the value in Business Central. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_bc_company`

> Job task web service must be a web service’s name, letters, digits and \_ only, or left blank.

**Why:** An administrator saving a Business Central connection on **Integrations** entered **Job task web service** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the service name from the **Web Services** page in Business Central, letters, digits and underscores only, or leave the field blank. Each field's help in the dialog says where to find the value in Business Central. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_bc_job_task_service`

> *field* must be a Business Central code of at most *maximum* characters, or left blank.

**Why:** An administrator saving a Business Central connection on **Integrations** entered the field the message names, such as a journal batch or an account in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the code exactly as Business Central shows it, within the length the message gives, or leave the field blank until you need it. Each field's help in the dialog says where to find the value in Business Central. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_bc_code`

> *field* must be a web service’s name, letters, digits and \_ only, or left blank.

**Why:** An administrator saving a Business Central connection on **Integrations** entered a web service name the message names in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the service name from the **Web Services** page in Business Central, letters, digits and underscores only, or leave it blank to use the standard name. Each field's help in the dialog says where to find the value in Business Central. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_bc_service`

> Business Central has no web service *service*; publish page *page*, *caption*, under that name on the Web Services page, or send hours to time sheets.

**Why:** The Business Central connection sends hours to the job journal, which needs three pages published as web services, and the one named isn't published under that name. A test says so, and so does a posting it stops.

**What to do:** In Business Central, open **Web Services** and publish the page named under the service name shown, or correct the web service field on the connection to match. Or set **Send hours to** back to time sheets. Then test again on **Integrations**. See [The ERPs you can export to](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_bc_page_unpublished`

> Environment URL must be a Dataverse environment’s https address, such as https://contoso.crm.dynamics.com.

**Why:** An administrator saving a Dynamics 365 Project Operations connection on **Integrations** entered **Environment URL** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the Dataverse environment's https address alone, such as `https://contoso.crm.dynamics.com`, without any path after it. Each field's help in the dialog says where to find the value in Dynamics 365 Project Operations. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_project_operations_url`

> *field* must be a Sage Intacct ID: letters, digits, dots, hyphens and underscores, at most 60.

**Why:** An administrator saving a Sage Intacct connection on **Integrations** entered the field the message names in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the ID as Sage Intacct shows it: letters, digits, dots, hyphens and underscores, up to 60 characters, with no spaces. Each field's help in the dialog says where to find the value in Sage Intacct. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_intacct_id`

> API URL must be the system’s https address alone, such as https://my123456-api.s4hana.cloud.sap.

**Why:** An administrator saving a SAP S/4HANA connection on **Integrations** entered **API URL** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the system's https address alone, such as `https://my123456-api.s4hana.cloud.sap`, with no path after it. On premises, keep the port, such as `https://s4.contoso.com:44300`. Each field's help in the dialog says where to find the value in SAP S/4HANA. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_sap_api_url`

> Client must be the three-digit SAP client, such as 100, or left blank.

**Why:** An administrator saving a SAP S/4HANA connection on **Integrations** entered **Client** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the three-digit SAP client number, such as `100`, or leave it blank. Each field's help in the dialog says where to find the value in SAP S/4HANA. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_sap_client`

> Token URL must be an https address, such as https://my123456-api.s4hana.cloud.sap/sap/bc/sec/oauth2/token, or left blank.

**Why:** An administrator saving a SAP S/4HANA Cloud connection on **Integrations** entered **Token URL** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the full https address of the token endpoint, or leave it blank. Each field's help in the dialog says where to find the value in SAP S/4HANA Cloud. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_sap_token_url`

> *field* must be an SAP key of at most *maximum* letters and digits.

**Why:** An administrator saving a SAP connection on **Integrations** entered the field the message names, such as **Company code** or an account in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the key exactly as SAP shows it, letters and digits only, within the length the message gives. Each field's help in the dialog says where to find the value in SAP. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_sap_key`

> Language must be a two-letter language code, such as EN, or left blank.

**Why:** An administrator saving a SAP connection on **Integrations** entered **Language** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter a two-letter language code, such as `EN`, or leave it blank. Each field's help in the dialog says where to find the value in SAP. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_sap_language`

> Journal entry service path must be a path on the system, such as /sap/bc/srt/scs\_ext/sap/journalentrycreaterequestconfi, or left blank.

**Why:** An administrator saving a SAP connection on **Integrations** entered **Journal entry service path** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the service's path on the system, starting with `/`, not a full address, or leave it blank. Each field's help in the dialog says where to find the value in SAP. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_sap_journal_service`

> Pod address must be the Fusion applications’ https address alone, on oraclecloud.com, such as https://acme.fa.us2.oraclecloud.com.

**Why:** An administrator saving an Oracle Fusion connection on **Integrations** entered **Pod address** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the Fusion applications' https address on `oraclecloud.com` alone, such as `https://acme.fa.us2.oraclecloud.com`, with nothing after the host. Each field's help in the dialog says where to find the value in Oracle Fusion. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_oracle_pod`

> Identity domain URL must be the identity domain’s https address alone, on oraclecloud.com, such as https://idcs-0123456789abcdef.identity.oraclecloud.com.

**Why:** An administrator saving an Oracle Fusion connection on **Integrations** entered **Identity domain URL** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the identity domain's https address on `oraclecloud.com` alone, with nothing after the host. Each field's help in the dialog says where to find the value in Oracle Fusion. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_oracle_identity_domain`

> Scope must be one scope, without spaces, or left blank.

**Why:** An administrator saving an Oracle Fusion connection on **Integrations** entered **Scope** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter a single scope with no spaces, or leave it blank. Each field's help in the dialog says where to find the value in Oracle Fusion. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_oracle_scope`

> Fixed cost expenditure type must be an expenditure type’s ID, a number, or left blank.

**Why:** An administrator saving an Oracle Fusion connection on **Integrations** entered **Fixed cost expenditure type** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the expenditure type's numeric ID, not its name, or leave it blank. The field's help says where its ID is listed. Each field's help in the dialog says where to find the value in Oracle Fusion. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_oracle_fixed_cost_type`

> *field* must be a name as Oracle shows it, on one line, at most 240 characters.

**Why:** An administrator saving an Oracle Fusion connection on **Integrations** entered the field the message names in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the name as Oracle shows it, on one line and up to 240 characters. Each field's help in the dialog says where to find the value in Oracle Fusion. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_oracle_name`

> Services host must be the tenant’s https Web Services address alone, such as https://wd2-impl-services1.workday.com.

**Why:** An administrator saving a Workday connection on **Integrations** entered **Services host** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the tenant's Web Services https address alone, such as `https://wd2-impl-services1.workday.com`, with no path after it. Each field's help in the dialog says where to find the value in Workday. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_workday_host`

> Tenant name must be the tenant’s name alone, letters, digits and underscores, such as acme\_preview.

**Why:** An administrator saving a Workday connection on **Integrations** entered **Tenant name** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the tenant's name alone, such as `acme_preview`: letters, digits and underscores, not an address. Each field's help in the dialog says where to find the value in Workday. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_workday_tenant`

> *field* must be a Workday reference ID: letters, digits, hyphens and underscores, at most 60.

**Why:** An administrator saving a Workday connection on **Integrations** entered the field the message names in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the Workday reference ID, not the display name: letters, digits, hyphens and underscores, up to 60 characters. Each field's help in the dialog says where to find the value in Workday. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_workday_id`

> Instance URL must be Acumatica’s https address, with the site’s path where it has one, and nothing after it, such as https://contoso.acumatica.com.

**Why:** An administrator saving an Acumatica connection on **Integrations** entered **Instance URL** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter Acumatica's https address, with the site's path if it has one, and nothing after that, such as `https://contoso.acumatica.com`. Each field's help in the dialog says where to find the value in Acumatica. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_acumatica_instance`

> Endpoint version must be a Default endpoint’s version, such as *version*, or left blank.

**Why:** An administrator saving an Acumatica connection on **Integrations** entered **Endpoint version** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the version of a Default endpoint, in the form the message shows, or leave it blank. Each field's help in the dialog says where to find the value in Acumatica. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_acumatica_version`

> Tenant must be a tenant’s login name as Acumatica shows it, on one line, at most 64 characters.

**Why:** An administrator saving an Acumatica connection on **Integrations** entered **Tenant** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the tenant's login name as Acumatica shows it, on one line and up to 64 characters, or leave it blank. Each field's help in the dialog says where to find the value in Acumatica. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_acumatica_tenant`

> Account ID must be NetSuite’s, such as 1234567, 1234567\_SB1 or TSTDRV1234567.

**Why:** An administrator saving a NetSuite connection on **Integrations** entered **Account ID** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Copy the account ID from **Setup › Company › Company Information** in NetSuite, such as `1234567` or `1234567_SB1` for a sandbox. Each field's help in the dialog says where to find the value in NetSuite. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_netsuite_account`

> Cost field must be a custom column field’s ID, such as custcol\_labor\_cost, or left blank.

