MF-1723 - Fix lack of logging for invalid query params (#1724)

* fix error package errors

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix bootstap and bootstrap api

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix certs

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix consumers

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix http

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix provision

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix readers

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix twins

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix things

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix users

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix sdk excpet channel policies users things

Signed-off-by: aryan <aryangodara03@gmail.com>

* tests passing, but logging not working for things and users

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix sdk tests, and other failing tests

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix comment

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix errors acc to pr review

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix errror wrapping in consumers api

Signed-off-by: aryan <aryangodara03@gmail.com>

* all tests running

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix encodeError

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix minor issues

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix failing sdk policy tests

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix errors in things test sdk

Signed-off-by: aryan <aryangodara03@gmail.com>

* update things service

Signed-off-by: aryan <aryangodara03@gmail.com>

* update usrs service

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix things and users sdk

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix sdk for channels groups policies things users

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix remaining services and sdk

Signed-off-by: aryan <aryangodara03@gmail.com>

* fix bootstrap twins

Signed-off-by: aryan <aryangodara03@gmail.com>

* resolve conflicts

Signed-off-by: aryan <aryangodara03@gmail.com>

* Shift errmalformedentity to pkg/errors

Signed-off-by: aryan <aryangodara03@gmail.com>

* Fix bootstrap service

Signed-off-by: aryan <aryangodara03@gmail.com>

* Add errors.Unwrap and use in encodeError

Signed-off-by: aryan <aryangodara03@gmail.com>

* Fix type in print statement for policies_test

Signed-off-by: aryan <aryangodara03@gmail.com>

* Fix ordering of errvalidation wrapping and encodeError

Signed-off-by: aryan <aryangodara03@gmail.com>

* Fix failing tests

Signed-off-by: aryan <aryangodara03@gmail.com>

---------

Signed-off-by: aryan <aryangodara03@gmail.com>

bootstrap/api/endpoint.go

@@ -8,13 +8,15 @@ import (
 
 	"github.com/go-kit/kit/endpoint"
 	"github.com/mainflux/mainflux/bootstrap"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 )
 
 func addEndpoint(svc bootstrap.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(addReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		channels := []bootstrap.Channel{}
@@ -52,7 +54,7 @@ func updateCertEndpoint(svc bootstrap.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateCertReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		cfg, err := svc.UpdateCert(ctx, req.token, req.thingID, req.ClientCert, req.ClientKey, req.CACert)
@@ -76,7 +78,7 @@ func viewEndpoint(svc bootstrap.Service) endpoint.Endpoint {
 		req := request.(entityReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		config, err := svc.View(ctx, req.token, req.id)
@@ -113,7 +115,7 @@ func updateEndpoint(svc bootstrap.Service) endpoint.Endpoint {
 		req := request.(updateReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		config := bootstrap.Config{
@@ -140,7 +142,7 @@ func updateConnEndpoint(svc bootstrap.Service) endpoint.Endpoint {
 		req := request.(updateConnReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		if err := svc.UpdateConnections(ctx, req.token, req.id, req.Channels); err != nil {
@@ -161,7 +163,7 @@ func listEndpoint(svc bootstrap.Service) endpoint.Endpoint {
 		req := request.(listReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		page, err := svc.List(ctx, req.token, req.filter, req.offset, req.limit)
@@ -207,7 +209,7 @@ func removeEndpoint(svc bootstrap.Service) endpoint.Endpoint {
 		req := request.(entityReq)
 
 		if err := req.validate(); err != nil {
-			return removeRes{}, err
+			return removeRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		if err := svc.Remove(ctx, req.token, req.id); err != nil {
@@ -222,7 +224,7 @@ func bootstrapEndpoint(svc bootstrap.Service, reader bootstrap.ConfigReader, sec
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(bootstrapReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		cfg, err := svc.Bootstrap(ctx, req.key, req.id, secure)
@@ -239,7 +241,7 @@ func stateEndpoint(svc bootstrap.Service) endpoint.Endpoint {
 		req := request.(changeStateReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		if err := svc.ChangeState(ctx, req.token, req.id, req.State); err != nil {

bootstrap/api/endpoint_test.go

@@ -88,11 +88,11 @@ var (
 		CACert:     "newca",
 	}
 
-	bsErrorRes    = toJSON(apiutil.ErrorRes{Err: bootstrap.ErrBootstrap.Error()})
+	missingIDRes  = toJSON(apiutil.ErrorRes{Err: errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingID).Error()})
+	missingKeyRes = toJSON(apiutil.ErrorRes{Err: errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerKey).Error()})
+	bsErrorRes    = toJSON(apiutil.ErrorRes{Err: errors.Wrap(bootstrap.ErrBootstrap, errors.ErrNotFound).Error()})
 	extKeyRes     = toJSON(apiutil.ErrorRes{Err: bootstrap.ErrExternalKey.Error()})
-	extSecKeyRes  = toJSON(apiutil.ErrorRes{Err: bootstrap.ErrExternalKeySecure.Error()})
-	missingIDRes  = toJSON(apiutil.ErrorRes{Err: apiutil.ErrMissingID.Error()})
-	missingKeyRes = toJSON(apiutil.ErrorRes{Err: apiutil.ErrBearerKey.Error()})
+	extSecKeyRes  = toJSON(apiutil.ErrorRes{Err: errors.Wrap(bootstrap.ErrExternalKeySecure, errors.New("encoding/hex: invalid byte: U+0078 'x'")).Error()})
 )
 
 type testRequest struct {

bootstrap/api/transport.go

@@ -6,6 +6,7 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/url"
 	"strings"
@@ -109,12 +110,12 @@ func MakeHandler(svc bootstrap.Service, reader bootstrap.ConfigReader, logger mf
 
 func decodeAddRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), contentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := addReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -122,7 +123,7 @@ func decodeAddRequest(_ context.Context, r *http.Request) (interface{}, error) {
 
 func decodeUpdateRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), contentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := updateReq{
@@ -130,7 +131,7 @@ func decodeUpdateRequest(_ context.Context, r *http.Request) (interface{}, error
 		id:    bone.GetValue(r, "configID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -138,7 +139,7 @@ func decodeUpdateRequest(_ context.Context, r *http.Request) (interface{}, error
 
 func decodeUpdateCertRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), contentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := updateCertReq{
@@ -146,7 +147,7 @@ func decodeUpdateCertRequest(_ context.Context, r *http.Request) (interface{}, e
 		thingID: bone.GetValue(r, "certID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -154,7 +155,7 @@ func decodeUpdateCertRequest(_ context.Context, r *http.Request) (interface{}, e
 
 func decodeUpdateConnRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), contentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := updateConnReq{
@@ -162,7 +163,7 @@ func decodeUpdateConnRequest(_ context.Context, r *http.Request) (interface{}, e
 		id:    bone.GetValue(r, "connID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -171,17 +172,17 @@ func decodeUpdateConnRequest(_ context.Context, r *http.Request) (interface{}, e
 func decodeListRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	o, err := apiutil.ReadUintQuery(r, offsetKey, defOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	l, err := apiutil.ReadUintQuery(r, limitKey, defLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	q, err := url.ParseQuery(r.URL.RawQuery)
 	if err != nil {
-		return nil, errors.ErrInvalidQueryParams
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrInvalidQueryParams)
 	}
 
 	req := listReq{
@@ -205,7 +206,7 @@ func decodeBootstrapRequest(_ context.Context, r *http.Request) (interface{}, er
 
 func decodeStateRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), contentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := changeStateReq{
@@ -213,7 +214,7 @@ func decodeStateRequest(_ context.Context, r *http.Request) (interface{}, error)
 		id:    bone.GetValue(r, "thingID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -257,20 +258,26 @@ func encodeSecureRes(_ context.Context, w http.ResponseWriter, response interfac
 }
 
 func encodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	switch {
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerToken,
-		err == apiutil.ErrBearerKey:
+		errors.Contains(err, apiutil.ErrBearerToken),
+		errors.Contains(err, apiutil.ErrBearerKey):
 		w.WriteHeader(http.StatusUnauthorized)
-	case errors.Contains(err, errors.ErrUnsupportedContentType):
+	case errors.Contains(err, apiutil.ErrUnsupportedContentType):
 		w.WriteHeader(http.StatusUnsupportedMediaType)
-	case errors.Contains(err, errors.ErrInvalidQueryParams),
+	case errors.Contains(err, apiutil.ErrInvalidQueryParams),
 		errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrMissingID,
-		err == apiutil.ErrBootstrapState,
-		err == apiutil.ErrLimitSize:
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrBootstrapState),
+		errors.Contains(err, apiutil.ErrLimitSize):
 		w.WriteHeader(http.StatusBadRequest)
-	case errors.Contains(err, errors.ErrNotFound):
+	case errors.Contains(err, errors.ErrNotFound),
+		errors.Contains(err, bootstrap.ErrThings):
 		w.WriteHeader(http.StatusNotFound)
 	case errors.Contains(err, bootstrap.ErrExternalKey),
 		errors.Contains(err, bootstrap.ErrExternalKeySecure),
@@ -291,9 +298,19 @@ func encodeError(_ context.Context, err error, w http.ResponseWriter) {
 		w.WriteHeader(http.StatusInternalServerError)
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
 		w.Header().Set("Content-Type", contentType)
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

bootstrap/service.go

@@ -377,23 +377,24 @@ func (bs bootstrapService) identify(ctx context.Context, token string) (string,
 func (bs bootstrapService) thing(id, token string) (mfsdk.Thing, error) {
 	var thing mfsdk.Thing
 	var err error
+	var sdkErr errors.SDKError
 
 	thing.ID = id
 	if id == "" {
-		thing, err = bs.sdk.CreateThing(mfsdk.Thing{}, token)
+		thing, sdkErr = bs.sdk.CreateThing(mfsdk.Thing{}, token)
 		if err != nil {
-			return mfsdk.Thing{}, errors.Wrap(errCreateThing, err)
+			return mfsdk.Thing{}, errors.Wrap(errCreateThing, errors.New(sdkErr.Err().Msg()))
 		}
 	}
 
