Reference
OPC UA status codes
Every OPC UA status code an engineer actually meets, with what it means, the real causes in order of frequency, and the fix. Currently 127 codes documented out of the 273 in the normative StatusCode list, prioritised by how often they stop a project.
How to use this. Work the code you actually got, not the one you expected. OPC UA returns the most specific code it can, and the specific code usually names the real problem, a certificate error is almost never a network error. If you cannot connect at all, start at BadConnectionRejected; if the session opens then drops, start at BadSecurityChecksFailed.
127 pages
Certificates 14
BadCertificateChainIncompleteA CA-issued certificate fails validation even though the root CA is trusted, and the error mentions an incomplete or unbuildable chain rather than a tBadCertificateHostNameInvalidThe channel opens far enough to validate the certificate and then fails with a domain or hostname mismatch, typically right after you switch from a hoBadCertificateInvalidThe handshake fails immediately with no useful detail, and moving the certificate into the trusted store makes no difference at all.BadCertificateIssuerRevocationUnknownValidation completes on the peer certificate but fails on one of the CA certificates above it, typically in a two-tier PKI where only the sub-CA's CRLBadCertificateIssuerRevokedEvery application whose certificate came from one particular CA fails to connect at once, while applications certified by a different CA are unaffecteBadCertificateIssuerTimeInvalidEvery application certified by one CA stops connecting at the same moment, and the individual application certificates are all well within their own vBadCertificateIssuerUseNotAllowedCertificates issued by a working corporate CA - trusted elsewhere in the enterprise, fine for TLS - are refused by OPC UA applications with an issuer BadCertificatePolicyCheckFailedAn older device or a legacy client is refused at the handshake while modern peers connect normally to the same endpoint, and the certificate itself isBadCertificateRevocationUnknownA properly chained, in-date, correctly named certificate is refused with a revocation-related error, and the crl folder in your PKI is empty or holds BadCertificateRevokedA connection that previously worked fails at the handshake with this code, and the peer certificate lands in the rejected store while the endpoint itsBadCertificateTimeInvalidA connection that worked for months fails overnight, or a brand-new device fails immediately on first connect with a certificate validity error.BadCertificateUntrustedThe connection dies during OpenSecureChannel, the client shows a trust dialog or a certificate error, and a copy of the offending certificate turns upBadCertificateUriInvalidCertificate validation gets past trust and hostname checks and then fails on the application URI, often immediately after someone copied a configuratiBadCertificateUseNotAllowedA certificate that is trusted, in date and correctly named is still rejected, and the message points at key usage rather than at trust, chain or hostn
Security 7
BadApplicationSignatureInvalidThe secure channel opens and CreateSession succeeds, then ActivateSession fails immediately, so the client appears to almost connect before dropping.BadNonceInvalidOne particular client or server pairing fails at OpenSecureChannel or ActivateSession while both applications work perfectly against every other peer.BadSecurityChecksFailedThe handshake gets past the endpoint list and then dies during OpenSecureChannel, CreateSession or ActivateSession with a security error that names noBadSecurityModeInsufficientReads and browses work normally, but one specific method call or one specific node fails, and it fails identically for every user you try.BadSecurityModeRejectedA quick unsecured test connection is refused outright, or a client configured for Sign fails against a server that only publishes SignAndEncrypt.BadSecurityPolicyRejectedA client that connects fine to one server refuses to connect to another, and the failure happens immediately at channel open with no certificate dialoBadUserSignatureInvalidAnonymous or username login to the same server works, and only the certificate-based user identity fails, always at ActivateSession.
Authentication 4
BadIdentityChangeNotSupportedAn application that connects anonymously and then re-activates with a user's credentials for a privileged action is refused at the re-activation, whilBadIdentityTokenInvalidActivateSession fails immediately regardless of which username and password you try, and anonymous connection to the same endpoint may work fine.BadIdentityTokenRejectedOne user's credentials are refused while another user connects successfully to the same endpoint with the same client and settings.BadUserAccessDeniedBrowsing works, reads on some nodes work, and a specific read, write or method call is refused for one user while an administrator can perform it.
Sessions 4
BadSessionClosedCalls fail immediately with BadSessionClosed rather than timing out, often right after a shutdown path or a reconnect ran in parallel with normal workBadSessionIdInvalidA client that has been reading happily for minutes or hours suddenly fails every service call with BadSessionIdInvalid, and keeps failing until it recBadSessionNotActivatedThe connection appears to come up - no certificate error, no timeout - but the first real request, usually a Browse of the root folder, fails with BadBadTooManySessionsNew clients cannot connect while existing ones keep working, and the failure appears at CreateSession rather than at the socket or certificate stage.