**Why:** An administrator saving a NetSuite connection on **Integrations** entered **Cost field** in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter the ID of a custom transaction column field, such as `custcol_labor_cost`, not its label, or leave it blank. Each field's help in the dialog says where to find the value in NetSuite. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_netsuite_cost_field`

> *field* must be an internal ID, a number, or left blank.

**Why:** An administrator saving a NetSuite connection on **Integrations** entered the field the message names in a form the ERP can't use, so the connection wasn't saved.

**What to do:** Enter NetSuite's internal ID, a number, not the record's name, or leave it blank. Each field's help in the dialog says where to find the value in NetSuite. See [Connect the ERP](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `erp_netsuite_internal_id`

## Your organization, its plan and its directory

> Your organization is not on a free trial, so there is nothing to extend. For anything about your plan, contact support at *support address*.

> Your organization is not on a free trial, so there is nothing to extend. For anything about your plan, contact support.

**Why:** An administrator chose to extend the free trial, but your organization isn't on one: it is on a plan, such as Free or a paid subscription, or was started on Free and never had a trial.

**What to do:** There is nothing to extend. To change plan, use the Plan & billing card on the **Organization** tab or the [Plans page](https://clockclerk.com/guide/screens/trial.md); for anything else about your plan, contact support.

Code `org_trial_none`

> Your trial was already extended once, on *date*, and it can only be extended once. To keep using Clock Clerk, choose a plan or contact support at *support address*.

> Your trial was already extended once, on *date*, and it can only be extended once. To keep using Clock Clerk, choose a plan or contact support.

**Why:** An administrator asked for more time, but the trial has already had its one extension, on the date shown. A trial can be extended only once.

**What to do:** Choose a plan on the [Plans page](https://clockclerk.com/guide/screens/trial.md) (**See plans** or **Choose a plan** in the notice at the top), or contact support if you need something else. Nothing you recorded is deleted while you decide.

Code `org_trial_extended`

> Your trial still has *days* days to run. It can be extended once it is within *time* days of ending.

**Why:** An administrator asked to extend the trial while it still had more days to run than the extension window allows. The trial can be extended only in its last days (the message says how many) or after it has ended.

**What to do:** Come back to the [Plans page](https://clockclerk.com/guide/screens/trial.md) once the trial is within that many days of ending; the **Ask for … more days** button appears then. Nothing needs doing until then.

Code `org_trial_too_early`

> Your trial has just been changed by somebody else. Reload the page to see where it stands.

**Why:** You asked to extend the trial at the same moment as somebody else, such as another administrator or Clock Clerk's support, changed it. Only the first change counts.

**What to do:** Reload the page to see the trial's new end date. If it was extended by the other change, the [one extension](https://clockclerk.com/guide/screens/trial.md) is used up.

Code `org_trial_changed`

> Your organization still has a subscription, which would go on being charged after it was gone. Cancel it under Plan & billing on the Organization tab first, and delete the organization once the subscription has ended.

**Why:** You asked to delete the organization while it is still paying for a subscription, or still owes a payment on one. Stripe would go on charging for it after the organization was gone, with nobody left who could stop it.

**What to do:** Choose **Cancel subscription** on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card. The subscription then ends with the period already paid for; once it has, ask for the deletion again. See [Delete organization](https://clockclerk.com/guide/screens/admin-organization.md).

Code `org_removal_subscription_open`

> The name typed is not your organization’s. Type it exactly as it is shown to confirm.

**Why:** Deleting an organization asks for its name, so that it is never done by a stray click. What was typed is not the name exactly as the Organization tab shows it; capital letters count.

**What to do:** Type the name again exactly as it appears in the dialog, or copy it from the **General** card.

Code `org_removal_name_mismatch`

> Your organization is already being deleted, on *date*.

> Your organization is already being deleted.

**Why:** Another administrator, or you in another tab, has already asked for the organization to be deleted. The day it goes stays the one first asked for.

**What to do:** Reload the Organization tab to see the day. To keep the organization, choose **Undo deletion** on the [Delete organization](https://clockclerk.com/guide/screens/admin-organization.md) card.

Code `org_removal_already_pending`

> Your organization is not being deleted, so there is nothing to undo.

**Why:** You chose **Undo deletion**, but the deletion had already been undone, for example by another administrator.

**What to do:** Nothing: the organization is kept. Reload the Organization tab to see where it stands.

Code `org_removal_none`

> This is the deployment’s own organization, which its operators sign in to, so it cannot be deleted.

**Why:** This organization is the one the people who run this deployment of Clock Clerk sign in to. Deleting it would lock them out of the deployment itself.

**What to do:** Nothing can delete it from the Organization tab. Talk to whoever runs the deployment.

Code `org_removal_home`

> Your organization is being deleted on *date*. Undo the deletion on the Organization tab first, then choose a plan.

**Why:** An administrator has asked for your organization to be deleted, and a plan chosen now would go on being charged for an organization that is about to go. So no subscription can be started or kept, and no plan asked for, until the deletion is undone.

**What to do:** To keep the organization and pay for it, choose **Undo deletion** on the [Delete organization](https://clockclerk.com/guide/screens/admin-organization.md) card, then choose a plan. To let it go, do nothing: it is removed on the day shown.

Code `billing_removal_pending`

> This deployment does not take payment online. Choose a plan to ask us for one instead.

**Why:** You tried to pay or manage billing online, but this deployment of Clock Clerk does not take payment through Stripe.

**What to do:** Choose a plan on the [Plans page](https://clockclerk.com/guide/screens/trial.md): the button opens a message to support, who put your organization on the plan for you.

Code `billing_off`

> You already have a subscription. Change or cancel it under Organization → Plan & billing.

**Why:** An administrator tried to start a new subscription, but your organization already has one. A second checkout would charge you twice, so it is refused. A checkout that has just been paid counts too, even before the screen knows about it.

**What to do:** If you just paid, wait a few seconds and reload. Otherwise open **Organization** under **Settings** and use the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card: **Switch to Team**, **Switch to Starter** or **Cancel subscription**.

Code `billing_already_subscribed`

> You already have a subscription, and a payment on it is due. Pay it under Organization → Plan & billing.

**Why:** An administrator tried to start a new subscription, but your organization already has one, and a payment on it has failed or is unpaid.

**What to do:** Open **Organization** under **Settings** and pay the overdue invoice from the banner on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card, with the card on file or **Use another card**. Paying lifts any read-only lock once Stripe confirms it.

Code `billing_already_subscribed_due`

> Payment isn’t set up completely on this deployment, so it can’t take you to the payment page. Ask whoever runs it to set its public address.

**Why:** Online payment is switched on for this deployment, but it has no public web address set for Stripe to send you back to after paying, so choosing a plan, and **More billing settings in Stripe**, can't open Stripe's pages.

**What to do:** This is for whoever runs this deployment to fix by setting its public address. Until they do, choosing a plan and **More billing settings in Stripe** won't work. Paying an open invoice and updating the card on the Plan & billing card still do.

Code `billing_no_return_address`

> Stripe didn’t answer. Try again in a moment.

**Why:** Clock Clerk asked Stripe, the payment service, to do something for your billing and Stripe didn't answer or refused.

**What to do:** Wait a moment and try again. If it keeps happening, contact support; the details are in the deployment's log.

Code `billing_stripe_failed`

> Your organization has no billing account yet. Choose a plan to set one up.

**Why:** An administrator tried to open the billing settings, a card or an invoice, but your organization has never started a subscription through Stripe, or Stripe no longer has its account.

**What to do:** Choose a plan on the [Plans page](https://clockclerk.com/guide/screens/trial.md); the checkout sets up the billing account. If you were already paying, contact support.

Code `billing_no_account`

> That invoice wasn’t found.

**Why:** You tried to pay or check an invoice that Stripe doesn't hold for your organization.

**What to do:** Reload the **Organization** tab and pay from the invoice list on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card. If an invoice you expect is missing, contact support.

Code `billing_invoice_not_found`

> That invoice can’t be paid: it’s void or not issued yet.

**Why:** You tried to pay an invoice that Stripe has voided or not yet issued, so there is nothing on it to pay.

**What to do:** Reload the **Organization** tab to see what is still owed on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card. Nothing needs paying on that invoice.

Code `billing_invoice_not_payable`

> The card wasn’t confirmed. Try again.

**Why:** You added a new card, but Stripe has not confirmed it, for example because a bank check was not completed. Any card already on file stays.

**What to do:** Open **Update card**, or **Add a card** where there is none yet, on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card again and complete any check your bank asks for.

Code `billing_card_not_confirmed`

> That card setup wasn’t found.