-	thing, err = bs.sdk.Thing(thing.ID, token)
-	if err != nil {
+	thing, sdkErr = bs.sdk.Thing(thing.ID, token)
+	if sdkErr != nil {
+		err = errors.New(sdkErr.Error())
 		if id != "" {
-			if _, errT := bs.sdk.DisableThing(thing.ID, token); errT != nil {
-				err = errors.Wrap(err, errT)
+			if _, sdkErr2 := bs.sdk.DisableThing(thing.ID, token); sdkErr2 != nil {
+				err = errors.Wrap(errors.New(sdkErr.Msg()), errors.New(sdkErr2.Msg()))
 			}
 		}
-
 		return mfsdk.Thing{}, errors.Wrap(ErrThings, err)
 	}
 

bootstrap/service_test.go

@@ -164,13 +164,17 @@ func TestAdd(t *testing.T) {
 
 	for _, tc := range cases {
 		_, err := svc.Add(context.Background(), tc.token, tc.config)
-		assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+		switch err {
+		case nil:
+			assert.Nil(t, err, fmt.Sprintf("%s: got unexpected error : %s", tc.desc, err))
+		default:
+			assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+		}
 	}
 }
 
 func TestView(t *testing.T) {
 	users := mocks.NewAuthClient(map[string]string{validToken: email})
-
 	server := newThingsServer(newThingsService(users))
 	svc := newService(users, server.URL)
 

certs/api/endpoint.go

@@ -8,17 +8,19 @@ import (
 
 	"github.com/go-kit/kit/endpoint"
 	"github.com/mainflux/mainflux/certs"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 )
 
 func issueCert(svc certs.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(addCertsReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		res, err := svc.IssueCert(ctx, req.token, req.ThingID, req.TTL)
 		if err != nil {
-			return certsRes{}, err
+			return certsRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		return certsRes{
@@ -36,12 +38,12 @@ func listSerials(svc certs.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		page, err := svc.ListSerials(ctx, req.token, req.thingID, req.offset, req.limit)
 		if err != nil {
-			return certsPageRes{}, err
+			return certsPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		res := certsPageRes{
 			pageRes: pageRes{
@@ -66,12 +68,12 @@ func viewCert(svc certs.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(viewReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		cert, err := svc.ViewCert(ctx, req.token, req.serialID)
 		if err != nil {
-			return certsPageRes{}, err
+			return certsPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		certRes := certsRes{
@@ -89,7 +91,7 @@ func revokeCert(svc certs.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(revokeReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		res, err := svc.RevokeCert(ctx, req.token, req.certID)
 		if err != nil {

certs/api/transport.go

@@ -6,6 +6,7 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 
 	kithttp "github.com/go-kit/kit/transport/http"
@@ -90,11 +91,11 @@ func encodeResponse(_ context.Context, w http.ResponseWriter, response interface
 func decodeListCerts(_ context.Context, r *http.Request) (interface{}, error) {
 	l, err := apiutil.ReadUintQuery(r, limitKey, defLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	o, err := apiutil.ReadUintQuery(r, offsetKey, defOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	req := listReq{
@@ -117,12 +118,12 @@ func decodeViewCert(_ context.Context, r *http.Request) (interface{}, error) {
 
 func decodeCerts(_ context.Context, r *http.Request) (interface{}, error) {
 	if r.Header.Get("Content-Type") != contentType {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := addCertsReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	return req, nil
@@ -138,21 +139,25 @@ func decodeRevokeCerts(_ context.Context, r *http.Request) (interface{}, error)
 }
 
 func encodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	switch {
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerToken:
+		errors.Contains(err, apiutil.ErrBearerToken):
 		w.WriteHeader(http.StatusUnauthorized)
-	case errors.Contains(err, errors.ErrUnsupportedContentType):
+	case errors.Contains(err, apiutil.ErrUnsupportedContentType):
 		w.WriteHeader(http.StatusUnsupportedMediaType)
 	case errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrMissingID,
-		err == apiutil.ErrMissingCertData,
-		err == apiutil.ErrInvalidCertData,
-		err == apiutil.ErrLimitSize:
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrMissingCertData),
+		errors.Contains(err, apiutil.ErrInvalidCertData),
+		errors.Contains(err, apiutil.ErrLimitSize):
 		w.WriteHeader(http.StatusBadRequest)
 	case errors.Contains(err, errors.ErrConflict):
 		w.WriteHeader(http.StatusConflict)
-
 	case errors.Contains(err, errors.ErrCreateEntity),
 		errors.Contains(err, errors.ErrViewEntity),
 		errors.Contains(err, errors.ErrRemoveEntity):
@@ -162,9 +167,19 @@ func encodeError(_ context.Context, err error, w http.ResponseWriter) {
 		w.WriteHeader(http.StatusInternalServerError)
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
 		w.Header().Set("Content-Type", contentType)
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

consumers/messages.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/pelletier/go-toml"
 
+	"github.com/mainflux/mainflux/internal/apiutil"
 	"github.com/mainflux/mainflux/logger"
 	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/pkg/messaging"
@@ -52,7 +53,7 @@ func Start(ctx context.Context, id string, sub messaging.Subscriber, consumer in
 				return err
 			}
 		default:
-			return errors.ErrInvalidQueryParams
+			return apiutil.ErrInvalidQueryParams
 		}
 
 	}

consumers/notifiers/api/endpoint.go

@@ -8,13 +8,15 @@ import (
 
 	"github.com/go-kit/kit/endpoint"
 	notifiers "github.com/mainflux/mainflux/consumers/notifiers"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 )
 
 func createSubscriptionEndpoint(svc notifiers.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(createSubReq)
 		if err := req.validate(); err != nil {
-			return createSubRes{}, err
+			return createSubRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		sub := notifiers.Subscription{
 			Contact: req.Contact,
@@ -36,7 +38,7 @@ func viewSubscriptionEndpint(svc notifiers.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(subReq)
 		if err := req.validate(); err != nil {
-			return viewSubRes{}, err
+			return viewSubRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		sub, err := svc.ViewSubscription(ctx, req.token, req.id)
 		if err != nil {
@@ -56,7 +58,7 @@ func listSubscriptionsEndpoint(svc notifiers.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listSubsReq)
 		if err := req.validate(); err != nil {
-			return listSubsRes{}, err
+			return listSubsRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		pm := notifiers.PageMetadata{
 			Topic:   req.topic,
@@ -82,6 +84,7 @@ func listSubscriptionsEndpoint(svc notifiers.Service) endpoint.Endpoint {
 			}
 			res.Subscriptions = append(res.Subscriptions, r)
 		}
+
 		return res, nil
 	}
 }
@@ -90,7 +93,7 @@ func deleteSubscriptionEndpint(svc notifiers.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(subReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		if err := svc.RemoveSubscription(ctx, req.token, req.id); err != nil {
 			return nil, err

consumers/notifiers/api/endpoint_test.go

@@ -37,8 +37,8 @@ const (
 var (
 	notFoundRes   = toJSON(apiutil.ErrorRes{Err: errors.ErrNotFound.Error()})
 	unauthRes     = toJSON(apiutil.ErrorRes{Err: errors.ErrAuthentication.Error()})
-	invalidRes    = toJSON(apiutil.ErrorRes{Err: errors.ErrInvalidQueryParams.Error()})
-	missingTokRes = toJSON(apiutil.ErrorRes{Err: apiutil.ErrBearerToken.Error()})
+	invalidRes    = toJSON(apiutil.ErrorRes{Err: errors.Wrap(apiutil.ErrValidation, apiutil.ErrInvalidQueryParams).Error()})
+	missingTokRes = toJSON(apiutil.ErrorRes{Err: errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken).Error()})
 )
 
 type testRequest struct {

consumers/notifiers/api/transport.go

@@ -6,6 +6,7 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -74,12 +75,12 @@ func MakeHandler(svc notifiers.Service, logger logger.Logger, instanceID string)
 
 func decodeCreate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), contentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := createSubReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -108,13 +109,13 @@ func decodeList(_ context.Context, r *http.Request) (interface{}, error) {
 
 	offset, err := apiutil.ReadUintQuery(r, offsetKey, defOffset)
 	if err != nil {
-		return listSubsReq{}, err
+		return listSubsReq{}, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req.offset = uint(offset)
 
 	limit, err := apiutil.ReadUintQuery(r, limitKey, defLimit)
 	if err != nil {
-		return listSubsReq{}, err
+		return listSubsReq{}, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req.limit = uint(limit)
 
@@ -138,21 +139,26 @@ func encodeResponse(_ context.Context, w http.ResponseWriter, response interface
 }
 
 func encodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	switch {
 	case errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrInvalidContact,
-		err == apiutil.ErrInvalidTopic,
-		err == apiutil.ErrMissingID,
-		errors.Contains(err, errors.ErrInvalidQueryParams):
+		errors.Contains(err, apiutil.ErrInvalidContact),
+		errors.Contains(err, apiutil.ErrInvalidTopic),
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrInvalidQueryParams):
 		w.WriteHeader(http.StatusBadRequest)
 	case errors.Contains(err, errors.ErrNotFound):
 		w.WriteHeader(http.StatusNotFound)
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerToken:
+		errors.Contains(err, apiutil.ErrBearerToken):
 		w.WriteHeader(http.StatusUnauthorized)
 	case errors.Contains(err, errors.ErrConflict):
 		w.WriteHeader(http.StatusConflict)
-	case errors.Contains(err, errors.ErrUnsupportedContentType):
+	case errors.Contains(err, apiutil.ErrUnsupportedContentType):
 		w.WriteHeader(http.StatusUnsupportedMediaType)
 
 	case errors.Contains(err, errors.ErrCreateEntity),
@@ -164,9 +170,19 @@ func encodeError(_ context.Context, err error, w http.ResponseWriter) {
 		w.WriteHeader(http.StatusInternalServerError)
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
 		w.Header().Set("Content-Type", contentType)
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

http/api/endpoint.go

@@ -8,6 +8,8 @@ import (
 
 	"github.com/go-kit/kit/endpoint"
 	"github.com/mainflux/mainflux/http"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 )
 
 func sendMessageEndpoint(svc http.Service) endpoint.Endpoint {
@@ -15,7 +17,7 @@ func sendMessageEndpoint(svc http.Service) endpoint.Endpoint {
 		req := request.(publishReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		return nil, svc.Publish(ctx, req.token, req.msg)

http/api/transport.go

@@ -6,6 +6,7 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/url"
@@ -31,7 +32,7 @@ const (
 	protocol    = "http"
 	ctSenmlJSON = "application/senml+json"
 	ctSenmlCBOR = "application/senml+cbor"
-	ctJSON      = "application/json"
+	contentType = "application/json"
 )
 
 var (
@@ -74,7 +75,7 @@ func parseSubtopic(subtopic string) (string, error) {
 
 	subtopic, err := url.QueryUnescape(subtopic)
 	if err != nil {
-		return "", errMalformedSubtopic
+		return "", errors.Wrap(apiutil.ErrValidation, errMalformedSubtopic)
 	}
 	subtopic = strings.ReplaceAll(subtopic, "/", ".")
 
