RESOURCE_ALREADY_EXISTS

A Resource with this name exists.

Checked 2026-09-28

A Resource with this name exists.

HTTP 409 · gRPC ALREADY_EXISTS · the error body

#Returned by

Method	Scope	What it does
`access.orgs.create`	`access:admin`	Creates an org. Access assigns the id.
`access.projects.create`	`access:admin`	Creates a project. Access assigns the id.
`access.envs.create`	`access:admin`	Creates an environment. Access assigns the id.
`access.api_keys.create`	`access:keys:write`	Creates an API key. Access assigns the id.
`agents.agents.create`	`agents:write`	Creates an agent and its version 1.
`agents.agents.run`	`agents:sessions`	Atomically admits a pinned task session, initial event and pending turn.
`agents.agent_sessions.create`	`agents:sessions`	Starts a session of an agent, pinned to its current version unless `agent_version` names another. Requires a secret key until end-user ownership is implemented. The session starts idle; `:send` starts its first turn.
`agents.memory_stores.create`	`agents:write`	Creates a memory store.
`agents.memories.create`	`agents:write`	Writes a memory.
`agents.owner_pools.create`	`agents:admin`	Creates an owner pool with no members. Its minimums and demotion rules are governance, so the caller needs `agents:admin`.
`artifacts.artifacts.create`	`artifacts:write`	Registers an artifact whose bytes were pushed by digest; verification runs after.
`auth.end_users.create`	`auth:write`	Creates an end user.
`auth.end_users.attach_external_id`	`auth:write`	Sets the customer's own id for an end user, once: an unset namespace is written, a set one is never rewritten, and a different value for a set namespace is refused. A namespace holds one id for the life of the user. Erasure removes the ids and remembers their hashes, so a value that belonged to an erased user is never handed to another one.
`auth.identities.move`	`auth:write`	Moves a federated or device identity from one end user to another, to fix a wrongly linked player. One transaction: the identity changes owner, the sessions of both end users are revoked, and nothing else about either moves (profile, memberships, data). Refused when it would leave the source with no sign-in, unless the source is suspended, and when the target already has an identity of the same provider. The reason is audited with the operator, both end users and the identity's fingerprint. An operator action: an end user's own session cannot call it.
`auth.customer_organizations.create`	`auth:write`	Creates a customer organization.
`auth.memberships.create`	`auth:write`	Creates a membership.
`auth.organization_roles.create`	`auth:write`	Creates an organization role.
`auth.invitations.create`	`auth:write`	Creates an invitation.
`auth.invitations.accept`	`auth:write`	Accepts a pending invitation for an end user whose verified email is the invited address, and creates the membership.
`auth.email_domains.create`	`auth:write`	Creates an email domain; the answer names the TXT record to publish.
`auth.oauth_clients.create`	`auth:write`	Creates an OAuth client.
`broker.trust_policies.create`	`broker:admin`	Creates a trust policy.
`build.builds.create`	`build:run`	Creates a build: one command or one image over a commit or a tree. The Operation is done when the build reaches a final state. `run` and `image` are the short forms.
`build.builds.run`	`build:run`	Runs one command over an uploaded tree and settles with its exit code, like the local command. A caller that gets a failure before the command started (BUILD_FAILURE_SETUP_FAILED, NO_CAPACITY) may build locally.
`build.builds.build_image`	`build:run`	Builds an image, with an SBOM and signed provenance, from a commit or an uploaded tree.
`config.config_flags.create`	`config:write`	Creates a config flag; the Operation is done when every cell serves it.
`config.config_segments.create`	`config:write`	Creates a config segment.
`connections.connection_providers.begin_registration`	`connections:admin`	Begins an expiring, one-use GitHub manifest registration ceremony. Open registration_url to POST the bound, prefilled manifest to GitHub. github_organization selects organization ownership. The state-authorized callback is GET /v1/connections/github-manifest:callback?state=...&code=... and returns only provider metadata and an installation URL.
`connections.connections.create`	`connections:write`	Records an installation; the controller confirms it with the provider.
`data.databases.create`	`data:write`	Creates a database. The Operation is done when the controller settles it.
`data.kv_namespaces.create`	`data:write`	Creates a kv namespace. The Operation is done when the controller settles it.
`data.buckets.create`	`data:write`	Creates a bucket. The Operation is done when the controller settles it.
`data.search_indexes.create`	`data:write`	Creates a search index. The Operation is done when the controller settles it.
`events.topics.create`	`events:write`	Creates a topic.
`events.topics.publish`	`events:publish`	Publishes CloudEvents into a Topic, atomically. Replaying the same `source` + `id` with the same payload returns the stored event; a different payload fails with RESOURCE_ALREADY_EXISTS.
`events.subscriptions.create`	`events:write`	Creates a subscription.
`events.queues.create`	`events:write`	Creates a queue.
`events.webhook_endpoints.create`	`events:write`	Creates a webhook endpoint.
`events.inbound_endpoints.create`	`events:write`	Creates an inbound endpoint.
`events.realtime_channels.create`	`events:write`	Creates a realtime channel.
`hosting.services.create`	`hosting:write`	Creates a service. The Operation is done when the controller settles it.
`hosting.service_rollouts.create`	`hosting:write`	Creates a rollout.