**Why:** A card being saved couldn't be matched to your organization, usually because a newer card was saved after it, for example in another tab.

**What to do:** Reload the **Organization** tab and check what it **Pays by** on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card. If it is not the one you want, use **Update card** (or **Add a card**, where there is none) again.

Code `billing_card_setup_not_found`

> Your organization has no subscription yet. Choose a plan to start one.

**Why:** An administrator tried to change plan, cancel, or keep a subscription, but your organization doesn't have one yet. A checkout whose payment hasn't arrived counts as none yet.

**What to do:** Choose a plan on the [Plans page](https://clockclerk.com/guide/screens/trial.md). If you just paid, wait a few seconds and reload.

Code `billing_no_subscription`

> Your subscription has ended. Choose a plan to start a new one.

**Why:** An administrator tried to change plan, cancel, or keep the subscription, but it has already ended. An ended subscription can't be changed or brought back.

**What to do:** Start a new one by choosing a plan on the [Plans page](https://clockclerk.com/guide/screens/trial.md). Nothing you recorded was deleted; see [when the organization is read-only](https://clockclerk.com/guide/screens/trial.md).

Code `billing_subscription_ended`

> A payment on your subscription is due. Pay it under Organization → Plan & billing before canceling.

> A payment on your subscription is due. Pay it under Organization → Plan & billing before keeping it.

> A payment on your subscription is due. Pay it under Organization → Plan & billing before changing plan.

**Why:** An administrator tried to change plan, cancel, or keep the subscription while a payment on it is owed. A plan change needs the subscription paid up, so it is refused even while Stripe is still retrying a failed payment. Canceling and keeping are refused only once Stripe has stopped retrying and the payment is unpaid.

**What to do:** Pay the overdue invoice from the banner on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card on the **Organization** tab, then try again.

Code `billing_payment_due`

> This subscription was arranged with us. Contact support to change it.

**Why:** Your subscription is on a price arranged with Clock Clerk directly, not one of the Starter or Team prices, so the app can't switch it without ending that arrangement.

**What to do:** Contact support to change your plan.

Code `billing_arranged`

> Your subscription ends on *date*. Keep your subscription first, then change plan.

**Why:** An administrator tried to change plan while the subscription is set to end on the date shown. A subscription about to end can't change plan.

**What to do:** Choose **Keep my subscription** on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card first, then switch plan. If support set the end date, **Keep my subscription** is refused; ask support to undo it.

Code `billing_cancel_pending`

> Your organization already moves to *plan* on *date*.

**Why:** An administrator asked to move to a plan that the organization is already set to move to, on the date shown. A move to Starter waits for the end of the billing period.

**What to do:** Nothing needs doing; the move happens on that date. To stay on Team instead, choose **Keep Team** on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card.

Code `billing_plan_pending`

> Your organization is already on *plan*.

**Why:** An administrator asked to switch to the plan the organization is already on.

**What to do:** Nothing needs doing. Reload the **Organization** tab if the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card still shows the old plan.

Code `billing_plan_current`

> Your subscription already ends on *date*.

**Why:** An administrator chose to cancel the subscription, but it is already set to end on the date shown.

**What to do:** Nothing needs doing; it ends then. To undo it, choose **Keep my subscription** on the [Plan & billing](https://clockclerk.com/guide/screens/admin-organization.md) card; if support set the end date, ask support to undo it.

Code `billing_already_ending`

> Your subscription isn’t set to end, so there is nothing to keep.

**Why:** An administrator chose to keep the subscription, but it isn't set to end, for example because somebody else already kept it. A subscription support set to end on a date is not one you can keep from here; ask support.

**What to do:** Nothing needs doing. Reload the **Organization** tab to see the subscription as it stands.

Code `billing_not_ending`

> A logo is a PNG, JPEG or WebP image. SVG isn’t accepted: export it as a PNG instead.

**Why:** An administrator uploaded a logo on the Organization tab's Branding card in a format Clock Clerk doesn't take. Only PNG, JPEG and WebP images are accepted; SVG and other formats are refused, whatever the file is named.

**What to do:** Export the logo as a PNG (or JPEG or WebP), up to 512 KB, and upload it again on the [Branding](https://clockclerk.com/guide/screens/admin-organization.md) card.

Code `logo_type`

> This organization’s access to Clock Clerk has been suspended, so no directory can be connected to it.

**Why:** An administrator tried to connect a Microsoft Entra directory to the organization, but its access to Clock Clerk has been suspended.

**What to do:** Nothing can be connected while it is suspended. Ask whoever runs this deployment (for Clock Clerk's own service, support) about the suspension.

Code `consent_link_suspended`

> This organization already signs in with Okta, so there is no directory to connect. Ask support if you want to change how it signs in.

> This organization already signs in with Microsoft Entra ID, so there is no directory to connect. Ask support if you want to change how it signs in.

**Why:** An administrator tried to connect a Microsoft Entra directory, but the organization already signs in with Okta or with Microsoft Entra ID. Connecting a directory is only for an organization that signs in with email and password, or with Microsoft without Microsoft Entra ID.

**What to do:** Nothing needs connecting. To change how your organization signs in, ask support; the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md) on the Organization tab shows the current method.

Code `consent_link_signs_in_elsewhere`

> A Microsoft Entra directory is already connected to this organization and is waiting for support to switch it over. Ask support if it is the wrong one.

**Why:** An administrator tried to connect a Microsoft Entra directory, but one is already connected and waiting for support to switch the organization over to it.

**What to do:** Nothing needs doing; support makes the switch, and until then everybody keeps signing in with their password. If the waiting directory is the wrong one, ask support. See the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md).

Code `consent_link_pending`

> Consent was granted for a different Microsoft directory from the one this organization signs in from (*directory id*). Consent as an administrator of that directory.

**Why:** An organization that signs in with Microsoft can only connect the directory it already signs in from, and the administrator who granted consent did so in another directory. Nothing changed.

**What to do:** Ask an administrator of the directory named in the message to start again with **Connect your Microsoft directory** on the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md), signing in to Microsoft with their account in that directory.

Code `consent_link_other_directory`

> This organization has no email domain of its own on record, so Clock Clerk cannot check that a directory belongs to it. Ask support to connect it for you.

**Why:** An administrator tried to connect a Microsoft Entra directory, but the organization has no email domain of its own on record, so Clock Clerk can't check that the directory is yours.

**What to do:** Ask support to connect the directory for you.

Code `consent_link_no_domain`

> Consent was granted for a different organization than the one you are signed in to. Sign in with the account you granted it as, and try again.

**Why:** After granting admin consent at Microsoft, you came back signed in to a different Microsoft organization from the one consent was granted for, so Clock Clerk can't tell which you meant.

**What to do:** Sign out, sign in with the same Microsoft account that granted consent, and follow the consent link again. See [Admin consent](https://clockclerk.com/guide/screens/setup.md).

Code `consent_wrong_directory`

> This deployment does not set organizations up by admin consent. Ask whoever runs it to set yours up for you — once it is, signing in works as usual.

**Why:** Somebody granted admin consent for an organization that Clock Clerk doesn't serve yet, but this deployment doesn't create new organizations that way.

**What to do:** Ask whoever runs this deployment to set your organization up. Once they have, [signing in with Microsoft](https://clockclerk.com/guide/signing-in.md) works as usual.

Code `consent_onboarding_closed`

> This organization’s access to Clock Clerk has been suspended. Granting consent again does not restore it — ask whoever runs this deployment.

**Why:** Somebody granted admin consent for an organization whose access to Clock Clerk has been suspended. Granting consent again doesn't lift a suspension.

**What to do:** Ask whoever runs this deployment (for Clock Clerk's own service, support) about the suspension.

Code `consent_suspended`

> This link to connect a Microsoft Entra directory has expired or has already been used. Start again from the Organization tab in Clock Clerk.

**Why:** Somebody followed a link to connect a Microsoft Entra directory that has expired or was already used. The link from **Connect Microsoft Entra ID** lasts an hour, the emailed one a week, and each works once; a newer link also cancels older ones.

**What to do:** First check the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md) on the Organization tab: a link already used, in another tab or by reloading after connecting, may have connected the directory, and if the card says it is connected and waiting, nothing more is needed. Otherwise an administrator starts again there, with **Connect Microsoft Entra ID** or **Email your IT administrator**.

Code `consent_link_expired`

> This link to connect a Microsoft Entra directory has already been used. Start again from the Organization tab in Clock Clerk.

**Why:** Somebody followed a link to connect a Microsoft Entra directory twice at the same moment, for example by clicking it twice quickly. Each link works only once, so the second of the two was refused.

**What to do:** Check the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md) on the Organization tab: if it says the directory is connected and waiting, nothing more is needed. Otherwise start again with **Connect Microsoft Entra ID**.