@@ -86,7 +87,7 @@ func parseSubtopic(subtopic string) (string, error) {
 		}
 
 		if len(elem) > 1 && (strings.Contains(elem, "*") || strings.Contains(elem, ">")) {
-			return "", errMalformedSubtopic
+			return "", errors.Wrap(apiutil.ErrValidation, errMalformedSubtopic)
 		}
 
 		filteredElems = append(filteredElems, elem)
@@ -98,18 +99,18 @@ func parseSubtopic(subtopic string) (string, error) {
 
 func decodeRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	ct := r.Header.Get("Content-Type")
-	if ct != ctSenmlJSON && ct != ctJSON && ct != ctSenmlCBOR {
-		return nil, errors.ErrUnsupportedContentType
+	if ct != ctSenmlJSON && ct != contentType && ct != ctSenmlCBOR {
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	channelParts := channelPartRegExp.FindStringSubmatch(r.RequestURI)
 	if len(channelParts) < 2 {
-		return nil, errors.ErrMalformedEntity
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.ErrMalformedEntity)
 	}
 
 	subtopic, err := parseSubtopic(channelParts[2])
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	var token string
@@ -123,7 +124,7 @@ func decodeRequest(_ context.Context, r *http.Request) (interface{}, error) {
 
 	payload, err := io.ReadAll(r.Body)
 	if err != nil {
-		return nil, errors.ErrMalformedEntity
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.ErrMalformedEntity)
 	}
 	defer r.Body.Close()
 
@@ -147,14 +148,19 @@ func encodeResponse(_ context.Context, w http.ResponseWriter, _ interface{}) err
 }
 
 func encodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	switch {
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerKey,
-		err == apiutil.ErrBearerToken:
+		errors.Contains(err, apiutil.ErrBearerKey),
+		errors.Contains(err, apiutil.ErrBearerToken):
 		w.WriteHeader(http.StatusUnauthorized)
 	case errors.Contains(err, errors.ErrAuthorization):
 		w.WriteHeader(http.StatusForbidden)
-	case errors.Contains(err, errors.ErrUnsupportedContentType):
+	case errors.Contains(err, apiutil.ErrUnsupportedContentType):
 		w.WriteHeader(http.StatusUnsupportedMediaType)
 	case errors.Contains(err, errMalformedSubtopic),
 		errors.Contains(err, errors.ErrMalformedEntity):
@@ -181,9 +187,19 @@ func encodeError(_ context.Context, err error, w http.ResponseWriter) {
 		}
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
-		w.Header().Set("Content-Type", ctJSON)
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+		w.Header().Set("Content-Type", contentType)
+
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

internal/api/common.go

@@ -6,6 +6,7 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 
 	"github.com/gofrs/uuid"
@@ -89,14 +90,19 @@ func EncodeResponse(_ context.Context, w http.ResponseWriter, response interface
 
 // EncodeError encodes an error response.
 func EncodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	w.Header().Set("Content-Type", ContentType)
 	switch {
-	case errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrMissingID,
-		err == apiutil.ErrEmptyList,
-		err == apiutil.ErrMissingMemberType,
-		errors.Contains(err, apiutil.ErrInvalidSecret),
-		err == apiutil.ErrNameSize:
+	case errors.Contains(err, apiutil.ErrInvalidSecret),
+		errors.Contains(err, errors.ErrMalformedEntity),
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrEmptyList),
+		errors.Contains(err, apiutil.ErrMissingMemberType),
+		errors.Contains(err, apiutil.ErrNameSize):
 		w.WriteHeader(http.StatusBadRequest)
 	case errors.Contains(err, errors.ErrAuthentication):
 		w.WriteHeader(http.StatusUnauthorized)
@@ -108,7 +114,7 @@ func EncodeError(_ context.Context, err error, w http.ResponseWriter) {
 		w.WriteHeader(http.StatusForbidden)
 	case errors.Contains(err, postgres.ErrMemberAlreadyAssigned):
 		w.WriteHeader(http.StatusConflict)
-	case errors.Contains(err, errors.ErrUnsupportedContentType):
+	case errors.Contains(err, apiutil.ErrUnsupportedContentType):
 		w.WriteHeader(http.StatusUnsupportedMediaType)
 	case errors.Contains(err, errors.ErrCreateEntity),
 		errors.Contains(err, errors.ErrUpdateEntity),
@@ -119,8 +125,16 @@ func EncodeError(_ context.Context, err error, w http.ResponseWriter) {
 		w.WriteHeader(http.StatusInternalServerError)
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

internal/apiutil/errors.go

@@ -9,6 +9,9 @@ import "github.com/mainflux/mainflux/pkg/errors"
 // to distinguish and log API request validation errors and avoid that service
 // errors are logged twice.
 var (
+	// ErrValidation indicates that an error was returned by the API.
+	ErrValidation = errors.New("something went wrong with the request")
+
 	// ErrBearerToken indicates missing or invalid bearer user token.
 	ErrBearerToken = errors.New("missing or invalid bearer user token")
 
@@ -132,12 +135,12 @@ var (
 	// ErrNotFoundParam indicates that the parameter was not found in the query.
 	ErrNotFoundParam = errors.New("parameter not found in the query")
 
-	// ErrMalformedEntity indicates a malformed entity specification.
-	ErrMalformedEntity = errors.New("malformed entity specification")
-
 	// ErrInvalidQueryParams indicates invalid query parameters.
 	ErrInvalidQueryParams = errors.New("invalid query parameters")
 
 	// ErrInvalidVisibilityType indicates invalid visibility type.
 	ErrInvalidVisibilityType = errors.New("invalid visibility type")
+
+	// ErrUnsupportedContentType indicates unacceptable or lack of Content-Type.
+	ErrUnsupportedContentType = errors.New("unsupported content type")
 )

internal/apiutil/transport.go

@@ -18,41 +18,9 @@ import (
 // LoggingErrorEncoder is a go-kit error encoder logging decorator.
 func LoggingErrorEncoder(logger logger.Logger, enc kithttp.ErrorEncoder) kithttp.ErrorEncoder {
 	return func(ctx context.Context, err error, w http.ResponseWriter) {
-		switch {
-		case errors.Contains(err, ErrBearerToken),
-			errors.Contains(err, ErrMissingID),
-			errors.Contains(err, ErrBearerKey),
-			errors.Contains(err, ErrInvalidAuthKey),
-			errors.Contains(err, ErrInvalidIDFormat),
-			errors.Contains(err, ErrNameSize),
-			errors.Contains(err, ErrLimitSize),
-			errors.Contains(err, ErrOffsetSize),
-			errors.Contains(err, ErrInvalidOrder),
-			errors.Contains(err, ErrInvalidDirection),
-			errors.Contains(err, ErrEmptyList),
-			errors.Contains(err, ErrMalformedPolicy),
-			errors.Contains(err, ErrMissingPolicySub),
-			errors.Contains(err, ErrMissingPolicyObj),
-			errors.Contains(err, ErrMalformedPolicyAct),
-			errors.Contains(err, ErrMissingCertData),
-			errors.Contains(err, ErrInvalidTopic),
-			errors.Contains(err, ErrInvalidContact),
-			errors.Contains(err, ErrMissingEmail),
-			errors.Contains(err, ErrMissingHost),
-			errors.Contains(err, ErrMissingPass),
-			errors.Contains(err, ErrMissingConfPass),
-			errors.Contains(err, ErrInvalidResetPass),
-			errors.Contains(err, ErrInvalidComparator),
-			errors.Contains(err, ErrMissingMemberType),
-			errors.Contains(err, ErrMaxLevelExceeded),
-			errors.Contains(err, ErrInvalidAPIKey),
-			errors.Contains(err, ErrInvalidLevel),
-			errors.Contains(err, ErrBootstrapState),
-			errors.Contains(err, ErrInvalidQueryParams),
-			errors.Contains(err, ErrMalformedEntity):
+		if errors.Contains(err, ErrValidation) {
 			logger.Error(err.Error())
 		}
-
 		enc(ctx, err, w)
 	}
 }
@@ -61,7 +29,7 @@ func LoggingErrorEncoder(logger logger.Logger, enc kithttp.ErrorEncoder) kithttp
 func ReadUintQuery(r *http.Request, key string, def uint64) (uint64, error) {
 	vals := bone.GetQuery(r, key)
 	if len(vals) > 1 {
-		return 0, errors.ErrInvalidQueryParams
+		return 0, ErrInvalidQueryParams
 	}
 
 	if len(vals) == 0 {
@@ -71,7 +39,7 @@ func ReadUintQuery(r *http.Request, key string, def uint64) (uint64, error) {
 	strval := vals[0]
 	val, err := strconv.ParseUint(strval, 10, 64)
 	if err != nil {
-		return 0, errors.ErrInvalidQueryParams
+		return 0, ErrInvalidQueryParams
 	}
 
 	return val, nil
@@ -81,7 +49,7 @@ func ReadUintQuery(r *http.Request, key string, def uint64) (uint64, error) {
 func ReadStringQuery(r *http.Request, key string, def string) (string, error) {
 	vals := bone.GetQuery(r, key)
 	if len(vals) > 1 {
-		return "", errors.ErrInvalidQueryParams
+		return "", ErrInvalidQueryParams
 	}
 
 	if len(vals) == 0 {
@@ -95,7 +63,7 @@ func ReadStringQuery(r *http.Request, key string, def string) (string, error) {
 func ReadMetadataQuery(r *http.Request, key string, def map[string]interface{}) (map[string]interface{}, error) {
 	vals := bone.GetQuery(r, key)
 	if len(vals) > 1 {
-		return nil, errors.ErrInvalidQueryParams
+		return nil, ErrInvalidQueryParams
 	}
 
 	if len(vals) == 0 {
@@ -105,7 +73,7 @@ func ReadMetadataQuery(r *http.Request, key string, def map[string]interface{})
 	m := make(map[string]interface{})
 	err := json.Unmarshal([]byte(vals[0]), &m)
 	if err != nil {
-		return nil, errors.Wrap(errors.ErrInvalidQueryParams, err)
+		return nil, errors.Wrap(ErrInvalidQueryParams, err)
 	}
 
