# TraconTenantProviderRefusedException > Tracon documentation. Tracon is a .NET package family that adds a control > plane on Microsoft Agent Framework, published as NuGet packages that run > inside your own ASP.NET Core application. > > Page: https://tracon.dev/api/tracon.tracontenantproviderrefusedexception/ > Summary: TraconTenantProviderRefusedException: Thrown when a tenant's provider rules refuse a call before it leaves the process.
Namespace Tracon · Assembly Tracon.Abstractions.dll
Thrown when a tenant's provider rules refuse a call before it leaves the process. ```csharp public sealed class TraconTenantProviderRefusedException : TraconException, ISerializable ```
Inheritance
object ← Exception ← TraconException ← TraconTenantProviderRefusedException
Implements
ISerializable
Inherited Members
TraconException.ErrorType, Exception.GetBaseException(), Exception.ToString(), Exception.GetType(), Exception.TargetSite, Exception.Message, Exception.Data, Exception.InnerException, Exception.HelpLink, Exception.Source, Exception.HResult, Exception.StackTrace, object.GetType(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()
## Remarks Three rules refuse: the tenant's egress policy does not allow the provider; the tenant has its own credential for a provider path that cannot use one; or the tenant's binding names a configuration key that has no value or that the tenant may not read. No provider is called, and the setup-time credential is never used in the tenant's place. Every path that checks a tenant throws this one type: the agent's model, its fallbacks, the summarizer and the loop judge (while the agent is compiled), image generation, speech, the knowledge base's embeddings and a live voice session. The error type is `tenant_provider_refused` and the class is [RunErrorClass.TenantProviderRefused](/api/tracon.runerrorclass/), so a workflow node retry and the job queue never repeat it. An image, speech or knowledge endpoint answers `403`; an agent run that the refusal stops before it starts answers `400`. The message names the tenant and the provider, never a key value. ## Constructors ### TraconTenantProviderRefusedException\(\) Creates a new error. ```csharp public TraconTenantProviderRefusedException() ``` ### TraconTenantProviderRefusedException\(string\) Creates a new error. ```csharp public TraconTenantProviderRefusedException(string message) ``` #### Parameters `message` [string](https://learn.microsoft.com/dotnet/api/system.string) Why the call was refused. Must not carry a key value. ### TraconTenantProviderRefusedException\(string, Exception\) Creates a new error. ```csharp public TraconTenantProviderRefusedException(string message, Exception innerException) ``` #### Parameters `message` [string](https://learn.microsoft.com/dotnet/api/system.string) Why the call was refused, with the context the caller adds. `innerException` [Exception](https://learn.microsoft.com/dotnet/api/system.exception) The refusal or the configuration error the caller met. ## Fields ### TenantProviderRefusedErrorType The stable value written to [TraconException.ErrorType](/api/tracon.traconexception/#Tracon_TraconException_ErrorType). ```csharp public const string TenantProviderRefusedErrorType = "tenant_provider_refused" ``` #### Field Value [string](https://learn.microsoft.com/dotnet/api/system.string) ## Properties ### ErrorType Gets the stable error type name written to the run record. ```csharp public override string ErrorType { get; } ``` #### Property Value [string](https://learn.microsoft.com/dotnet/api/system.string) #### Remarks Defaults to the full name of the exception type, so today's behaviour does not change. A derived type overrides this member when the record has to be machine readable — for example [TraconContentFilteredException](/api/tracon.traconcontentfilteredexception/) writes `content_filtered`. Reports and alert rules can rely on this stable name instead of an assembly name. The value is written to `RunError.Type` and **carries no secret**.