Code `consent_link_used`

> Connecting your organization’s directory is a Microsoft Entra administrator’s act. Your account holds no role in your directory that could have granted consent, so ask one of its administrators to do it.

**Why:** Somebody followed the link to connect your organization's Microsoft Entra directory with a Microsoft account that holds no administrator role in that directory, so it could not have granted consent.

**What to do:** Send the steps to one of your directory's administrators with **Email your IT administrator** on the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md), and have them follow the link.

Code `consent_connect_not_admin`

> The Microsoft account you consented with is not on *domains*, so Clock Clerk cannot tell that its directory is your organization’s. Consent with an administrator account on one of those domains.

**Why:** Somebody connected a Microsoft Entra directory with a Microsoft account whose address isn't on any of your organization's own email domains (the message lists them), so Clock Clerk can't tell the directory is yours.

**What to do:** Grant consent again with an administrator account whose address is on one of those domains. Start from the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md) on the Organization tab.

Code `consent_wrong_domain`

> This Microsoft Entra directory is already connected to another organization in Clock Clerk. Contact support so we can sort out which one it belongs to.

**Why:** Somebody tried to connect a Microsoft Entra directory that another organization in Clock Clerk already uses.

**What to do:** Contact support so they can sort out which organization the directory belongs to.

Code `consent_directory_taken`

> Setting your organization up is a Microsoft Entra administrator’s act: whoever grants consent becomes its first administrator here. Your account holds no role in your directory that could have granted it, so ask one of its administrators to follow the consent link — or ask whoever runs this deployment to set your organization up for you.

**Why:** Somebody tried to set up a new organization through admin consent with a Microsoft account that holds no administrator role in the directory. Whoever grants consent becomes the organization's first administrator, so only a Microsoft Entra administrator can, unless the deployment offers trials to anybody, and this one does not.

**What to do:** Use **Copy these instructions** on the page and send them to one of your directory's administrators, or ask whoever runs this deployment to set the organization up. See [Admin consent](https://clockclerk.com/guide/screens/setup.md).

Code `consent_not_admin`

> Your organization already signs in with *service*.

**Why:** An administrator asked to move to Okta or Microsoft Entra ID sign-in, or started moving to their own Okta, but the organization already signs in that way, or with the other one. An organization that signs in with Microsoft accounts is told this when it asks for the Microsoft Entra ID setup pack: it connects its directory itself instead.

**What to do:** Nothing needs doing. To change how your organization signs in, ask support. If your organization signs in with Microsoft accounts, an administrator of your Microsoft directory can use **Connect your Microsoft directory** on the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md) instead.

Code `sign_in_request_already`

> The setup pack only goes to an address on your organization’s own domain, and your organization has not proved one yet. Ask support to set up sign-in instead.

**Why:** An administrator asked for the sign-in setup pack to be emailed, but the pack only goes to an address on the organization's own domain, and your organization has no domain on record yet.

**What to do:** Ask support to set up sign-in for you instead. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `sign_in_request_no_domain`

> The setup pack only goes to an address on your organization’s own domain (*domains*), so that it can’t be used to email anybody else. Use your IT administrator’s address there.

**Why:** An administrator gave an address for the sign-in setup pack that isn't on the organization's own domains (the message lists them). The pack only goes there, so it can't be used to email anybody else.

**What to do:** Enter your IT administrator's address on one of those domains, under **Send the setup pack to** in the setup wizard or **Email your IT administrator** on the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md).

Code `sign_in_request_other_domain`

> *email address* is a personal address, and support only takes a sign-in request from an address at an organization. Email *support address* from your work address to set up sign-in instead.

**Why:** An administrator asked for a sign-in change, but their own account's address is a personal one, such as free webmail, and support only takes a sign-in request from an address at an organization.

**What to do:** Email support at the address in the message from your work address. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `sign_in_request_personal`

> Email *support address* to set up sign-in instead.

> Ask whoever runs this deployment to set up sign-in for you.

**Why:** An administrator asked for a sign-in change, but this deployment can't send the setup pack or pass the request on to support, for example because it has no email set up or its mail provider refused.

**What to do:** Email support at the address in the message to set up sign-in. If no address is shown, ask whoever runs this deployment.

Code `sign_in_request_unavailable`

> *address* can’t be sent a setup pack.

**Why:** An administrator asked for the sign-in setup pack to be emailed, but Clock Clerk won't send it to that address. At this point the address is on your own domain, so this usually means the organization's access has been suspended.

**What to do:** Ask support to set up sign-in for you. See the [Sign-in card](https://clockclerk.com/guide/screens/admin-organization.md).

Code `sign_in_request_not_sendable`

> The issuer has to be the https address of an authorization server on okta.com or oktapreview.com, for example https://acme.okta.com/oauth2/default. To sign in through Okta on your own domain, ask support to set it up instead.

**Why:** Before an organization starts signing in with its own Okta, Clock Clerk has somebody complete a test sign-in through it, and checks the token Okta returns. The issuer entered is not an https address on okta.com or oktapreview.com, so Clock Clerk did not contact it. An Okta on your own domain works too, but support has to set it up.

**What to do:** Copy the **Issuer URI** from your authorization server in the Okta Admin Console (Security → API). If your Okta uses a custom domain, ask support to set up sign-in instead. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `okta_test_not_okta_hosted`

> Clock Clerk couldn’t read the sign-in settings *issuer* publishes. Check that the issuer is your authorization server’s Issuer URI under Security → API in the Okta Admin Console, for example https://acme.okta.com/oauth2/default, or, if there is no API item there, your Okta address on its own, such as https://acme.okta.com.

**Why:** Before an organization starts signing in with its own Okta, Clock Clerk has somebody complete a test sign-in through it, and checks the token Okta returns. Clock Clerk could not read the settings and signing keys that issuer publishes, or what it found there belongs to a different issuer. That usually means a typo in the address, or a path after it that names no authorization server.

**What to do:** Copy the **Issuer URI** exactly as the authorization server shows it in the Okta Admin Console (Security → API), and test again. If your Okta has no API item under Security, it has no authorization servers of its own to list: enter your Okta address on its own, such as `https://acme.okta.com`. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `okta_test_unreachable`

> Okta’s token didn’t pass: it isn’t signed by that issuer’s keys, names a different issuer, has expired, or names no Okta user. Check that the issuer is the authorization server you signed in through, and try again.

**Why:** Before an organization starts signing in with its own Okta, Clock Clerk has somebody complete a test sign-in through it, and checks the token Okta returns. The token was not signed by the issuer entered, came from a different authorization server, had expired, or did not belong to a person.

**What to do:** Check that the issuer entered is the authorization server your Clock Clerk app integration signs in through, and test again with a fresh sign-in. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `okta_test_invalid_token`

> The token Okta issued is for a different application than the client id you entered. Copy the client id from Clock Clerk’s app integration in your Okta Admin Console, and try again.

**Why:** Before an organization starts signing in with its own Okta, Clock Clerk has somebody complete a test sign-in through it, and checks the token Okta returns. The token was issued to a different app integration than the client id entered.

**What to do:** Copy the **Client ID** from the Clock Clerk app integration in the Okta Admin Console (Applications), and test again. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `okta_test_client_mismatch`

> The ID token Okta issued carries no email address, or marks it unverified. Make sure the app integration grants the email scope and the person has an email address in Okta, and try again.

**Why:** Before an organization starts signing in with its own Okta, Clock Clerk has somebody complete a test sign-in through it, and checks the token Okta returns. The token carries no email address, or says the address is unverified, so Clock Clerk cannot tell who signed in.

**What to do:** In the Okta Admin Console, check that the person who signed in has an email address on their profile, and that the authorization server's access policy lets the Clock Clerk app integration ask for the `email` scope (Security → API, the server, **Access Policies**; the default policy allows it). There is no claim to add. Then test again. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `okta_test_no_email`

> Okta signed you in as *email address*. The test has to sign in with the address you signed up with, or with an administrator’s address for an organization that already exists. Sign in to Okta as that person, or change their email in Okta to match.

**Why:** Before an organization starts signing in with its own Okta, Clock Clerk has somebody complete a test sign-in through it, and checks the token Okta returns. The person who signed in to Okta has a different email address there than the one that proves the test: the address that started the sign-up, or, for an organization that already exists, one of its administrators’.

**What to do:** Sign in to Okta as yourself with the address you use in Clock Clerk, or ask your Okta administrator to correct your email in Okta, and test again. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `okta_test_email_mismatch`

> Clock Clerk can’t give your organization a workspace address of its own from here, and Okta sign-in needs one. Finish with a password for now, then ask for Okta sign-in from the setup wizard, and support will assign the address.