 	return m, nil
@@ -115,7 +83,7 @@ func ReadMetadataQuery(r *http.Request, key string, def map[string]interface{})
 func ReadBoolQuery(r *http.Request, key string, def bool) (bool, error) {
 	vals := bone.GetQuery(r, key)
 	if len(vals) > 1 {
-		return false, errors.ErrInvalidQueryParams
+		return false, ErrInvalidQueryParams
 	}
 
 	if len(vals) == 0 {
@@ -124,7 +92,7 @@ func ReadBoolQuery(r *http.Request, key string, def bool) (bool, error) {
 
 	b, err := strconv.ParseBool(vals[0])
 	if err != nil {
-		return false, errors.ErrInvalidQueryParams
+		return false, ErrInvalidQueryParams
 	}
 
 	return b, nil
@@ -134,7 +102,7 @@ func ReadBoolQuery(r *http.Request, key string, def bool) (bool, error) {
 func ReadFloatQuery(r *http.Request, key string, def float64) (float64, error) {
 	vals := bone.GetQuery(r, key)
 	if len(vals) > 1 {
-		return 0, errors.ErrInvalidQueryParams
+		return 0, ErrInvalidQueryParams
 	}
 
 	if len(vals) == 0 {
@@ -144,7 +112,7 @@ func ReadFloatQuery(r *http.Request, key string, def float64) (float64, error) {
 	fval := vals[0]
 	val, err := strconv.ParseFloat(fval, 64)
 	if err != nil {
-		return 0, errors.ErrInvalidQueryParams
+		return 0, ErrInvalidQueryParams
 	}
 
 	return val, nil
@@ -158,7 +126,7 @@ type number interface {
 func ReadNumQuery[N number](r *http.Request, key string, def N) (N, error) {
 	vals := bone.GetQuery(r, key)
 	if len(vals) > 1 {
-		return 0, errors.ErrInvalidQueryParams
+		return 0, ErrInvalidQueryParams
 	}
 	if len(vals) == 0 {
 		return def, nil

opcua/api/endpoint.go

@@ -7,7 +7,9 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
 	"github.com/mainflux/mainflux/opcua"
+	"github.com/mainflux/mainflux/pkg/errors"
 )
 
 func browseEndpoint(svc opcua.Service) endpoint.Endpoint {
@@ -15,7 +17,7 @@ func browseEndpoint(svc opcua.Service) endpoint.Endpoint {
 		req := request.(browseReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		nodes, err := svc.Browse(ctx, req.ServerURI, req.Namespace, req.Identifier)

opcua/api/transport.go

@@ -6,6 +6,7 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 
 	kithttp "github.com/go-kit/kit/transport/http"
@@ -51,17 +52,17 @@ func MakeHandler(svc opcua.Service, logger mflog.Logger, instanceID string) http
 func decodeBrowse(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, serverParam, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	n, err := apiutil.ReadStringQuery(r, namespaceParam, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	i, err := apiutil.ReadStringQuery(r, identifierParam, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	if n == "" || i == "" {
@@ -97,8 +98,13 @@ func encodeResponse(_ context.Context, w http.ResponseWriter, response interface
 }
 
 func encodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	switch {
-	case errors.Contains(err, errors.ErrInvalidQueryParams),
+	case errors.Contains(err, apiutil.ErrInvalidQueryParams),
 		errors.Contains(err, errors.ErrMalformedEntity),
 		err == apiutil.ErrMissingID:
 		w.WriteHeader(http.StatusBadRequest)
@@ -107,9 +113,19 @@ func encodeError(_ context.Context, err error, w http.ResponseWriter) {
 		w.WriteHeader(http.StatusInternalServerError)
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
 		w.Header().Set("Content-Type", contentType)
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

pkg/errors/errors.go

@@ -81,6 +81,18 @@ func Wrap(wrapper error, err error) error {
 	}
 }
 
+// Unwrap returns the wrapper and the error by separating the Wrapper from the error.
+func Unwrap(err error) (error, error) {
+	if ce, ok := err.(Error); ok {
+		if ce.Err() == nil {
+			return nil, New(ce.Msg())
+		}
+		return New(ce.Msg()), ce.Err()
+	}
+
+	return nil, err
+}
+
 func cast(err error) Error {
 	if err == nil {
 		return nil

pkg/errors/sdk_errors.go

@@ -86,6 +86,7 @@ func CheckError(resp *http.Response, expectedStatusCodes ...int) SDKError {
 	if msg, ok := content[errorKey]; ok {
 		if v, ok := msg.(string); ok {
 			return NewSDKErrorWithStatus(New(v), resp.StatusCode)
+
 		}
 		return NewSDKErrorWithStatus(fmt.Errorf("%v", msg), resp.StatusCode)
 	}

pkg/errors/types.go

@@ -10,15 +10,6 @@ var (
 	// ErrAuthorization indicates failure occurred while authorizing the entity.
 	ErrAuthorization = New("failed to perform authorization over the entity")
 
-	// ErrUnsupportedContentType indicates unacceptable or lack of Content-Type.
-	ErrUnsupportedContentType = New("unsupported content type")
-
-	// ErrInvalidQueryParams indicates invalid query parameters.
-	ErrInvalidQueryParams = New("invalid query parameters")
-
-	// ErrNotFoundParam indicates that the parameter was not found in the query.
-	ErrNotFoundParam = New("parameter not found in the query")
-
 	// ErrMalformedEntity indicates a malformed entity specification.
 	ErrMalformedEntity = New("malformed entity specification")
 

pkg/sdk/go/bootstrap.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/mainflux/mainflux/internal/apiutil"
 	"github.com/mainflux/mainflux/pkg/errors"
 )
 
@@ -133,7 +134,7 @@ func (sdk mfSDK) Whitelist(cfg BootstrapConfig, token string) errors.SDKError {
 	}
 
 	if cfg.ThingID == "" {
-		return errors.NewSDKError(errors.ErrNotFoundParam)
+		return errors.NewSDKError(apiutil.ErrNotFoundParam)
 	}
 
 	url := fmt.Sprintf("%s/%s/%s", sdk.bootstrapURL, whitelistEndpoint, cfg.ThingID)

pkg/sdk/go/certs_test.go

@@ -127,49 +127,49 @@ func TestIssueCert(t *testing.T) {
 			thingID:  "",
 			duration: "10h",
 			token:    adminToken,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrMissingID, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingID), http.StatusBadRequest),
 		},
 		{
 			desc:     "create new cert with invalid thing id and duration",
 			thingID:  "ah",
 			duration: "10h",
 			token:    adminToken,
-			err:      errors.NewSDKErrorWithStatus(certs.ErrFailedCertCreation, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, certs.ErrFailedCertCreation), http.StatusInternalServerError),
 		},
 		{
 			desc:     "create new cert with thing id and empty duration",
 			thingID:  thingID,
 			duration: "",
 			token:    exampleUser1,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrMissingCertData, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingCertData), http.StatusBadRequest),
 		},
 		{
 			desc:     "create new cert with thing id and malformed duration",
 			thingID:  thingID,
 			duration: "10g",
 			token:    exampleUser1,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrInvalidCertData, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrInvalidCertData), http.StatusBadRequest),
 		},
 		{
 			desc:     "create new cert with empty token",
 			thingID:  thingID,
 			duration: "10h",
 			token:    "",
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrBearerToken, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken), http.StatusUnauthorized),
 		},
 		{
 			desc:     "create new cert with invalid token",
 			thingID:  thingID,
 			duration: "10h",
 			token:    wrongValue,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrAuthentication), http.StatusUnauthorized),
 		},
 		{
 			desc:     "create new empty cert",
 			thingID:  "",
 			duration: "",
 			token:    adminToken,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrMissingID, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingID), http.StatusBadRequest),
 		},
 	}
 
@@ -217,14 +217,14 @@ func TestViewCert(t *testing.T) {
 			desc:     "get non-existent cert",
 			certID:   "43",
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrNotFound, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrNotFound), http.StatusInternalServerError),
 			response: sdk.Subscription{},
 		},
 		{
 			desc:     "get cert with invalid token",
 			certID:   cert.CertSerial,
 			token:    "",
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrBearerToken, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken), http.StatusUnauthorized),
 			response: sdk.Subscription{},
 		},
 	}
@@ -273,14 +273,14 @@ func TestViewCertByThing(t *testing.T) {
 			desc:     "get non-existent cert",
 			thingID:  "43",
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrNotFound, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrNotFound), http.StatusInternalServerError),
 			response: sdk.Subscription{},
 		},
 		{
 			desc:     "get cert with invalid token",
 			thingID:  thingID,
 			token:    "",
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrBearerToken, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken), http.StatusUnauthorized),
 			response: sdk.Subscription{},
 		},
 	}
@@ -327,19 +327,19 @@ func TestRevokeCert(t *testing.T) {
 			desc:    "revoke non-existing cert",
 			thingID: "2",
 			token:   token,
-			err:     errors.NewSDKErrorWithStatus(certs.ErrFailedCertRevocation, http.StatusInternalServerError),
+			err:     errors.NewSDKErrorWithStatus(errors.Wrap(certs.ErrFailedCertRevocation, errors.ErrNotFound), http.StatusInternalServerError),
 		},
 		{
 			desc:    "revoke cert with invalid id",
 			thingID: "",
 			token:   token,
-			err:     errors.NewSDKErrorWithStatus(apiutil.ErrMissingID, http.StatusBadRequest),
+			err:     errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingID), http.StatusBadRequest),
 		},
 		{
 			desc:    "revoke cert with empty token",
 			thingID: thingID,
 			token:   "",
-			err:     errors.NewSDKErrorWithStatus(apiutil.ErrBearerToken, http.StatusUnauthorized),
+			err:     errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken), http.StatusUnauthorized),
 		},
 		{
 			desc:    "revoke existing cert",
@@ -351,7 +351,7 @@ func TestRevokeCert(t *testing.T) {
 			desc:    "revoke deleted cert",
 			thingID: thingID,
 			token:   token,
-			err:     errors.NewSDKErrorWithStatus(certs.ErrFailedToRemoveCertFromDB, http.StatusInternalServerError),
+			err:     errors.NewSDKErrorWithStatus(errors.Wrap(certs.ErrFailedToRemoveCertFromDB, errors.ErrNotFound), http.StatusInternalServerError),
 		},
 	}
 

