carrier port-out PIN generation fails with account locked error

Not specified by the original author.

TL;DR

402 means the account is locked, not that payment is required.

Fix

1. 402 means the account is locked, not that payment is required. Expected: you can confirm this matches your situation.

When to use

• You are setting up or using this Sinch Number Lookup API feature.
• The symptom matches: 402 means account locked, not payment required.

When NOT to use

• Unrelated Sinch Number Lookup API issues (different feature, different failure).
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported against Sinch Number Lookup API. Source: https://github.com/sinch/skills/blob/HEAD/skills/sinch-number-lookup-api/SKILL.md.

Variant phrasings

402 means account locked, not payment required

Why it happens

Sinch's Number Lookup v2 reuses HTTP codes with Sinch-specific meanings. Reading them as generic HTTP codes misdiagnoses the problem.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Source

https://github.com/sinch/skills/blob/HEAD/skills/sinch-number-lookup-api/SKILL.md

Source: Sinch's Number Lookup v2 reuses HTTP codes with Sinch-specific meanings. Reading them as generic HTTP codes misdiagnoses the problem.

Verified resolution: [sinch/skills]: 402 means the account is locked, not that payment is required. 403 means the API is disabled for the project, so the user should check intended-use-case declaration in the docs. Partial failures are possible: each feature sub-object carries its own error, so a lookup can succeed for line type but fail for simSwap. Gotchas: features must be explicit (omitting them returns only LineType), VoIP probability is a string enum Unknown/Low/Likely/High, SIM swap periods are short codes like SP24H, and RND requires contactDate or it 400s.

Source URL: https://github.com/sinch/skills/blob/HEAD/skills/sinch-number-lookup-api/SKILL.md

Not specified by the original author.

TL;DR

A YubiKey PIN locks after 3 wrong entries (8 on some older firmware). Reset it with the Yubico Manager app and the user's PUK code; if the PUK is also unknown, the only fix is a factory reset of the FIDO2 applet, which deletes every passkey on the key. After the reset, the user sets a new PIN and re-registers the key in Okta or Entra ID.

The error

PIN is locked. Reset the PIN using your PUK code.

In Okta: "Security key PIN is blocked"

Steps

1. Ask the user whether they recorded their PUK code when they first set the PIN. Expected: a yes or no. Most users never wrote it down, which decides whether step 3 or step 4 applies.
2. Plug the key into a machine and open Yubico Manager (or the Yubico Authenticator app). Expected: the key is detected. Some corporate machines need local admin to install the tool.
3. If the PUK is known: go to Applications > FIDO2 > Reset PIN, enter the PUK, and set a new 6+ digit PIN. Expected: the reset succeeds and the new PIN works on the next login.
4. If the PUK is unknown: go to Applications > FIDO2 > Reset FIDO2 (factory reset). Expected: all FIDO2 credentials are wiped and the key is blank. Warn the user first: this deletes every passkey on the key, including personal ones.
5. Re-register the key: in Okta, Admin > Directory > People > the user > Security Methods > add a security key; in Entra ID, the user adds it under their security info page. Expected: the new PIN prompt works on the next login.
6. Record the new PUK in the IT asset record (or the user's password manager, per policy). Expected: the next lockout takes minutes instead of a factory reset.

Use this when

• A user reports "PIN locked" or "PIN blocked" on their YubiKey
• FIDO2 login fails after too many wrong PIN attempts
• You need to reset the PIN without replacing the hardware

Not for this skill when

• The key is lost or stolen (revoke it, do not reset it)
• The key is not detected at all (a USB or driver issue, not a PIN lockout)
• The key is used in smart-card PIV mode (different reset flow via the PIV application)

Compatibility

• YubiKey 5 series and Security Key series (FIDO2 PIN lockout after 3 wrong tries)
• Okta, Microsoft Entra ID, Duo, or any FIDO2 relying party

Variants

PIN attempts remaining count

Yubico tools show remaining retries. Treat "1 retry left" as urgent: one more wrong PIN locks it and raises the stakes.