**Why:** An organization that signs in with Okta has a workspace address of its own, like acme.clockclerk.com, and the app integration in your Okta has to name it. When you start a trial on Okta, nobody types that address: Clock Clerk takes it from your email domain. Here it can’t, because another organization already has that address, because the name is one Clock Clerk keeps for itself, or because your domain gives no usable name.

**What to do:** Choose a password on the same page and start your trial with it. Then ask for Okta sign-in in the setup wizard: support assigns your organization an address and switches it to Okta. If your organization already signs in with passwords and you were moving it to Okta yourself, ask for Okta sign-in instead in the same way. See [The emailed link](https://clockclerk.com/guide/screens/setup.md).

Code `okta_workspace_unavailable`

> The Free plan signs in with passwords only. Choose a password to start on Free, or start a free trial instead to sign in with Okta.

**Why:** You opened the emailed link from **Start on Free** and chose **Use my organization’s Okta**. Single sign-on, Okta included, comes with every paid plan and the trial, not with Free, so a Free organization cannot start on Okta. Nothing has been created.

**What to do:** Choose a password on the same page to start on Free. To sign in with Okta from the start, start a free trial instead with [Start free trial](https://app.clockclerk.com/signup), which runs on the Team plan, and choose your Okta at its link; afterwards, pick any paid plan to keep it. See [Starting on your organization's Okta](https://clockclerk.com/guide/screens/setup.md).

Code `okta_free_plan`

> That Okta authorization server already signs in another Clock Clerk organization. Use an authorization server of your own, or ask support for help.

**Why:** Each authorization server in Okta signs people in to one Clock Clerk organization, so that a token from it always says which organization it is for. The issuer you entered belongs to an organization that is already set up. The message deliberately does not say which.

**What to do:** Check that you copied the **Issuer URI** of your own organization’s authorization server (Security → API in the Okta Admin Console). If it is yours and you think it shouldn’t be in use, ask support. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `okta_issuer_in_use`

> That issuer is too long. Copy the Issuer URI exactly as your authorization server shows it in the Okta Admin Console.

> Enter the client id of Clock Clerk’s app integration, exactly as your Okta Admin Console shows it.

**Why:** Connecting your own Okta takes two values from the Okta Admin Console: the issuer of your authorization server and the client id of Clock Clerk’s app integration. One of them is missing, or longer than any real one.

**What to do:** Copy the **Issuer URI** from Security → API, and the **Client ID** from the app integration’s General tab, and save again. See [Decide how people sign in](https://clockclerk.com/guide/workflows/set-up-your-organization.md).

Code `okta_settings_invalid`

> Your organization didn’t switch itself to the way it signs in now, so it can’t switch back from here. Ask support to change it.

**Why:** An organization that switched itself to its own identity provider from the Organization tab can switch back to passwords there, but only while it still signs in the way it switched to. Yours was set up by support, or support has changed its sign-in since.

**What to do:** Ask support to move your organization back to email and password. See [Switching back to passwords](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_switch_back_unavailable`

> That identity provider already signs in another Clock Clerk organization. Use one of your own, or ask support for help.

**Why:** Each identity provider signs in one Clock Clerk organization, so that a sign-in through it can only mean yours. Another organization already signs in through the issuer you entered, or, for Google Workspace, through the same Workspace domain.

**What to do:** Check that you entered your own organization’s issuer or Workspace domain. If it is yours and you think it shouldn’t be in use, ask support. See [Set up single sign-on](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_switch_issuer_in_use`

> None of your organization’s administrators has an email address on its own domain, so a test sign-in can’t prove that the identity provider is your organization’s. Ask support to set up sign-in instead.

**Why:** An organization that signs in with passwords can move itself to its own identity provider once an administrator passes a test sign-in through it. The test only counts when the provider signs in one of the organization’s administrators with an address on a domain the organization has proved it owns, such as the one it signed up with. None of your administrators has such an address in Clock Clerk, so no test could pass.

**What to do:** Ask for sign-in through your provider instead, and support will set it up for you. See [Set up single sign-on](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_switch_no_administrator`

> Enter the issuer: the https address your identity provider names itself by.

> Enter the client secret of Clock Clerk’s app at your identity provider.

> Enter the client id of Clock Clerk’s app at your identity provider, exactly as it shows it.

**Why:** Testing a sign-in through your own provider takes its issuer (except for Google Workspace), the client id of Clock Clerk’s app there, and for Google Workspace its client secret. One of them is missing, is not an https address, or is longer than any real one. Google Workspace’s domain is not entered: the test sign-in learns it from your account.

**What to do:** Copy each value exactly as your provider shows it, and test again. See [Enter its details](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_switch_settings_invalid`

> This sign-in test has expired, has already been used, or was replaced by a newer one. Go back to your organization’s sign-in settings in Clock Clerk and start the test again.

**Why:** When an administrator tests a sign-in through their own provider, Clock Clerk runs it on the organization’s own workspace address. Each test is good for an hour, and starting another replaces it. This one is past its hour, has already switched the organization, or was replaced. It is also the answer when the organization has become read-only since the test was started, because its free trial or subscription ended: choose a plan first.

**What to do:** Go back to the Sign-in card on the Organization tab and test again. If the organization already signs in through your provider, there is nothing left to do. See [Set up single sign-on](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_switch_ticket_invalid`

> Test a sign-in through these settings first. Switch on works for an hour after a test passes.

**Why:** Switch on only takes settings a test sign-in has proved, within the hour after it passed. No test has passed in that time, or something the test proved has changed since: the administrator it signed in has left or is no longer an administrator, or a newer test was started.

**What to do:** Choose Test sign-in again, then Switch on. See [Switch on](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_switch_untested`

> Clock Clerk can’t give your organization a workspace address of its own from here, and signing in through your own identity provider needs one. Ask support, who will assign the address.

**Why:** An organization that signs in through its own provider does so at a workspace address of its own, which the redirect URI registered at the provider is built on. Your deployment has no workspace addresses, your domain suggests none, or the one it suggests belongs to another organization.

**What to do:** Ask support, who can assign your organization an address and set up the sign-in. See [Set up single sign-on](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_switch_workspace_unavailable`

> The test sign-in didn’t pass: your identity provider refused it, or its answer wasn’t for the client id you entered. Check the client id and secret, that the redirect URI is registered exactly as shown, and that you’re assigned to the app, then test again.

**Why:** The test sign-in came back without a sign-in Clock Clerk could accept. Your provider refused it, perhaps because you are not assigned to the app, or the redirect URI is not registered exactly as shown, or the client id or secret is wrong, or the answer was for a different app.

**What to do:** Check the app at your provider against the panel: the redirect URI, the client id and secret, and that you are assigned to it. Then test again. See [Register Clock Clerk at your provider](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_test_failed`

> Your identity provider signed you in without an email address it vouches for. Make sure the app is granted the email scope and your account has a verified email address, then test again.

**Why:** A test sign-in is matched to one of your administrators by email address, and only by an address your provider says it has verified. The sign-in carried no email address, or one marked unverified.

**What to do:** Grant the app the `email` scope, give your account a verified email address at the provider, and test again. See [Set up single sign-on](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_test_no_email`

> Your identity provider signed you in as *email*, which isn’t the address of one of this organization’s administrators on its own domain. Sign in there as such an administrator, or change your address there to match the one you have in Clock Clerk.

**Why:** A test sign-in only proves the provider is your organization’s if it signs in one of your administrators, whose Clock Clerk address is on a domain your organization has proved it owns. Your provider signed in somebody else, or an administrator whose address there differs from the one in Clock Clerk.

**What to do:** Sign in to your provider as such an administrator, or change your address there to match your Clock Clerk address, and test again. See [Set up single sign-on](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_test_not_administrator`

> Google signed you in with an account that isn’t in a Google Workspace, such as a personal Gmail account. Sign in with your organization’s Google Workspace account, then test again.

**Why:** A test sign-in through Google Workspace learns your Workspace’s domain from the account Google signs in, because Google names the Workspace only for accounts that belong to one. The account you chose belongs to none, so there is no Workspace to switch your organization to. Nothing changed, and the test can be run again.

**What to do:** Test again and, at Google, choose your work account in your organization’s Workspace, or use **Use another account** to add it. See [Test a sign-in](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `google_switch_no_workspace_domain`

> Google signed you in with an account of a Google Workspace whose domain isn’t one your organization has proved it owns. Sign in with an account of your organization’s own Workspace, or ask support to add your Workspace’s domain.

**Why:** Every Google account goes through the same Google sign-in, so Clock Clerk switches your organization only to a Workspace on a domain your organization has proved it owns, such as the domain of the address you signed up with, or on a subdomain of one: a Workspace on `qa.example.com` counts when your organization owns `example.com`. The account Google signed in belongs to a Workspace on another domain. You also see this at **Switch on** if that domain stopped being your organization’s after the test passed.