pkg/sdk/go/channels_test.go

@@ -125,7 +125,7 @@ func TestCreateChannel(t *testing.T) {
 			channel: sdk.Channel{
 				Status: mfclients.EnabledStatus.String(),
 			},
-			err: errors.NewSDKErrorWithStatus(apiutil.ErrNameSize, http.StatusBadRequest),
+			err: errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrNameSize), http.StatusBadRequest),
 		},
 		{
 			desc: "create a channel with every field defined",
@@ -209,7 +209,7 @@ func TestCreateChannels(t *testing.T) {
 			channels: []sdk.Channel{},
 			response: []sdk.Channel{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrEmptyList, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrEmptyList), http.StatusBadRequest),
 		},
 		{
 			desc: "register channels that can't be marshalled",
@@ -299,7 +299,7 @@ func TestListChannels(t *testing.T) {
 			token:    invalidToken,
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -307,7 +307,7 @@ func TestListChannels(t *testing.T) {
 			token:    "",
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -315,7 +315,7 @@ func TestListChannels(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    0,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -323,7 +323,7 @@ func TestListChannels(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    110,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: []sdk.Channel(nil),
 		},
 		{
@@ -421,7 +421,7 @@ func TestViewChannel(t *testing.T) {
 			token:     "wrongtoken",
 			channelID: channel.ID,
 			response:  sdk.Channel{Children: []*sdk.Channel{}},
-			err:       errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized),
+			err:       errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized),
 		},
 		{
 			desc:      "view channel for wrong id",
@@ -575,7 +575,7 @@ func TestUpdateChannel(t *testing.T) {
 			},
 			response: sdk.Channel{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized),
 		},
 		{
 			desc: "update channel description with invalid token",
@@ -585,7 +585,7 @@ func TestUpdateChannel(t *testing.T) {
 			},
 			response: sdk.Channel{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized),
 		},
 		{
 			desc: "update channel metadata with invalid token",
@@ -597,7 +597,7 @@ func TestUpdateChannel(t *testing.T) {
 			},
 			response: sdk.Channel{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized),
 		},
 		{
 			desc: "update channel that can't be marshalled",
@@ -739,7 +739,7 @@ func TestListChannelsByThing(t *testing.T) {
 			clientID: testsutil.GenerateUUID(t, idProvider),
 			page:     sdk.PageMetadata{},
 			response: []sdk.Channel(nil),
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized),
 		},
 		{
 			desc:     "list channel with an invalid id",
@@ -803,7 +803,7 @@ func TestEnableChannel(t *testing.T) {
 	repoCall1 := gRepo.On("RetrieveByID", mock.Anything, mock.Anything).Return(nil)
 	repoCall2 := gRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(nil)
 	_, err := mfsdk.EnableChannel("wrongID", adminToken)
-	assert.Equal(t, err, errors.NewSDKErrorWithStatus(mfgroups.ErrEnableGroup, http.StatusNotFound), fmt.Sprintf("Enable channel with wrong id: expected %v got %v", errors.ErrNotFound, err))
+	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.Wrap(mfgroups.ErrEnableGroup, errors.ErrNotFound), http.StatusNotFound), fmt.Sprintf("Enable channel with wrong id: expected %v got %v", errors.ErrNotFound, err))
 	ok := repoCall.Parent.AssertCalled(t, "EvaluateGroupAccess", mock.Anything, mock.Anything)
 	assert.True(t, ok, "EvaluateGroupAccess was not called on enabling channel")
 	ok = repoCall1.Parent.AssertCalled(t, "RetrieveByID", mock.Anything, "wrongID")
@@ -873,7 +873,7 @@ func TestDisableChannel(t *testing.T) {
 	repoCall1 := gRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(sdk.ErrFailedRemoval)
 	repoCall2 := gRepo.On("RetrieveByID", mock.Anything, mock.Anything).Return(nil)
 	_, err := mfsdk.DisableChannel("wrongID", adminToken)
-	assert.Equal(t, err, errors.NewSDKErrorWithStatus(mfgroups.ErrDisableGroup, http.StatusNotFound), fmt.Sprintf("Disable channel with wrong id: expected %v got %v", errors.ErrNotFound, err))
+	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.Wrap(mfgroups.ErrDisableGroup, errors.ErrNotFound), http.StatusNotFound), fmt.Sprintf("Disable channel with wrong id: expected %v got %v", errors.ErrNotFound, err))
 	ok := repoCall.Parent.AssertCalled(t, "EvaluateGroupAccess", mock.Anything, mock.Anything)
 	assert.True(t, ok, "EvaluateGroupAccess was not called on disabling group with wrong id")
 	ok = repoCall1.Parent.AssertCalled(t, "RetrieveByID", mock.Anything, "wrongID")

pkg/sdk/go/consumers_test.go

@@ -83,7 +83,7 @@ func TestCreateSubscription(t *testing.T) {
 			desc:         "create new subscription with empty token",
 			subscription: sub1,
 			token:        "",
-			err:          errors.NewSDKErrorWithStatus(apiutil.ErrBearerToken, http.StatusUnauthorized),
+			err:          errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken), http.StatusUnauthorized),
 			empty:        true,
 		},
 		{
@@ -97,7 +97,7 @@ func TestCreateSubscription(t *testing.T) {
 			desc:         "create new empty subscription",
 			subscription: emptySubscription,
 			token:        token,
-			err:          errors.NewSDKErrorWithStatus(apiutil.ErrInvalidTopic, http.StatusBadRequest),
+			err:          errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrInvalidTopic), http.StatusBadRequest),
 			empty:        true,
 		},
 	}
@@ -148,7 +148,7 @@ func TestViewSubscription(t *testing.T) {
 			desc:     "get subscription with invalid token",
 			subID:    id,
 			token:    "",
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrBearerToken, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken), http.StatusUnauthorized),
 			response: sdk.Subscription{},
 		},
 	}
@@ -260,7 +260,7 @@ func TestDeleteSubscription(t *testing.T) {
 			desc:     "delete subscription with invalid token",
 			subID:    id,
 			token:    "",
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrBearerToken, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken), http.StatusUnauthorized),
 			response: sdk.Subscription{},
 		},
 	}

pkg/sdk/go/groups_test.go

@@ -103,7 +103,7 @@ func TestCreateGroup(t *testing.T) {
 			group: sdk.Group{
 				Status: mfclients.EnabledStatus.String(),
 			},
-			err: errors.NewSDKErrorWithStatus(apiutil.ErrNameSize, http.StatusBadRequest),
+			err: errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrNameSize), http.StatusBadRequest),
 		},
 		{
 			desc: "create a group with every field defined",
@@ -203,7 +203,7 @@ func TestListGroups(t *testing.T) {
 			token:    invalidToken,
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -211,7 +211,7 @@ func TestListGroups(t *testing.T) {
 			token:    "",
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -219,7 +219,7 @@ func TestListGroups(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    0,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -227,7 +227,7 @@ func TestListGroups(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    110,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: []sdk.Group(nil),
 		},
 		{
@@ -333,7 +333,7 @@ func TestListParentGroups(t *testing.T) {
 			token:    invalidToken,
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -341,7 +341,7 @@ func TestListParentGroups(t *testing.T) {
 			token:    "",
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -349,7 +349,7 @@ func TestListParentGroups(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    0,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -357,7 +357,7 @@ func TestListParentGroups(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    110,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: []sdk.Group(nil),
 		},
 		{
@@ -464,7 +464,7 @@ func TestListChildrenGroups(t *testing.T) {
 			token:    invalidToken,
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -472,7 +472,7 @@ func TestListChildrenGroups(t *testing.T) {
 			token:    "",
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -480,7 +480,7 @@ func TestListChildrenGroups(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    0,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -488,7 +488,7 @@ func TestListChildrenGroups(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    110,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: []sdk.Group(nil),
 		},
 		{
@@ -580,7 +580,7 @@ func TestViewGroup(t *testing.T) {
 			token:    "wrongtoken",
 			groupID:  group.ID,
 			response: sdk.Group{Children: []*sdk.Group{}},
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:     "view group for wrong id",
@@ -729,7 +729,7 @@ func TestUpdateGroup(t *testing.T) {
 			},
 			response: sdk.Group{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc: "update group description with invalid token",
@@ -739,7 +739,7 @@ func TestUpdateGroup(t *testing.T) {
 			},
 			response: sdk.Group{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc: "update group metadata with invalid token",
@@ -751,7 +751,7 @@ func TestUpdateGroup(t *testing.T) {
 			},
 			response: sdk.Group{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc: "update a group that can't be marshalled",
@@ -888,7 +888,7 @@ func TestListMemberships(t *testing.T) {
 			clientID: testsutil.GenerateUUID(t, idProvider),
 			page:     sdk.PageMetadata{},
 			response: []sdk.Group(nil),
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:     "list clients with an invalid id",

pkg/sdk/go/message.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/mainflux/mainflux/internal/apiutil"
 	"github.com/mainflux/mainflux/pkg/errors"
 )
 