`hosting.previews.create`	`hosting:write`	Creates a preview. The Operation is done when the controller settles it.
`hosting.source_links.create`	`hosting:write`	Creates a source link. The Operation is done when the controller settles it.
`keys.keys.create`	`keys:write`	Creates a key; the signer generates its first version.
`knowledge.spaces.create`	`knowledge:write`	Creates a space.
`knowledge.knowledge_schemas.create`	`knowledge:write`	Creates a knowledge schema.
`knowledge.episodes.create`	`knowledge:write`	Records an episode and returns at once (`remember`); extraction reads it afterwards.
`knowledge.entities.create`	`knowledge:write`	Creates an entity in a space. An entity whose external id already names one in the graph is refused with `RESOURCE_ALREADY_EXISTS`, which names it; use Update with `allow_missing` to upsert.
`knowledge.relations.create`	`knowledge:write`	Records a fact in a space (`relate`). A fact that contradicts a current one with the same subject and a single-valued predicate closes the older fact; nothing is overwritten.
`localization.catalogs.create`	`localization:write`	Creates a catalog.
`localization.glossaries.create`	`localization:write`	Creates a glossary.
`money.store_connections.create`	`billing:write`	Creates a store connection; its credential is sealed and never returned.
`money.entitlement_grants.create`	`billing:credits.approve`	Creates a manual entitlement grant (support, comp, grace). Append-only; needs the approval-class scope. The approver recorded is the key's principal.
`money.licence_keys.generate`	`billing:licence_keys.approve`	Generates a licence key: Money creates the Ed25519 key, seals it, and never returns the private half. Needs the approval-class scope, which the developer role does not hold.
`money.licence_keys.import`	`billing:licence_keys.approve`	Imports an existing Ed25519 key (PKCS8), for a key already pinned in shipped clients. Refused unless the expected public key is the imported key's public half.
`money.revenue_sources.create`	`revenue:write`	Registers a revenue source. The `money` source is implicit and never created here.
`network.domains.create`	`network:write`	Creates a domain. The Operation is done when the controller settles it.
`network.routes.create`	`network:write`	Creates a route. The Operation is done when the controller settles it.
`network.egress_identities.create`	`network:write`	Creates an egress identity. The Operation is done when the controller settles it.
`network.private_links.create`	`network:write`	Creates a private link. The Operation is done when the controller settles it.
`notify.mail_domains.create`	`notify:write`	Creates an email domain.
`notify.mail_routes.create`	`notify:write`	Creates a route.
`notify.senders.create`	`notify:write`	Creates a sender.
`notify.recipients.create`	`notify:write`	Creates a recipient.
`notify.suppressions.create`	`notify:write`	Creates a suppression.
`notify.templates.create`	`notify:write`	Creates a template.
`notify.messages.create`	`notify:send`	Sends a Message.
`notify.mailboxes.create`	`notify:write`	Creates a mailbox.
`notify.mailbox_oauth_apps.create`	`notify:write`	Creates a mailbox OAuth app.
`notify.mailbox_connect_links.create`	`notify:write`	Mints a mailbox connect link for one end user; the response carries its `url`, which no later call returns.
`notify.broadcasts.create`	`notify:write`	Creates a broadcast.
`release.releases.create`	`release:write`	Creates a release: admits it and rolls it out in waves. The Operation is done when the release is live or halted.
`runners.scale_sets.create`	`runners:write`	Creates a scale set. The Operation is done when the controller settles it.
`sandboxes.pools.create`	`sandboxes:write`	Creates a pool. The Operation is done when the controller settles it.
`sandboxes.leases.create`	`sandboxes:write`	Creates a lease: granted now and returned READY (or GRANTED when `wait_ready` is false), or refused with a typed error. There is no queue.
`sandboxes.volumes.create`	`sandboxes:write`	Creates a volume.
`sandboxes.snapshots.create`	`sandboxes:write`	Captures a running lease's disk as a snapshot.
`secrets.secrets.create`	`secrets:write`	Creates a secret, without a value; add one with CreateSecretVersion.
`secrets.secret_versions.create`	`secrets:write`	Adds a value to a secret as its newest version. The value is never returned.
`secrets.secret_bindings.create`	`secrets:write`	Creates a secret binding.
`secrets.profiles.create`	`secrets:write`	Creates an empty profile; its first version is written by a write-back mount (`:open` with WRITE_BACK, then `:commit`).
`workflows.workflows.create`	`workflows:write`	Creates a workflow.
`workflows.schedules.create`	`workflows:write`	Creates a schedule.
`workflows.runs.create`	`workflows:run`	Starts a Run of a Workflow, now or after `start_delay` or at `schedule_time`. `run_id` is the caller's key: the same key and intent return the same Run, a changed intent is refused. An end user's session may call it on a Workflow whose `callers` is `USERS` when the session holds the Workflow's `permission`.
`workflows.jobs.create`	`workflows:write`	Creates a job.
`workflows.job_runs.create`	`workflows:run`	Starts a run of a Job now. The same `Idempotency-Key` returns the same run for 24h; a Schedule fire uses `{job}:{intended time}`. With concurrency `forbid`, a start while a run is active fails with INVALID_STATE.
`workflows.distributed_jobs.create`	`workflows:write`	Creates a distributed job.
`workflows.distributed_runs.create`	`workflows:run`	Starts a run of a distributed job. The same `Idempotency-Key` returns the same run for 24h.

Was this page helpful?

Tell us what is missing, wrong, or unclear — this opens a real inbox.

Send feedback

Platform links