**What to do:** Test again with an account of your organization’s own Workspace. If your Workspace’s primary domain differs from the one your organization signed up with, ask support to add it to your organization first. See [Test a sign-in](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `google_switch_domain_not_yours`

> Clock Clerk couldn’t read the sign-in settings *issuer* publishes. Check that the issuer is exactly the address your identity provider gives for it.

**Why:** Before a test sign-in starts, Clock Clerk reads the sign-in settings and signing keys the issuer publishes. It could not read them, or what it found there belongs to a different issuer. That usually means a typo in the issuer, or an address that is not your provider’s issuer.

**What to do:** Copy the issuer exactly as your provider gives it, such as your Okta authorization server’s Issuer URI, and test again. See [Enter its details](https://clockclerk.com/guide/workflows/set-up-single-sign-on.md).

Code `sign_in_test_unreachable`

## Expense settings and reimbursements

> A receipt threshold is an amount of zero or more, to the cent. Leave it empty for none.

**Why:** You saved a receipt threshold with more than two decimal places, or one larger than any expense can be. This applies both to the organization's **Receipt needed above** and to a client's **Receipt above** under Customer settings.

**What to do:** Enter an amount to the cent, such as `25.00`. Left empty, the organization's threshold means receipts are never required, and a client's means the organization's threshold applies. See [Receipts](https://clockclerk.com/guide/screens/admin-expense-categories.md).

Code `receipt_threshold_invalid`

> One of these claims was changed on the ERP export at the same moment, so nothing was saved. Please try again.

**Why:** You chose **Export and mark paid back** while one of the claims in the run was being released or retried on the ERP export at the same moment. A claim is paid back one way or the other, never both, so nothing was saved and no file was made.

**What to do:** Choose **Export and mark paid back** again. Any claim the ERP is now paying is left out of the run and listed under **Paid back through the ERP**. See [Exporting the run](https://clockclerk.com/guide/screens/reimbursements.md).

Code `reimbursement_export_race`

## Invoices

> An invoice has to say who is claiming. Give the organization a legal name.

**Why:** You saved the seller block on **Invoices → Customer settings** without a **Legal name**. Every invoice has to say who is claiming the money, so the name is required. Only Finance users and administrators have this screen.

**What to do:** Fill in **Legal name**, and your **Address**, **Tax id** and **Remit to** while you are there, then choose **Save profile**. See [Before you start](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_profile_legal_name`

> A tax rate is a percentage between 0 and 100.

**Why:** You entered a tax rate below 0 or above 100. That applies wherever a **Tax %** is typed: on an invoice, in the house or a customer's invoice settings, and on a contractor's profile or month.

**What to do:** Enter the rate as a percentage between 0 and 100, such as `20` for 20%. See [Customer settings](https://clockclerk.com/guide/screens/invoices.md).

Code `tax_percent_range`

> Payment terms are a number of days between 0 and 365.

**Why:** You entered payment terms below 0 or above 365 days. That applies wherever terms are typed: on an invoice, in the house or a customer's invoice settings, and on a contractor's profile.

**What to do:** Enter the number of days between issue and due date, from 0 to 365, such as `30`. See [Customer settings](https://clockclerk.com/guide/screens/invoices.md).

Code `payment_terms_range`

> There is nothing left to bill in that period. The hours may have gone onto another invoice since this screen was drawn.

**Why:** You chose **Create draft invoice**, but none of the ticked hours or expenses are still unbilled. Usually somebody else put them on another invoice after your screen was drawn.

**What to do:** Look for that invoice in the list on Invoices. If there is more to bill, open **Generate** again so it shows what is unbilled now. See [Generate a draft](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_nothing_to_bill`

> *invoice number* has been issued. Void it first if it is wrong.

**Why:** You tried to change an invoice that has been issued, or to issue or discard it again. Once issued, an invoice's lines and presentation are fixed, because the customer may already hold it.

**What to do:** If it is wrong, choose **Void invoice**, which puts its hours back in unbilled time, then generate a new draft. See [Discarding and voiding](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_issued`

> *invoice number* has been withdrawn and cannot be edited.

**Why:** You tried to change, issue or discard an invoice that has already been voided, or a draft that was discarded. A withdrawn invoice stays in the list as Void, struck through, and can't be changed.

**What to do:** Generate a new draft for the hours instead; they went back into unbilled time when it was withdrawn. See [Discarding and voiding](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_withdrawn`

> A percentage discount is between 0 and 100.

**Why:** You added a discount with **Add discount**, set it to %, and entered a percentage above 100. A percentage can't take off more than the whole amount.

**What to do:** Enter a percentage from 0 to 100, or remove the discount line with its **×**. See [Check its lines and totals](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_discount_percent_range`

> There is nothing on this invoice to issue.

**Why:** You chose **Issue invoice** on a draft with no lines left on it, usually because every line was removed.

**What to do:** Add what it should claim with **Add line**, or choose **Discard draft** and generate a new one. See [Check its lines and totals](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_nothing_to_issue`

> This organization has no invoice profile yet, so there is no seller to head the document. Fill one in under Invoices → Customer settings first.

**Why:** You chose **Issue invoice** before your organization has a seller block with a legal name. Issuing copies the seller block onto the invoice, so there has to be one.

**What to do:** On **Invoices → Customer settings**, fill in **Legal name** and the rest of the seller block, choose **Save profile**, then issue the draft. See [Before you start](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_no_profile`

> This invoice has not been issued. Discard the draft instead.

**Why:** You tried to void an invoice that is still a draft. Voiding is for issued invoices; a draft is withdrawn by discarding it.

**What to do:** Choose **Discard draft** on the draft instead. Its hours go back into unbilled time either way. See [Discarding and voiding](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_void_draft`

> This invoice has already been withdrawn.

**Why:** You tried to void an invoice that has already been voided or discarded, often by somebody else while you had it open.

**What to do:** Nothing needs doing: reload the invoice and it shows as Void. See [Discarding and voiding](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_already_withdrawn`

> *invoice number* has not been issued, so there is nothing for a customer to have paid. Issue it first.

**Why:** You tried to record a payment on an invoice that is still a draft. A customer can only pay an invoice that has been issued.

**What to do:** Choose **Issue invoice** first, then **Record payment**. See [Record a payment](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_payment_draft`

> *invoice number* has been withdrawn. Money received against it belongs on whatever replaced it.

**Why:** You tried to record a payment on an invoice that has been voided. A voided invoice can't be paid.

**What to do:** Record the money against the invoice that replaced it. If there is none yet, generate and issue one for the hours first. See [Record a payment](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_payment_withdrawn`

> *invoice number* has *amount* outstanding, and there is no way to take a payment back once it is recorded. Record what is owed, and send the rest back to the customer.

**Why:** The payment you recorded is more than the invoice's outstanding balance. A recorded payment can't be taken back, so the app won't take more than is owed. This can also happen when somebody else recorded a payment at the same moment.

**What to do:** Record exactly the balance shown, and send the rest back to the customer outside Clock Clerk. See [Record a payment](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_overpayment`

> This deployment has no mail provider configured, so an invoice cannot be emailed from here. Print it and send it however you already send documents, and ask whoever runs the deployment to configure a provider.

**Why:** You chose **Send to customer** or **Send reminder**, and this deployment has no mail provider set up. You won't see this on Clock Clerk's own service; it happens on a deployment whose operator hasn't configured email.

**What to do:** Choose **Print**, save the invoice as a PDF, and send it yourself. Ask whoever runs this deployment to configure a mail provider. See [Send it to the customer](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_email_mail_off`

> *invoice number* is still a draft. Issue it first — a draft is not a claim, and sending one would start terms that are not running.

**Why:** You tried to email an invoice that is still a draft. A draft isn't a claim yet, and its payment terms only start when it is issued.

**What to do:** Choose **Issue invoice**, then **Send to customer**. See [Issue it](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_email_draft`

> *invoice number* has been withdrawn, so there is nothing left to send.

**Why:** You tried to email, or send a reminder for, an invoice that has been voided. There is nothing left on it to claim.

**What to do:** If the hours still need billing, generate and issue a new invoice and send that one. See [Discarding and voiding](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_email_withdrawn`

> *client* has no billing address on their record, so there is nowhere to send this. Add one under Clients first.

**Why:** You tried to email an invoice, and the client has no **Billing email** on their record.

**What to do:** Ask an administrator to add a **Billing email** to the client under [Clients](https://clockclerk.com/guide/screens/clients.md), or print the invoice and send it yourself.

Code `invoice_email_no_address`

> This organization may email *number* invoices a minute and *number* a day. Wait a moment, or print the document and send it however you already send documents.

**Why:** Your organization has sent as many invoice emails as it may for now: 5 a minute and 50 a day. Invoices and their reminders count together.

