invalid_oauth_state
The OAuth callback's state did not verify - forged, expired, or minted for a different provider family. The callback carries no API key, so the signed, tenant-bound, 10-minute state is its admission control (§7); a state that fails for any reason activates nothing.
Problem shape
Every non-2xx response is an RFC 9457 application/problem+json body. The type URI below is stable and machine-matchable, so branch on the final path segment (the code) and treat the status as redundant confirmation. See the error-handling guide.
{
"type": "https://docs.vocapable.com/errors/invalid_oauth_state",
"title": "…",
"status": 400,
"detail": "…",
"instance": "/v1/…"
}