@@ -57,7 +58,7 @@ func (sdk mfSDK) ReadMessages(chanName, token string) (MessagesPage, errors.SDKE
 
 func (sdk *mfSDK) SetContentType(ct ContentType) errors.SDKError {
 	if ct != CTJSON && ct != CTJSONSenML && ct != CTBinary {
-		return errors.NewSDKError(errors.ErrUnsupportedContentType)
+		return errors.NewSDKError(apiutil.ErrUnsupportedContentType)
 	}
 
 	sdk.msgContentType = ct

pkg/sdk/go/message_test.go

@@ -64,7 +64,7 @@ func TestSendMessage(t *testing.T) {
 			chanID: chanID,
 			msg:    msg,
 			auth:   "",
-			err:    errors.NewSDKErrorWithStatus(apiutil.ErrBearerKey, http.StatusUnauthorized),
+			err:    errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerKey), http.StatusUnauthorized),
 		},
 		"publish message with invalid authorization token": {
 			chanID: chanID,
@@ -82,7 +82,7 @@ func TestSendMessage(t *testing.T) {
 			chanID: "",
 			msg:    msg,
 			auth:   atoken,
-			err:    errors.NewSDKErrorWithStatus(errors.ErrMalformedEntity, http.StatusBadRequest),
+			err:    errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrMalformedEntity), http.StatusBadRequest),
 		},
 		"publish message unable to authorize": {
 			chanID: chanID,
@@ -130,7 +130,7 @@ func TestSetContentType(t *testing.T) {
 		{
 			desc:  "set invalid content type",
 			cType: "invalid",
-			err:   errors.NewSDKError(errors.ErrUnsupportedContentType),
+			err:   errors.NewSDKError(apiutil.ErrUnsupportedContentType),
 		},
 	}
 	for _, tc := range cases {

pkg/sdk/go/policies_test.go

@@ -9,15 +9,12 @@ import (
 
 	"github.com/go-zoo/bone"
 	"github.com/mainflux/mainflux/internal/apiutil"
-	"github.com/mainflux/mainflux/logger"
 	mflog "github.com/mainflux/mainflux/logger"
 	"github.com/mainflux/mainflux/pkg/errors"
 	sdk "github.com/mainflux/mainflux/pkg/sdk/go"
-	"github.com/mainflux/mainflux/things/clients"
 	tclients "github.com/mainflux/mainflux/things/clients"
 	tmocks "github.com/mainflux/mainflux/things/clients/mocks"
 	tgmocks "github.com/mainflux/mainflux/things/groups/mocks"
-	"github.com/mainflux/mainflux/things/policies"
 	tpolicies "github.com/mainflux/mainflux/things/policies"
 	tapi "github.com/mainflux/mainflux/things/policies/api/http"
 	tpmocks "github.com/mainflux/mainflux/things/policies/mocks"
@@ -34,14 +31,14 @@ import (
 var utadminPolicy = umocks.SubjectSet{Subject: "things", Relation: []string{"g_add"}}
 
 func newUsersPolicyServer(svc upolicies.Service) *httptest.Server {
-	logger := logger.NewMock()
+	logger := mflog.NewMock()
 	mux := bone.New()
 	uapi.MakeHandler(svc, mux, logger)
 
 	return httptest.NewServer(mux)
 }
 
-func newThingsPolicyServer(svc clients.Service, psvc policies.Service) *httptest.Server {
+func newThingsPolicyServer(svc tclients.Service, psvc tpolicies.Service) *httptest.Server {
 	logger := mflog.NewMock()
 	mux := bone.New()
 	tapi.MakeHandler(svc, psvc, mux, logger)
@@ -92,7 +89,7 @@ func TestCreatePolicyUser(t *testing.T) {
 			},
 			page:  sdk.PolicyPage{Policies: []sdk.Policy{clientPolicy}},
 			token: generateValidToken(t, csvc, cRepo),
-			err:   errors.NewSDKErrorWithStatus(sdk.ErrFailedCreation, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedCreation), http.StatusInternalServerError),
 		},
 		{
 			desc: "add a new policy with owner",
@@ -125,7 +122,7 @@ func TestCreatePolicyUser(t *testing.T) {
 				Actions: []string{"wrong"},
 				Subject: "sub3",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMalformedPolicyAct), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -135,7 +132,7 @@ func TestCreatePolicyUser(t *testing.T) {
 				Actions: []string{"c_delete"},
 				Subject: "sub4",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingPolicyObj, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingPolicyObj), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -145,7 +142,7 @@ func TestCreatePolicyUser(t *testing.T) {
 				Actions: []string{"c_delete"},
 				Object:  "obj4",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingPolicySub, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingPolicySub), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -228,7 +225,7 @@ func TestAuthorizeUser(t *testing.T) {
 				Subject:    "sub3",
 				EntityType: "client",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMalformedPolicyAct), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -239,7 +236,7 @@ func TestAuthorizeUser(t *testing.T) {
 				Subject:    "sub4",
 				EntityType: "client",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingPolicyObj, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingPolicyObj), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -250,7 +247,7 @@ func TestAuthorizeUser(t *testing.T) {
 				Object:     "obj4",
 				EntityType: "client",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingPolicySub, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingPolicySub), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -261,7 +258,7 @@ func TestAuthorizeUser(t *testing.T) {
 				Object:     "obj5",
 				EntityType: "client",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMalformedPolicyAct), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 	}
@@ -322,7 +319,7 @@ func TestAssign(t *testing.T) {
 			},
 			page:  sdk.PolicyPage{Policies: []sdk.Policy{clientPolicy}},
 			token: generateValidToken(t, csvc, cRepo),
-			err:   errors.NewSDKErrorWithStatus(sdk.ErrFailedCreation, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedCreation), http.StatusInternalServerError),
 		},
 		{
 			desc: "add a new policy with owner",
@@ -355,7 +352,7 @@ func TestAssign(t *testing.T) {
 				Actions: []string{"wrong"},
 				Subject: "sub3",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMalformedPolicyAct), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -365,7 +362,7 @@ func TestAssign(t *testing.T) {
 				Actions: []string{"c_delete"},
 				Subject: "sub4",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingPolicyObj, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingPolicyObj), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -375,7 +372,7 @@ func TestAssign(t *testing.T) {
 				Actions: []string{"c_delete"},
 				Object:  "obj4",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingPolicySub, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingPolicySub), http.StatusInternalServerError),
 			token: generateValidToken(t, csvc, cRepo),
 		},
 		{
@@ -440,13 +437,13 @@ func TestUpdatePolicy(t *testing.T) {
 			desc:   "update policy action with invalid token",
 			action: []string{"m_write"},
 			token:  "non-existent",
-			err:    errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:    errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:   "update policy action with wrong policy action",
 			action: []string{"wrong"},
 			token:  generateValidToken(t, csvc, cRepo),
-			err:    errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			err:    errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMalformedPolicyAct), http.StatusInternalServerError),
 		},
 	}
 
@@ -507,7 +504,7 @@ func TestUpdateThingsPolicy(t *testing.T) {
 			desc:   "update policy action with invalid token",
 			action: []string{"m_write"},
 			token:  "non-existent",
-			err:    errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized),
+			err:    errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized),
 		},
 		{
 			desc:   "update policy action with wrong policy action",
@@ -521,7 +518,7 @@ func TestUpdateThingsPolicy(t *testing.T) {
 		policy.Actions = tc.action
 		policy.CreatedAt = time.Now()
 		repoCall := pRepo.On("RetrieveAll", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(tpolicies.PolicyPage{}, nil)
-		repoCall1 := pRepo.On("Update", mock.Anything, mock.Anything).Return(policies.Policy{}, tc.err)
+		repoCall1 := pRepo.On("Update", mock.Anything, mock.Anything).Return(tpolicies.Policy{}, tc.err)
 		err := mfsdk.UpdateThingPolicy(policy, tc.token)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		ok := repoCall.Parent.AssertCalled(t, "Update", mock.Anything, mock.Anything)
@@ -578,7 +575,7 @@ func TestListPolicies(t *testing.T) {
 		{
 			desc:     "list policies with invalid token",
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 			response: []sdk.Policy(nil),
 		},
 		{
@@ -648,7 +645,7 @@ func TestListPolicies(t *testing.T) {
 				Action: "wrong",
 			},
 			response: []sdk.Policy(nil),
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMalformedPolicyAct), http.StatusInternalServerError),
 		},
 	}
 
@@ -699,7 +696,7 @@ func TestDeletePolicy(t *testing.T) {
 	repoCall1 = pRepo.On("RetrieveAll", mock.Anything, mock.Anything).Return(convertUserPolicyPage(sdk.PolicyPage{Policies: []sdk.Policy{cpr}}), nil)
 	repoCall2 = pRepo.On("Delete", mock.Anything, mock.Anything).Return(sdk.ErrFailedRemoval)
 	err = mfsdk.DeleteUserPolicy(pr, invalidToken)
-	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized), fmt.Sprintf("expected %v got %v", pr, err))
+	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized), fmt.Sprintf("expected %v got %s", pr, err))
 	ok = repoCall.Parent.AssertCalled(t, "Delete", mock.Anything, mock.Anything)
 	assert.True(t, ok, "Delete was not called on invalid policy")
 	repoCall2.Unset()
@@ -741,7 +738,7 @@ func TestUnassign(t *testing.T) {
 	repoCall1 = pRepo.On("RetrieveAll", mock.Anything, mock.Anything).Return(convertUserPolicyPage(sdk.PolicyPage{Policies: []sdk.Policy{cpr}}), nil)
 	repoCall2 = pRepo.On("Delete", mock.Anything, mock.Anything).Return(sdk.ErrFailedRemoval)
 	err = mfsdk.Unassign(pr.Subject, pr.Object, invalidToken)
-	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized), fmt.Sprintf("expected %v got %v", pr, err))
+	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized), fmt.Sprintf("expected %v got %s", pr, err))
 	ok = repoCall.Parent.AssertCalled(t, "Delete", mock.Anything, mock.Anything)
 	assert.True(t, ok, "Delete was not called on invalid policy")
 	repoCall2.Unset()
@@ -776,6 +773,7 @@ func TestConnect(t *testing.T) {
 		page   sdk.PolicyPage
 		token  string
 		err    errors.SDKError
+		tcerr  errors.SDKError
 	}{
 		{
 			desc: "add new policy",
@@ -787,6 +785,7 @@ func TestConnect(t *testing.T) {
 			page:  sdk.PolicyPage{},
 			token: adminToken,
 			err:   nil,
+			tcerr: nil,
 		},
 		{
 			desc: "add existing policy",
@@ -798,6 +797,7 @@ func TestConnect(t *testing.T) {
 			page:  sdk.PolicyPage{Policies: []sdk.Policy{clientPolicy}},
 			token: adminToken,
 			err:   errors.NewSDKErrorWithStatus(sdk.ErrFailedCreation, http.StatusInternalServerError),
+			tcerr: errors.NewSDKError(sdk.ErrFailedCreation),
 		},
 		{
 			desc: "add a new policy with owner",
@@ -809,6 +809,7 @@ func TestConnect(t *testing.T) {
 				Subject: "subwithowner",
 			},
 			err:   nil,
+			tcerr: nil,
 			token: adminToken,
 		},
 		{
@@ -820,6 +821,7 @@ func TestConnect(t *testing.T) {
 				Subject: "sub2",
 			},
 			err:   nil,
+			tcerr: nil,
 			token: adminToken,
 		},
 		{
@@ -831,6 +833,7 @@ func TestConnect(t *testing.T) {
 				Subject: "sub3",
 			},
 			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			tcerr: errors.NewSDKError(apiutil.ErrMalformedPolicyAct),
 			token: adminToken,
 		},
 		{
@@ -840,7 +843,8 @@ func TestConnect(t *testing.T) {
 				Actions: []string{"c_delete"},
 				Subject: "sub4",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingID, http.StatusBadRequest),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingID), http.StatusBadRequest),
+			tcerr: errors.NewSDKError(apiutil.ErrMissingID),
 			token: adminToken,
 		},
 		{
@@ -850,7 +854,8 @@ func TestConnect(t *testing.T) {
 				Actions: []string{"c_delete"},
 				Object:  "obj4",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingID, http.StatusBadRequest),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingID), http.StatusBadRequest),
+			tcerr: errors.NewSDKError(apiutil.ErrMissingID),
 			token: adminToken,
 		},
 		{
@@ -861,12 +866,13 @@ func TestConnect(t *testing.T) {
 				Object:  "obj5",
 			},
 			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			tcerr: errors.NewSDKError(apiutil.ErrMalformedPolicyAct),
 			token: adminToken,
 		},
 	}
 