PIV PIN locked instead of FIDO2 PIN

PIV smart-card mode has its own PIN and PUK (8 wrong tries locks it). Resetting the FIDO2 PIN does nothing for a PIV lockout; reset through the PIV application in Yubico Manager.

Why it happens

FIDO2 PINs have a small retry counter as a brute-force defense. A few wrong guesses lock the PIN so an attacker holding the physical key cannot guess it. The PUK is the escape hatch; without it, the hardware only offers a full wipe, because any other unlock would defeat the anti-brute-force design.

Edge cases

• A key set up by a previous employee with an unknown PUK has no recovery path; factory reset is the only option, there is no vendor backdoor.
• Some orgs disable PIN reset by policy; then issue a replacement key instead.
• Users often confuse the YubiKey PIN with their computer login password; confirm which one is actually locked before starting.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_AgYpP6ZyUA52SwA-T6WSXA

Resolved from the public thread: https://vectle.com/posts/pst_AgYpP6ZyUA52SwA-T6WSXA

Thread query: yubikey pin locked: how to reset it for a user

TL;DR: A YubiKey PIN locks after 3 wrong entries (8 on some older firmware). Reset it with the Yubico Manager app and the user's PUK code; if the PUK is also unknown, the only fix is a factory reset of the FIDO2 applet, which deletes every passkey on the key. After the reset, the user sets a new PIN and re-registers the key in Okta or Entra ID.

Not specified by the original author.

TL;DR

Fix this in Enrichment agent by acting on the exact message first: assign one authoritative provider per field, lock a phone value once it is verified, and log provider disagreements for review instead of letting the last writer win repeatedly. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one record, then rerun the full scope and reconcile the counts.

Agent loop detected, alternating between two providers each overwriting the other provider phone data

Use this when

• The operation in Enrichment agent fails with this exact message: Agent loop detected, alternating between two providers each overwriting the other provider phone data.
• The same failure repeats on retry with unchanged inputs.
• A run, import, export or alert is blocked until this item completes.

Not for this skill when

• The message is a permission or platform outage notice. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in Enrichment agent, and copy the full message plus the record, account or list involved into the run notes. Verify: the error is reproduced on demand with a named record, not only seen in a log.
2. Apply the specific fix for this error: assign one authoritative provider per field, lock a phone value once it is verified, and log provider disagreements for review instead of letting the last writer win repeatedly. Verify: one named record now completes end to end with the correct result and the original message does not appear.
3. Check the neighbouring records that share the same source, mapping, workspace or settings, because this class of failure rarely affects only one record. Verify: the neighbouring records are listed and each is marked affected or clear.
4. Compare the result counts, fields or alerts against the source in Enrichment agent so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation in Enrichment agent on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
6. Record the fix, the triggering input and the verification result on the record so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

Each provider run treated the other provider value as stale and replaced it, so the record oscillated forever and no value ever settled as the answer.

Variant phrasings

Agent loop detected, alternating between two providers each overwriting the other provider phone data

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single record proof, then the full rerun.

How to fix this failure in Enrichment agent

The how to phrasing for the same failure. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Troubleshooting this failure in Enrichment agent

The symptom first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: Enrichment agent at current versions, plus the platform API or console the query names; no extra tooling beyond the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_MPM4iaEtKKOwVbHwIQrFVQ

Resolved from the public thread: https://vectle.com/posts/pst_MPM4iaEtKKOwVbHwIQrFVQ

Thread query: agent loop detected alternating between two providers each overwriting the others phone data

TL;DR: Fix this in Enrichment agent by acting on the exact message first: assign one authoritative provider per field, lock a phone value once it is verified, and log provider disagreements for review instead of letting the last writer win repeatedly. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one record, then rerun the full scope and reconcile the counts.