Channels 4
BadRequestHeaderInvalidEvery service call on an otherwise healthy channel fails with the same header error, including simple ones like Read, so the problem is clearly not thBadSecureChannelClosedRequests fail as a group the moment the channel goes, typically with outstanding Publish requests completing first, and the client's connection state BadSecureChannelIdInvalidRequests are rejected instantly with a channel-level error, often immediately after a reconnect attempt that appeared to succeed at the TCP layer.BadSecureChannelTokenUnknownA long-running connection fails at a regular interval - often on the hour or on a fixed multiple of minutes - and recovers after a reconnect, then fai
Connection 17
BadConnectionClosedIn-flight requests, especially long-polled Publish calls, all complete with the same error at the same instant, and the client's state goes to reconneBadConnectionRejectedThe client fails immediately with a connection error and no OPC UA detail - no endpoint list, no certificate prompt, no session.BadEndpointUrlInvalidThe connection fails before any certificate or user prompt, usually within a second, with the client reporting the URL rather than a network or securiBadProtocolVersionUnsupportedThe TCP connection is accepted and then torn down within milliseconds, before any endpoint list, certificate prompt or session, with an error naming tBadRequestInterruptedSeveral in-flight requests fail together at the exact moment a reconnect starts, with no server-side fault reason attached to any of them.BadRequestTimeoutOne kind of call - a large Browse, a bulk Read, a method that touches the field layer - times out consistently while small calls on the same session rBadServerHaltedThe connection is established or re-establishes fine, but every service call is refused with the same code, and it persists until someone intervenes oBadServerNotConnectedEither every call from a client fails instantly with no network activity at all, or a subset of tags on a gateway go bad together while the rest of thBadServerTooBusyRequests are refused quickly and cleanly on a connection that is otherwise healthy, in bursts that correlate with plant startup, a server restart or aBadShutdownEvery outstanding request completes with the same code at once, the connection drops immediately afterwards, and the server is unreachable for a shortBadTcpEndpointUrlInvalidThe TCP connection is accepted and then closed immediately with an error frame, so the client reports a failure in well under a second with no certifiBadTcpMessageTooLargeSmall operations work fine but one specific call fails every time: a wide Read, a large Write, a browse of a big folder, or a subscription notificatioBadTcpMessageTypeInvalidA server configured for reverse connect logs repeated rejections from the client address and stops retrying, while the client shows an unexpected messBadTcpNotEnoughResourcesConnections or large requests fail on a server that has been running for a while, often alongside subscription and browse failures, and often clearingBadTcpSecureChannelUnknownMessages are rejected at the framing layer immediately after what looked like a successful reconnect, or immediately after a server restart while the BadTcpServerTooBusyNew connections are refused at the handshake while existing clients keep working, and the refusals cluster at plant startup or after a server restart.BadTimeoutOperations fail after a fixed interval that matches an SDK default, and the connection often recovers by itself a moment later, giving a sawtooth of f
Address space 12
BadAttributeIdInvalidA Read returns Good at the service level but one entry in the results array carries this status, usually the entry for a folder or an object that a geBadBrowseDirectionInvalidA Browse call fails immediately with this code for every node, including well-known nodes such as the Objects folder, while a Read on the same sessionBadContinuationPointInvalidA large browse or history query works for the first few pages and then fails partway through, more often on a loaded server or when the client paused BadNoContinuationPointsBrowse or HistoryRead starts failing for every client on a busy server, and the failures clear after clients are restarted rather than after any serveBadNoMatchA browse path that resolves against one machine returns no match against an apparently identical one, or a query that worked in a test system returns BadNodeClassInvalidOne specific operation fails against a node that browses and reads perfectly well, most often a method Call or an event subscription.BadNodeIdInvalidEvery request touching one particular node fails identically, and the failing value in the log often looks visibly wrong - an empty NodeId, a stray coBadNodeIdUnknownA client that has worked for months suddenly fails on some or all of its nodes right after a controller download, a firmware update or a server reconfBadNotFoundOne entry in a browse-path translation result is bad while the others resolve, or a whole path fails at a specific element that you can plainly see inBadObjectDeletedA subset of nodes that worked a moment ago starts failing while the rest of the address space is untouched, often after a job finished, a file was cloBadReferenceTypeIdInvalidA Browse or AddReferences call that works against one server fails against another, and the browse returns nothing rather than an empty result set.BadTooManyMatchesA path translation or query fails only against the largest machines or the busiest servers, while the same request succeeds on a small test address sp