 	for _, tc := range cases {
-		repoCall := pRepo.On("Save", mock.Anything, mock.Anything).Return(convertThingPolicy(tc.policy), tc.err)
+		repoCall := pRepo.On("Save", mock.Anything, mock.Anything).Return(convertThingPolicy(tc.policy), tc.tcerr)
 		conn := sdk.ConnectionIDs{ChannelIDs: []string{tc.policy.Object}, ThingIDs: []string{tc.policy.Subject}, Actions: tc.policy.Actions}
 		err := mfsdk.Connect(conn, tc.token)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
@@ -926,7 +932,7 @@ func TestConnectThing(t *testing.T) {
 			},
 			page:  sdk.PolicyPage{Policies: []sdk.Policy{clientPolicy}},
 			token: adminToken,
-			err:   errors.NewSDKErrorWithStatus(sdk.ErrFailedCreation, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedCreation), http.StatusInternalServerError),
 		},
 		{
 			desc: "add a new policy with owner",
@@ -959,7 +965,7 @@ func TestConnectThing(t *testing.T) {
 				Actions: []string{"wrong"},
 				Subject: "sub3",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMalformedPolicyAct), http.StatusInternalServerError),
 			token: adminToken,
 		},
 		{
@@ -969,7 +975,7 @@ func TestConnectThing(t *testing.T) {
 				Actions: []string{"c_delete"},
 				Subject: "sub4",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingID, http.StatusBadRequest),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingID), http.StatusBadRequest),
 			token: adminToken,
 		},
 		{
@@ -979,7 +985,7 @@ func TestConnectThing(t *testing.T) {
 				Actions: []string{"c_delete"},
 				Object:  "obj4",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMissingID, http.StatusBadRequest),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMissingID), http.StatusBadRequest),
 			token: adminToken,
 		},
 		{
@@ -989,7 +995,7 @@ func TestConnectThing(t *testing.T) {
 				Subject: "sub5",
 				Object:  "obj5",
 			},
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrMalformedPolicyAct, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrMalformedPolicyAct), http.StatusInternalServerError),
 			token: adminToken,
 		},
 	}
@@ -1037,7 +1043,7 @@ func TestDisconnectThing(t *testing.T) {
 
 	repoCall = pRepo.On("Delete", mock.Anything, mock.Anything).Return(sdk.ErrFailedRemoval)
 	err = mfsdk.DisconnectThing(pr.Subject, pr.Object, invalidToken)
-	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized), fmt.Sprintf("expected %v got %v", pr, err))
+	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized), fmt.Sprintf("expected %v got %s", pr, err))
 	ok = repoCall.Parent.AssertCalled(t, "Delete", mock.Anything, mock.Anything)
 	assert.True(t, ok, "Delete was not called on invalid policy")
 	repoCall.Unset()
@@ -1076,7 +1082,7 @@ func TestDisconnect(t *testing.T) {
 	repoCall = pRepo.On("Delete", mock.Anything, mock.Anything).Return(sdk.ErrFailedRemoval)
 	conn = sdk.ConnectionIDs{ChannelIDs: []string{pr.Object}, ThingIDs: []string{pr.Subject}}
 	err = mfsdk.Disconnect(conn, invalidToken)
-	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized), fmt.Sprintf("expected %v got %v", pr, err))
+	assert.Equal(t, err, errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized), fmt.Sprintf("expected %v got %s", pr, err))
 	ok = repoCall.Parent.AssertCalled(t, "Delete", mock.Anything, mock.Anything)
 	assert.True(t, ok, "Delete was not called on invalid policy")
 	repoCall.Unset()

pkg/sdk/go/sdk.go

@@ -65,6 +65,8 @@ var (
 
 	// ErrFailedDisable indicates that client disable failed.
 	ErrFailedDisable = errors.New("failed to disable client")
+
+	ErrInvalidJWT = errors.New("invalid JWT")
 )
 
 type PageMetadata struct {

pkg/sdk/go/things_test.go

@@ -72,6 +72,7 @@ func TestCreateThing(t *testing.T) {
 		client   sdk.Thing
 		response sdk.Thing
 		token    string
+		repoErr  error
 		err      errors.SDKError
 	}{
 		{
@@ -79,6 +80,7 @@ func TestCreateThing(t *testing.T) {
 			client:   thing,
 			response: thing,
 			token:    token,
+			repoErr:  nil,
 			err:      nil,
 		},
 		{
@@ -86,6 +88,7 @@ func TestCreateThing(t *testing.T) {
 			client:   thing,
 			response: sdk.Thing{},
 			token:    token,
+			repoErr:  sdk.ErrFailedCreation,
 			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedCreation, http.StatusInternalServerError),
 		},
 		{
@@ -93,6 +96,7 @@ func TestCreateThing(t *testing.T) {
 			client:   sdk.Thing{},
 			response: sdk.Thing{},
 			token:    token,
+			repoErr:  errors.ErrMalformedEntity,
 			err:      errors.NewSDKErrorWithStatus(errors.ErrMalformedEntity, http.StatusBadRequest),
 		},
 		{
@@ -106,6 +110,7 @@ func TestCreateThing(t *testing.T) {
 			response: sdk.Thing{},
 			token:    token,
 			err:      errors.NewSDKError(fmt.Errorf("json: unsupported type: chan int")),
+			repoErr:  errors.NewSDKError(fmt.Errorf("json: unsupported type: chan int")),
 		},
 		{
 			desc: "register thing with empty secret",
@@ -121,8 +126,9 @@ func TestCreateThing(t *testing.T) {
 					Secret: "",
 				},
 			},
-			token: token,
-			err:   nil,
+			token:   token,
+			err:     nil,
+			repoErr: nil,
 		},
 		{
 			desc: "register thing with empty identity",
@@ -138,15 +144,9 @@ func TestCreateThing(t *testing.T) {
 					Secret:   secret,
 				},
 			},
-			token: token,
-			err:   nil,
-		},
-		{
-			desc:     "register empty thing",
-			client:   sdk.Thing{},
-			response: sdk.Thing{},
-			token:    token,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrMalformedEntity, http.StatusBadRequest),
+			token:   token,
+			repoErr: nil,
+			err:     nil,
 		},
 		{
 			desc: "register thing with every field defined",
@@ -172,13 +172,15 @@ func TestCreateThing(t *testing.T) {
 				UpdatedAt:   time.Now(),
 				Status:      mfclients.EnabledStatus.String(),
 			},
-			token: token,
-			err:   nil,
+			token:   token,
+			repoErr: nil,
+			err:     nil,
 		},
 	}
 	for _, tc := range cases {
-		repoCall := cRepo.On("Save", mock.Anything, mock.Anything).Return(tc.response, tc.err)
+		repoCall := cRepo.On("Save", mock.Anything, mock.Anything).Return(tc.response, tc.repoErr)
 		rThing, err := mfsdk.CreateThing(tc.client, tc.token)
+
 		tc.response.ID = rThing.ID
 		tc.response.Owner = rThing.Owner
 		tc.response.CreatedAt = rThing.CreatedAt
@@ -243,14 +245,14 @@ func TestCreateThings(t *testing.T) {
 			things:   things,
 			response: []sdk.Thing{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedCreation, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedCreation), http.StatusInternalServerError),
 		},
 		{
 			desc:     "register empty things",
 			things:   []sdk.Thing{},
 			response: []sdk.Thing{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrEmptyList, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrEmptyList), http.StatusBadRequest),
 		},
 		{
 			desc: "register things that can't be marshalled",
@@ -357,7 +359,7 @@ func TestListThings(t *testing.T) {
 			token:    invalidToken,
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -365,7 +367,7 @@ func TestListThings(t *testing.T) {
 			token:    "",
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -373,7 +375,7 @@ func TestListThings(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    0,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrLimitSize, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrLimitSize), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -381,7 +383,7 @@ func TestListThings(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    110,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrLimitSize, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrLimitSize), http.StatusInternalServerError),
 			response: []sdk.Thing(nil),
 		},
 		{
@@ -755,7 +757,7 @@ func TestUpdateThing(t *testing.T) {
 			thing:    thing2,
 			response: sdk.Thing{},
 			token:    adminToken,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedUpdate, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedUpdate), http.StatusInternalServerError),
 		},
 		{
 			desc: "update thing that can't be marshalled",
@@ -847,7 +849,7 @@ func TestUpdateThingTags(t *testing.T) {
 			thing:    thing2,
 			response: sdk.Thing{},
 			token:    adminToken,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedUpdate, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedUpdate), http.StatusInternalServerError),
 		},
 		{
 			desc: "update thing that can't be marshalled",
@@ -909,6 +911,7 @@ func TestUpdateThingSecret(t *testing.T) {
 		newSecret string
 		token     string
 		response  sdk.Thing
+		repoErr   error
 		err       error
 	}{
 		{
@@ -917,6 +920,7 @@ func TestUpdateThingSecret(t *testing.T) {
 			newSecret: "newSecret",
 			token:     adminToken,
 			response:  rthing,
+			repoErr:   nil,
 			err:       nil,
 		},
 		{
@@ -925,6 +929,7 @@ func TestUpdateThingSecret(t *testing.T) {
 			newSecret: "newPassword",
 			token:     "non-existent",
 			response:  sdk.Thing{},
+			repoErr:   errors.ErrAuthorization,
 			err:       errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
 		},
 		{
@@ -933,13 +938,13 @@ func TestUpdateThingSecret(t *testing.T) {
 			newSecret: "newSecret",
 			token:     adminToken,
 			response:  sdk.Thing{},
+			repoErr:   apiutil.ErrInvalidSecret,
 			err:       errors.NewSDKErrorWithStatus(apiutil.ErrInvalidSecret, http.StatusBadRequest),
 		},
 	}
-
 	for _, tc := range cases {
 		repoCall := pRepo.On("EvaluateThingAccess", mock.Anything, mock.Anything).Return(policies.Policy{}, nil)
-		repoCall1 := cRepo.On("UpdateSecret", mock.Anything, mock.Anything).Return(convertThing(tc.response), tc.err)
+		repoCall1 := cRepo.On("UpdateSecret", mock.Anything, mock.Anything).Return(convertThing(tc.response), tc.repoErr)
 		uClient, err := mfsdk.UpdateThingSecret(tc.oldSecret, tc.newSecret, tc.token)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		assert.Equal(t, tc.response, uClient, fmt.Sprintf("%s: expected %v got %v\n", tc.desc, tc.response, uClient))
@@ -1010,7 +1015,7 @@ func TestUpdateThingOwner(t *testing.T) {
 			thing:    thing2,
 			response: sdk.Thing{},
 			token:    adminToken,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedUpdate, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedUpdate), http.StatusInternalServerError),
 		},
 		{
 			desc: "update thing that can't be marshalled",
@@ -1074,6 +1079,7 @@ func TestEnableThing(t *testing.T) {
 		token    string
 		thing    sdk.Thing
 		response sdk.Thing
+		repoErr  error
 		err      errors.SDKError
 	}{
 		{
@@ -1082,6 +1088,7 @@ func TestEnableThing(t *testing.T) {
 			token:    adminToken,
 			thing:    disabledThing1,
 			response: endisabledThing1,
+			repoErr:  nil,
 			err:      nil,
 		},
 		{
@@ -1090,7 +1097,8 @@ func TestEnableThing(t *testing.T) {
 			token:    adminToken,
 			thing:    enabledThing1,
 			response: sdk.Thing{},
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedEnable, http.StatusInternalServerError),
+			repoErr:  sdk.ErrFailedEnable,
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(sdk.ErrFailedEnable, sdk.ErrFailedEnable), http.StatusInternalServerError),
 		},
 		{
 			desc:     "enable non-existing thing",
@@ -1098,14 +1106,15 @@ func TestEnableThing(t *testing.T) {
 			token:    adminToken,
 			thing:    sdk.Thing{},
 			response: sdk.Thing{},
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedEnable, http.StatusNotFound),
+			repoErr:  sdk.ErrFailedEnable,
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(sdk.ErrFailedEnable, errors.ErrNotFound), http.StatusNotFound),
 		},
 	}
 
