HRESULT 0x803D0022 (WS_E_SECURITY_TOKEN

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

the endpoint rejected a Windows Web Services security token because it expired.

Previous	Next
WS_E_OTHER	WS_E_SECURITY_SYSTEM_FAILURE

WS_E_SECURITY_TOKEN_EXPIRED

WS_E_SECURITY_TOKEN_EXPIRED is a Windows Web Services API HRESULT. It means that the server rejected the supplied security token because its lifetime ended. Depending on the service policy, the token may need to be renewed or acquired again.

What to check for WS_E_SECURITY_TOKEN_EXPIRED

Check client and server clocks, token issue and expiry times, audience and renewal policy.
Refresh the token through the supported identity flow before retrying the request.
Avoid repeatedly retrying with the same expired token.

Microsoft documentation

Diagnostic interpretation of WS_E_SECURITY_TOKEN_EXPIRED

WS_E_SECURITY_TOKEN_EXPIRED has the HRESULT value 0x803D0022. AllStat records the condition as “A security token was rejected by the server because it has expired.”. For WS_E_SECURITY_TOKEN_EXPIRED, in practice, interpret that wording at the boundary owned by the Windows component or COM interface that returned the HRESULT, rather than treating the value as a generic Windows message.

Evidence to capture for WS_E_SECURITY_TOKEN_EXPIRED

Record the exact COM method or Windows API, its input object, the calling thread, and the full 0x803D0022 value before a wrapper converts it to an exception or Boolean result.
Capture any IErrorInfo text, activity identifier, event-log entry, and subsystem trace that mentions WS_E_SECURITY_TOKEN_EXPIRED or the ws / security / token / expired operation.
For WS_E_SECURITY_TOKEN_EXPIRED, compare the failing machine with a working one at the same configuration boundary: component version, policy, registration, identity, and target resource.

Retry and recovery for WS_E_SECURITY_TOKEN_EXPIRED

Retry WS_E_SECURITY_TOKEN_EXPIRED only when the owning API documents a transient state or after the condition described as “A security token was rejected by the server because it has expired.” has changed. For WS_E_SECURITY_TOKEN_EXPIRED, configuration, policy, format, and authorization failures normally require correction first; an immediate loop can hide the original call site and add secondary errors.

Looking for a different code? Search another status or error code.