**What to do:** Wait a minute and send again; if the day's limit is reached, send it tomorrow, or choose **Print** and send it yourself. See [Send it to the customer](https://clockclerk.com/guide/workflows/bill-a-client.md).

Code `invoice_email_rate_limited`

## Contractors

> That person already has a contractor profile.

**Why:** An administrator chose **New contractor** and picked a person who already has a contractor profile. A person has only one.

**What to do:** Find them in the list on [Contractor profiles](https://clockclerk.com/guide/screens/admin-contractors.md) and use **Edit** instead.

Code `contractor_profile_exists`

> That contractor has a month that has been submitted and not yet paid. Settle or return it before removing the profile.

**Why:** Somebody in Finance or an administrator chose **Remove** on a contractor profile while one of that contractor's months is submitted and not yet paid. The month still needs the profile to be paid from.

**What to do:** Find the month on [Awaiting payment](https://clockclerk.com/guide/screens/contractors.md) and take it the rest of the way, which depends on its state (see [its buttons](https://clockclerk.com/guide/screens/contractors.md)). **Awaiting sign-off:** the engagement manager chooses **Countersign protocol**, or the contractor withdraws it. **With accounting:** Finance chooses **Approve for payment**. **Approved to pay:** pay it, then choose **Mark as paid**. Then remove the profile. Returning the month to the contractor doesn't help: a returned month still counts as submitted. Only the contractor can take it back, with **Withdraw** while it is **Awaiting sign-off**; a returned month has to be submitted again first.

Code `contractor_profile_open_month`

> An invoice series starts at 1.

**Why:** Somebody saved a contractor's billing details with a **Next number** below 1. A contractor's own invoice series starts at 1.

**What to do:** Set **Next number** to 1 or more under Numbering & tax, on the profile in [Contractor profiles](https://clockclerk.com/guide/screens/admin-contractors.md) or on [My Month → Billing details](https://clockclerk.com/guide/screens/month.md), and save again.

Code `invoice_series_start`

> A contractor needs somebody to accept their months. Name an engagement manager.

**Why:** An administrator saved a contractor profile without an **Engagement manager**, or with one who is no longer in the organization. Every contractor needs somebody to accept their months.

**What to do:** Choose an **Engagement manager** under Contract on the [profile](https://clockclerk.com/guide/screens/admin-contractors.md) and save again.

Code `contractor_countersigner_missing`

> A contractor cannot countersign their own months.

**Why:** A contractor profile was saved naming the contractor as their own engagement manager. Nobody accepts their own work.

**What to do:** Name somebody else as **Engagement manager**: an administrator, a Manager over one of their projects, or someone in Finance allowed to countersign. See [Before you start](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_countersigner_self`

> *name* handles the money but has not been allowed to countersign, so they cannot accept a month. An administrator can allow it on the People tab.

**Why:** A contractor profile was saved naming somebody in Finance as engagement manager, but they don't have **Can countersign contractor months**. Handling the money doesn't on its own let somebody accept the work.

**What to do:** An administrator turns on **Can countersign contractor months** on that person's page under [People](https://clockclerk.com/guide/screens/admin-people.md), or names somebody else. See [Before you start](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_countersigner_finance`

> *name* is not a manager or an administrator, so they cannot accept a month.

**Why:** A contractor profile was saved naming a User as engagement manager. Only a Manager, an administrator, or someone in Finance allowed to countersign can accept a contractor's month.

**What to do:** Name somebody who can, or have an administrator change that person's role on [People](https://clockclerk.com/guide/screens/admin-people.md) first. See [Roles](https://clockclerk.com/guide/roles.md).

Code `contractor_countersigner_not_manager`

> *name* does not manage any project this person is on, so they could not approve the month’s timesheets. Grant them access first, or name somebody who has it.

**Why:** A contractor profile was saved naming a Manager who doesn't manage any project the contractor is on. Countersigning approves the contractor's weeks, which that Manager couldn't do.

**What to do:** An administrator gives the Manager a grant over a client or project the contractor works on (see [grants](https://clockclerk.com/guide/workflows/set-up-your-organization.md)), or names somebody who already has one.

Code `contractor_countersigner_no_reach`

> There are no payment details on this profile to confirm.

**Why:** Somebody in Finance or an administrator chose **Confirm payment details** on a profile that has no payment details yet.

**What to do:** Nothing to confirm yet. The contractor adds them on [My Month → Billing details](https://clockclerk.com/guide/screens/month.md), or you add them with **Edit** on [Contractor profiles](https://clockclerk.com/guide/screens/admin-contractors.md); then confirm.

Code `contractor_payment_nothing_to_confirm`

> These payment details have changed since you opened them. Look at them again before confirming.

**Why:** Somebody changed the contractor's payment details while you had the confirmation dialog open, so what you checked is no longer what is on file. Nothing was confirmed.

**What to do:** Close the dialog, reload [Contractor profiles](https://clockclerk.com/guide/screens/admin-contractors.md), and choose **Confirm payment details** again. Check the new details with the contractor before confirming.

Code `contractor_payment_details_stale`

> This month has been submitted, so it is no longer yours to change. Ask for it to be returned first.

**Why:** As a contractor, you tried to change a month's invoice settings or mark days as not worked after submitting it. Once submitted, the month is frozen.

**What to do:** If it is still **Awaiting sign-off**, choose **Withdraw** on [My Month](https://clockclerk.com/guide/screens/month.md). If it is **With accounting**, ask your engagement manager or Finance to send it back. Once it is **Approved to pay** or **Paid**, it can no longer be sent back. See [Your month, as a contractor](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_month_submitted`

> An invoice cannot be dated before the month it is for.

**Why:** As a contractor, you set the **Invoice date** on My Month to a day before the month the invoice is for.

**What to do:** Choose a date in the month or later. See [Beside the documents](https://clockclerk.com/guide/screens/month.md).

Code `contractor_invoice_date_early`

> An invoice total cannot be negative.

**Why:** As a contractor issuing your own invoice, you entered a negative amount in **Its total** on My Month.

**What to do:** Enter the total from your own invoice as zero or more. It has to match the protocol before you can submit. See [Beside the documents](https://clockclerk.com/guide/screens/month.md).

Code `contractor_invoice_total_negative`

> An invoice number is at most *maximum* characters.

**Why:** As a contractor issuing your own invoice, you entered a number in **Your invoice number** longer than the limit the message names.

**What to do:** Shorten it to fit. See [Beside the documents](https://clockclerk.com/guide/screens/month.md).

Code `contractor_invoice_number_too_long`

> Every workday this month is already accounted for.

**Why:** As a contractor, you chose **Mark as not worked**, but no workday this month is left without time, for example because you logged it in the meantime.

**What to do:** Nothing needs doing. Reload [My Month](https://clockclerk.com/guide/screens/month.md) to see the checks as they stand.

Code `contractor_month_accounted_for`

> This month is not ready to submit: some workdays have no time on them. Log the time, or mark the days as not worked.

> This month is not ready to submit: your billing details are missing your legal name, tax id or payment details.

> This month is not ready to submit: no agreed rate covers some of its days. Whoever looks after contracts has to add one.

> This month is not ready to submit: the invoice to go with the protocol is not ready yet.

**Why:** As a contractor, you chose **Submit** while a check under **Before you submit** still blocks it: workdays with no time, missing billing details, a day with no agreed rate, or an invoice that isn't ready. The message names the first.

**What to do:** Clear it on [My Month](https://clockclerk.com/guide/screens/month.md): **Log time** or **Mark as not worked** for empty days, **Complete details** for billing details, and set a number prefix or your own invoice's number and total. A missing rate is for Finance or an administrator to add on Team costs ([Set what they are paid](https://clockclerk.com/guide/workflows/pay-contractors.md)).

Code `contractor_month_not_ready`

> Only a month that is waiting to be countersigned can be withdrawn. Once somebody has acted on it, ask for it to be returned.

**Why:** As a contractor, you chose **Withdraw**, but the month is no longer waiting to be countersigned: it has been countersigned, approved, or sent back already.

**What to do:** If it was countersigned, ask your engagement manager or Finance to send it back. See [Your month, as a contractor](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_month_not_withdrawable`

> *name* is this contractor’s engagement manager, so it is their month to read and to act on.

> Somebody else is this contractor’s engagement manager, so it is their month to read and to act on.

**Why:** As a Manager, you tried to open or act on a contractor's month where somebody else is named as the engagement manager. Only the named engagement manager, Finance and administrators handle it.

**What to do:** Leave it to the person the message names, or ask an administrator to name you on the [contractor's profile](https://clockclerk.com/guide/screens/admin-contractors.md).

Code `contractor_not_your_engagement`

> An administrator has not allowed you to countersign contractor months. *name* is this contractor’s engagement manager, so it is theirs to accept.

> An administrator has not allowed you to countersign contractor months. Somebody else is this contractor’s engagement manager, so it is theirs to accept.