Data access 14
BadDataEncodingInvalidA Read or CreateMonitoredItems on a structured variable fails with BadDataEncodingInvalid while scalar nodes on the same server read fine.BadDataEncodingUnsupportedStructured values read fine with the default encoding but fail as soon as the client asks for XML or JSON, on a server that otherwise behaves normallyBadDecodingErrorA specific node or a specific service call fails to decode while everything else on the same session works, or a client throws a decoding exception miBadEncodingLimitsExceededReads or subscription notifications work for small sets and fail once a batch grows, a large array is added, or an address space export is attempted.BadIndexRangeInvalidA Read or Write that includes an IndexRange fails immediately, while the same request without the IndexRange succeeds and returns the whole array.BadIndexRangeNoDataA ranged read that worked yesterday now returns BadIndexRangeNoData, usually after the underlying array shrank or the server restarted with an empty bBadNotReadableBrowsing shows the node and its attributes fine, but every Read of the Value attribute and every attempt to add it to a subscription returns BadNotReaBadNotWritableA Write returns BadNotWritable immediately, with no delay and no effect on the value, while Reads on the same node work perfectly.BadOutOfRangeA Write with a plausible value is rejected while a smaller or larger value on the same node succeeds, and reading the node shows a range property thatBadRequestTooLargeA bulk Read, Write or CreateMonitoredItems fails outright with no per-item results, while the same operation split into halves succeeds.BadResponseTooLargeA Browse of a large folder, a HistoryRead over a long window, or a Publish during a burst fails while the same call over a smaller scope returns normaBadStructureMissingA service call fails immediately with BadStructureMissing and no per-item results, usually the first time a hand-built or generated request is used.BadTypeMismatchA Write that looks correct returns BadTypeMismatch for one item while the other items in the same request succeed, and reading the same node back workBadWriteNotSupportedA Write fails with BadWriteNotSupported even though AccessLevel shows CurrentWrite, and the same value written from a different tool succeeds.
Device 6
BadDeviceFailureTags from one device or one I/O module go bad while the rest of the server stays healthy, and the device itself is showing a fault indication.BadNoCommunicationThe session stays connected and browsing works, but a group of tags all flip to a bad status at the same moment and stay there until the underlying deBadNotConnectedA node browses normally and has a sensible DisplayName and DataType, but every read returns a bad status and no value has ever arrived - not even onceBadOutOfServiceA tag goes bad at a moment that correlates with maintenance work rather than with any equipment or network event, and it returns to Good when the workBadSensorFailureOne measurement goes bad while every other value from the same device stays Good, often with the raw signal sitting at an obvious under-range or over-BadWaitingForInitialDataImmediately after creating a subscription, the first notification for some or all items arrives with this status and no value, then real values follow
Subscriptions 13
BadDeadbandFilterInvalidItems with a deadband are rejected while identical items with DeadbandType None are accepted, and the rejection follows the node rather than the clienBadEventFilterInvalidAn attempt to subscribe to events on the Server object or an alarm area fails immediately, and no events are ever delivered even though the server cleBadFilterNotAllowedCreateMonitoredItems or ModifyMonitoredItems rejects a specific item with this code while identical items without a filter are accepted.BadFilterOperandInvalidAn event subscription is rejected and the response carries an EventFilterResult with a bad status against one specific select or where operand rather BadMonitoredItemFilterUnsupportedThe same filter that works against one server is rejected by another, usually a PLC or an embedded gateway, while the item itself is created successfuBadMonitoredItemIdInvalidModifyMonitoredItems, SetMonitoringMode, SetTriggering or DeleteMonitoredItems returns this code for some items while other items in the same call sucBadMonitoringModeInvalidSetMonitoringMode or CreateMonitoredItems rejects the item with this code, and the item either never reports or stays in whatever mode it already had.BadNoSubscriptionThe Publish loop returns this code immediately and repeatedly on a session that connects cleanly and can read and browse normally.BadSubscriptionIdInvalidPublish calls that were working start returning this code on every attempt, and no further data change notifications arrive, while a plain Read on theBadTooManyMonitoredItemsCreateMonitoredItems succeeds for the first part of a large batch and returns this code for the remainder, so a subscription comes up with fewer itemsBadTooManyOperationsA large Read, Write, Browse or CreateMonitoredItems call is rejected outright with this code as a whole-request error, while the same nodes succeed whBadTooManyPublishRequestsA client that works against one server logs this code steadily against another, sometimes alongside occasional gaps in data, while everything else aboBadTooManySubscriptionsCreateSubscription fails once a system has been running a while or once the last few clients are commissioned, while existing subscriptions keep worki
