---
title: "MPP challenge already expired, or with an unreadable expires — x402 defect class mpp-challenge-expired-at-issue"
description: "MPP challenge already expired, or with an unreadable expires (mpp-challenge-expired-at-issue), an x402 defect class: Where the challenge carries expires, it is RFC 3339 and later than the moment the challenge was served. Detectable by an unpaid probe. A challenge expired at issue cannot be paid: the server refuses the credential as payment-expired and the buyer's ledger records a failed purchase at a door that never offered a live one."
canonical: "https://scvd.store/defects/mpp-challenge-expired-at-issue"
url: "https://scvd.store/defects/mpp-challenge-expired-at-issue"
term_code: "mpp-challenge-expired-at-issue"
defined_in: "https://scvd.store/defects"
data: "https://scvd.store/defects.json"
vocabulary_version: "22"
license: "https://creativecommons.org/licenses/by/4.0/"
---

# MPP challenge already expired, or with an unreadable expires

`mpp-challenge-expired-at-issue` — an x402 defect class.

**Asserts:** Where the challenge carries expires, it is RFC 3339 and later than the moment the challenge was served.

**Costs:** A challenge expired at issue cannot be paid: the server refuses the credential as payment-expired and the buyer's ledger records a failed purchase at a door that never offered a live one.

**Detectable:** unpaid — a free probe can see it

**Falsified by:** The same door serving a challenge whose expires parses and lies in the future at the stated moment.

**How an operator clears it:** Set expires from the server's clock at issue time plus a window a client can act in, in RFC 3339 with a timezone, or omit it; a fixed or stale timestamp is the usual cause.

**What a buyer does:** Do not pay a challenge that is already expired: the credential will be refused and the attempt may still be logged against you. Re-request the door for a fresh challenge, and if it is expired again, tell the operator.

**Our signal:** `mpp-expires-rfc3339`

---

Vocabulary v22, CC BY 4.0. Every class: https://scvd.store/defects. Machine-readable, with falsifiers and cross-instrument mappings: https://scvd.store/defects.json.

A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.