**Why:** You are in Finance and chose to countersign a contractor's month, but you aren't its engagement manager and an administrator hasn't given you **Can countersign contractor months**.

**What to do:** Leave the countersigning to the engagement manager the message names. You can still send the month back, approve it once it is countersigned, and pay it. An administrator can allow you on your page under [People](https://clockclerk.com/guide/screens/admin-people.md). See [Countersign the month](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_countersign_not_allowed`

> Only a month that has been submitted and not yet countersigned can be accepted.

**Why:** You chose **Countersign protocol**, but the month isn't awaiting sign-off: it was withdrawn, sent back, or already countersigned, perhaps by somebody else a moment ago.

**What to do:** Reload the month on [Contractors](https://clockclerk.com/guide/screens/contractors.md) to see where it stands. Nothing needs doing unless it comes back for sign-off.

Code `contractor_month_not_awaiting`

> Only a submitted month that has not been approved for payment can be sent back.

**Why:** You chose **Return to contractor**, but the month is not awaiting sign-off or with accounting. A month that hasn't been submitted, or has been approved for payment or paid, can't be sent back.

**What to do:** Reload the month to see its state. Once a month is **Approved to pay** or **Paid**, its figures are final. See [Sending a month back](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_month_not_returnable`

> This month has been countersigned, so it is not waiting on anybody who can be nudged from here — what is left is accounting’s.

**Why:** You chose **Send reminder** on a month that has already been countersigned. It now waits on Finance or an administrator, and nobody is reminded from here.

**What to do:** Nothing needs a reminder. Finance or an administrator approves it for payment and pays it. See [Reminders and emails](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_remind_countersigned`

> This month is waiting on you, so there is nobody to remind.

**Why:** You chose **Send reminder** on a month that is waiting on you, for example one awaiting your countersignature as its engagement manager.

**What to do:** Act on it yourself: **Countersign protocol** or **Return to contractor**. See [Countersign the month](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_remind_self`

> Whoever this month is waiting on is no longer on the roster.

**Why:** You chose **Send reminder**, but the person the month is waiting on is no longer in the organization.

**What to do:** If it is the engagement manager, an administrator names a new one on the [contractor's profile](https://clockclerk.com/guide/screens/admin-contractors.md). Then remind them.

Code `contractor_remind_gone`

> Only a countersigned month that has not been approved can be cleared for payment.

**Why:** Somebody in Finance or an administrator chose **Approve for payment** on a month that isn't with accounting: it hasn't been countersigned, was sent back, or was already approved.

**What to do:** Reload the month to see its state. A month has to be countersigned first. See [Approve it for payment](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_month_not_with_accounting`

> This month was submitted with payment details that have since changed. Return it so it is submitted again with the current ones.

**Why:** Somebody in Finance or an administrator chose **Approve for payment**, but the contractor's payment details changed after the month was submitted. The month would pay the account it was submitted with, which nobody approving it was shown.

**What to do:** Choose **Return to contractor** so they submit it again with the current details. The return clears the countersignature, so the engagement manager countersigns it again; then confirm the new details and approve. See [Confirm where the money goes](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_payment_route_changed`

> Payment details have not been confirmed since they last changed.

**Why:** Somebody in Finance or an administrator chose **Approve for payment**, but nobody has confirmed the contractor's payment details since they last changed.

**What to do:** Choose **Confirm payment details** under Payment, which opens Contractor profiles, check the details and confirm, then approve. See [Confirm where the money goes](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_payment_unconfirmed`

> Only a month that has been approved for payment can be marked as paid.

**Why:** Somebody in Finance or an administrator chose **Mark as paid** on a month that isn't approved for payment, or has already been marked paid.

**What to do:** Reload the month to see its state. If it is **With accounting**, choose **Approve for payment** first. See [Pay it and record it](https://clockclerk.com/guide/workflows/pay-contractors.md).

Code `contractor_month_not_approved`

> This month’s bill is being sent to *ERP* right now. Try again in a minute.

**Why:** You chose **Mark as paid** while your ERP is taking this month as a vendor bill at that very moment.

**What to do:** Wait a minute and try again. See [Export to an ERP or QuickBooks](https://clockclerk.com/guide/workflows/export-to-your-erp.md).

Code `contractor_bill_being_sent`

## Rates and costs

> There is already a billing role called “*name*”.

**Why:** You created or renamed a billing role with a name another role already has. Each name is used once, ignoring capitals, and archived roles count too. Only Finance users and administrators manage billing roles.

**What to do:** Choose another name. If the role you want is archived, choose **Restore** in its **…** menu under **Archived roles** instead. See [Billing roles](https://clockclerk.com/guide/screens/finance.md).

Code `billing_role_name_taken`

> Hours have been invoiced as this role. Archive it instead, so it leaves the pickers and keeps pricing what was booked as it.

> A contractor’s hours have been protocolled as this role. Archive it instead, so it leaves the pickers and keeps pricing what was booked as it.

> Somebody is assigned this role on a project. Archive it instead, so it leaves the pickers and keeps pricing what was booked as it.

> This role is somebody’s default. Archive it instead, so it leaves the pickers and keeps pricing what was booked as it.

> A client contract, a project’s rate card or a person’s rate card prices this role. Archive it instead, so it leaves the pickers and keeps pricing what was booked as it.

> Hours have been booked as this role. Archive it instead, so it leaves the pickers and keeps pricing what was booked as it.

**Why:** You deleted a billing role that something still uses. The message says what: hours booked, invoiced or on a contractor's protocol as the role, somebody assigned it on a project or having it as their default, or a client contract, project or person's rate card pricing it. Deleting it would leave those without a role.

**What to do:** Choose **Archive** in the role's **…** menu instead. It leaves every picker, keeps pricing what was booked as it, and can be restored later. See [Billing roles](https://clockclerk.com/guide/screens/finance.md).

Code `billing_role_in_use`

> This role’s prices changed since the screen was loaded. Try again.

**Why:** You deleted a billing role while somebody else changed or deleted one of its standard prices. Nothing was deleted.

**What to do:** Reload Billing rates and choose **Delete** again. See [Billing roles](https://clockclerk.com/guide/screens/finance.md).

Code `billing_role_prices_changed`

> Something has started using this role since the screen was loaded. Archive it instead, so it leaves the pickers and keeps pricing what was booked as it.

**Why:** You deleted a billing role that nothing used when your screen loaded, but somebody has since booked time as it, been assigned it, or priced it. Nothing was deleted.

**What to do:** Choose **Archive** in the role's **…** menu instead, so it leaves the pickers and keeps pricing what was booked as it. See [Billing roles](https://clockclerk.com/guide/screens/finance.md).

Code `billing_role_used_meanwhile`

> The effective-to date is before the effective-from date.

**Why:** You saved a rate or cost period whose end date is before its start date. This applies to billing rates and to team costs.

**What to do:** Set **Effective to** on or after **Effective from**, or leave it empty for no end. See [Billing rates](https://clockclerk.com/guide/screens/finance.md).

Code `period_end_before_start`

> An hourly cost cannot be more than *maximum*. For a salary, choose Monthly or Annual.

**Why:** You saved an hourly cost above 100,000. A figure that large is almost always a salary typed under the **Hourly** basis, which would price every hour at it.

**What to do:** If it is a salary, choose **Monthly** or **Annual** under **Basis** and keep the figure. Otherwise correct the hourly amount. See [Team costs](https://clockclerk.com/guide/screens/finance.md).

Code `cost_hourly_too_high`

## Reports

> That range is too long to cost — *years* years at a time at most.

**Why:** Your report's date range covers more than 5 years. Costs are worked out month by month over the range, so a range is capped at 5 years at a time.

**What to do:** Set a shorter **Date range**, or a **Custom** range with **From** and **To** 5 years apart at most. For longer, run one report per stretch. See [Narrow it down](https://clockclerk.com/guide/workflows/report-on-your-time.md).

Code `report_cost_range_too_long`

> That range is too long to ask where filings stand — *years* years at a time at most.

**Why:** Your report's date range covers more than 5 years. The report looks up where every person's weeks stand over the range, so a range is capped at 5 years at a time.

**What to do:** Set a shorter **Date range**, or a **Custom** range with **From** and **To** 5 years apart at most. For longer, run one report per stretch. See [Narrow it down](https://clockclerk.com/guide/workflows/report-on-your-time.md).

Code `report_filing_range_too_long`

> You already have a report called “*name*”.

**Why:** You saved or renamed a report with a name one of your own saved reports already has. Names only need to be unique among your reports, ignoring capitals.

**What to do:** Choose another **Name**, or open the report you already have from **Saved reports** and save over it. See [Save it](https://clockclerk.com/guide/workflows/report-on-your-time.md).

Code `saved_report_name_taken`