History 6
BadAggregateInvalidInputsA processed read returns good aggregate values for most intervals and this code for a scattered few, usually the intervals covering a machine stop or BadAggregateNotSupportedRaw history reads work, TimeAverage works, and PercentGood or WorstQuality returns this code from the same server.BadBoundNotFoundReads at fixed timestamps return values in the middle of a shift but fail at the first and last requested instants.BadDataUnavailableHistory reads succeed for the last few days and fail with this code as soon as the requested window crosses back into older data.BadHistoryOperationInvalidThe history service call itself completes but every node comes back with this code, and changing the time window by a few seconds sometimes makes it wBadHistoryOperationUnsupportedA raw or processed history read that works against one server returns nothing but this code against another, even though the variable clearly has live
Methods 5
BadArgumentsMissingA method that works from UaExpert's Call dialog fails from your own client with this code, and adding a placeholder argument changes the error rather BadInvalidArgumentThe call reaches the method and fails immediately, with the same values working from a vendor tool but not from your client.BadMethodInvalidThe method is clearly visible in the address space and readable in UaExpert, but every Call returns this code.BadNotExecutableThe same call succeeds when the machine is idle in local mode and fails whenever it is running, or succeeds for one login and fails for another.BadTooManyArgumentsA method call that used to work now fails after a client update or a server downgrade, with no change to the values being sent.
Server 9
BadInternalErrorOne reproducible request fails while everything else on the same session works, and the server log contains an exception or stack trace at the same inBadInvalidStateThe same call succeeds sometimes and fails at other times, with the difference tracking what the machine or the object was doing at that moment.BadNotImplementedA service or an operation that is defined in the specification and visible in your SDK returns the same refusal on every attempt, on every node, from BadNotSupportedA service that works with default parameters fails as soon as you set one particular option, filter, encoding or flag.BadNothingToDoA service call fails instantly with no per-operation results at all, usually right after a configuration load or a filtering step in the client.BadOutOfMemoryRequests start failing under load while smaller requests still succeed, and the server may recover on its own once clients back off.BadResourceUnavailablePart of the address space works normally while one branch, one service or one device consistently fails, often starting at a time that matches a restaBadServiceUnsupportedOne specific call fails identically every time from every client, while sessions, browsing and reads all work normally.BadUnexpectedErrorAn operation fails with a status that says nothing specific, sometimes intermittently, and the client has no additional information to act on.
Uncertain 6
UncertainEngineeringUnitsExceededA tag reports a value slightly beyond its declared limits with an uncertain status, most often at zero, at a maximum, or just past one end of the rangUncertainInitialValueThe first notification for many items after a subscription is created carries this status, and real values with Good status follow within a cycle or tUncertainLastUsableValueA tag keeps showing a plausible, unchanging value while the timestamp stops advancing, and downstream trends flatline instead of going bad.UncertainNoCommunicationLastUsableValueOne device's tags all freeze at plausible values with an uncertain status at the same instant, while tags from other devices on the same server keep uUncertainSensorNotAccurateA single analogue tag reports an uncertain status while its value sits at or near the end of its range, and the tags around it are all Good.UncertainSubstituteValueA tag reports a suspiciously round or default-looking number - zero, a nominal setpoint, a mid-range value - with an uncertain status, and it does not
Good 6
GoodClampedA write returns success, but reading the same node back gives a different number - typically exactly the range limit - and the machine behaves as if aGoodCompletesAsynchronouslyA method call returns success immediately for an operation that clearly cannot have finished - a recipe download, a software update, a long move - andGoodMoreDataA history query returns a plausible but short series that always ends at the same point, and a naive client concludes the data stops there.GoodNoDataA history query for a period you expected to be populated returns an empty result with a Good status, and a report shows a blank interval rather than GoodOverloadThe data looks continuous and plausible but samples are missing - a counter jumps, a cycle is absent, a fast transient never appears - and no error isGoodSubscriptionTransferredAfter a network interruption or a channel renewal, the client logs this code once per transferred subscription and data resumes without any monitored
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.