 	for _, tc := range cases {
 		repoCall := pRepo.On("EvaluateThingAccess", mock.Anything, mock.Anything).Return(policies.Policy{}, nil)
-		repoCall1 := cRepo.On("RetrieveByID", mock.Anything, tc.id).Return(convertThing(tc.thing), tc.err)
-		repoCall2 := cRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(convertThing(tc.response), tc.err)
+		repoCall1 := cRepo.On("RetrieveByID", mock.Anything, tc.id).Return(convertThing(tc.thing), tc.repoErr)
+		repoCall2 := cRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(convertThing(tc.response), tc.repoErr)
 		eClient, err := mfsdk.EnableThing(tc.id, tc.token)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		assert.Equal(t, tc.response, eClient, fmt.Sprintf("%s: expected %v got %v\n", tc.desc, tc.response, eClient))
@@ -1205,6 +1214,7 @@ func TestDisableThing(t *testing.T) {
 		token    string
 		thing    sdk.Thing
 		response sdk.Thing
+		repoErr  error
 		err      errors.SDKError
 	}{
 		{
@@ -1213,6 +1223,7 @@ func TestDisableThing(t *testing.T) {
 			token:    adminToken,
 			thing:    enabledThing1,
 			response: disenabledThing1,
+			repoErr:  nil,
 			err:      nil,
 		},
 		{
@@ -1221,7 +1232,8 @@ func TestDisableThing(t *testing.T) {
 			token:    adminToken,
 			thing:    disabledThing1,
 			response: sdk.Thing{},
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedDisable, http.StatusInternalServerError),
+			repoErr:  sdk.ErrFailedDisable,
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(sdk.ErrFailedDisable, sdk.ErrFailedDisable), http.StatusInternalServerError),
 		},
 		{
 			desc:     "disable non-existing thing",
@@ -1229,14 +1241,15 @@ func TestDisableThing(t *testing.T) {
 			thing:    sdk.Thing{},
 			token:    adminToken,
 			response: sdk.Thing{},
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedDisable, http.StatusNotFound),
+			repoErr:  sdk.ErrFailedDisable,
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(sdk.ErrFailedDisable, errors.ErrNotFound), http.StatusNotFound),
 		},
 	}
 
 	for _, tc := range cases {
 		repoCall := pRepo.On("EvaluateThingAccess", mock.Anything, mock.Anything).Return(policies.Policy{}, nil)
-		repoCall1 := cRepo.On("RetrieveByID", mock.Anything, tc.id).Return(convertThing(tc.thing), tc.err)
-		repoCall2 := cRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(convertThing(tc.response), tc.err)
+		repoCall1 := cRepo.On("RetrieveByID", mock.Anything, tc.id).Return(convertThing(tc.thing), tc.repoErr)
+		repoCall2 := cRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(convertThing(tc.response), tc.repoErr)
 		dThing, err := mfsdk.DisableThing(tc.id, tc.token)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		assert.Equal(t, tc.response, dThing, fmt.Sprintf("%s: expected %v got %v\n", tc.desc, tc.response, dThing))
@@ -1335,24 +1348,27 @@ func TestIdentify(t *testing.T) {
 		desc     string
 		secret   string
 		response string
+		repoErr  error
 		err      errors.SDKError
 	}{
 		{
 			desc:     "identify thing successfully",
 			response: thing.ID,
 			secret:   thing.Credentials.Secret,
+			repoErr:  nil,
 			err:      nil,
 		},
 		{
 			desc:     "identify thing with an invalid token",
 			response: "",
 			secret:   invalidToken,
+			repoErr:  errors.ErrAuthentication,
 			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
 		},
 	}
 
 	for _, tc := range cases {
-		repoCall := cRepo.On("RetrieveBySecret", mock.Anything, mock.Anything).Return(convertThing(thing), tc.err)
+		repoCall := cRepo.On("RetrieveBySecret", mock.Anything, mock.Anything).Return(convertThing(thing), tc.repoErr)
 		id, err := mfsdk.IdentifyThing(tc.secret)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		assert.Equal(t, tc.response, id, fmt.Sprintf("%s: expected %v got %v\n", tc.desc, tc.response, id))
@@ -1407,7 +1423,7 @@ func TestShareThing(t *testing.T) {
 			channelID: generateUUID(t),
 			thingID:   thingID,
 			token:     invalidToken,
-			err:       errors.NewSDKErrorWithStatus(errors.ErrAuthorization, http.StatusUnauthorized),
+			err:       errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthorization, errors.ErrAuthentication), http.StatusUnauthorized),
 		},
 		{
 			desc:      "share thing with valid token for unauthorized user",

pkg/sdk/go/tokens_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/mainflux/mainflux/internal/apiutil"
@@ -60,7 +61,7 @@ func TestIssueToken(t *testing.T) {
 		{
 			desc:   "issue token for an empty user",
 			client: sdk.User{},
-			err:    errors.NewSDKErrorWithStatus(apiutil.ErrMissingIdentity, http.StatusInternalServerError),
+			err:    errors.NewSDKErrorWithStatus(apiutil.ErrMissingIdentity, http.StatusBadRequest),
 		},
 		{
 			desc: "issue token for invalid secret",
@@ -71,17 +72,19 @@ func TestIssueToken(t *testing.T) {
 				},
 			},
 			dbClient: wrongClient,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, apiutil.ErrValidation), http.StatusUnauthorized),
 		},
 	}
 	for _, tc := range cases {
 		repoCall := cRepo.On("RetrieveByIdentity", mock.Anything, mock.Anything).Return(convertClient(tc.dbClient), tc.err)
 		token, err := mfsdk.CreateToken(tc.client)
-		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
-		if tc.err == nil {
+		switch tc.err {
+		case nil:
 			assert.NotEmpty(t, token, fmt.Sprintf("%s: expected token, got empty", tc.desc))
 			ok := repoCall.Parent.AssertCalled(t, "RetrieveByIdentity", mock.Anything, mock.Anything)
 			assert.True(t, ok, fmt.Sprintf("RetrieveByIdentity was not called on %s", tc.desc))
+		default:
+			assert.True(t, strings.Contains(err.Msg(), tc.err.Msg()), fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		}
 		repoCall.Unset()
 	}
@@ -138,7 +141,7 @@ func TestRefreshToken(t *testing.T) {
 		{
 			desc:  "refresh token for an empty token",
 			token: "",
-			err:   errors.NewSDKErrorWithStatus(apiutil.ErrBearerToken, http.StatusInternalServerError),
+			err:   errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrBearerToken), http.StatusInternalServerError),
 		},
 	}
 	for _, tc := range cases {

pkg/sdk/go/users_test.go

@@ -73,14 +73,14 @@ func TestCreateClient(t *testing.T) {
 			client:   user,
 			response: sdk.User{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedCreation, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedCreation), http.StatusInternalServerError),
 		},
 		{
 			desc:     "register empty user",
 			client:   sdk.User{},
 			response: sdk.User{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrMalformedEntity, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrMalformedEntity), http.StatusBadRequest),
 		},
 		{
 			desc: "register a user that can't be marshalled",
@@ -107,7 +107,7 @@ func TestCreateClient(t *testing.T) {
 			},
 			response: sdk.User{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrMalformedEntity, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrMalformedEntity), http.StatusBadRequest),
 		},
 		{
 			desc: "register user with empty secret",
@@ -119,7 +119,7 @@ func TestCreateClient(t *testing.T) {
 			},
 			response: sdk.User{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrMalformedEntity, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrMalformedEntity), http.StatusBadRequest),
 		},
 		{
 			desc: "register user with empty identity",
@@ -131,14 +131,14 @@ func TestCreateClient(t *testing.T) {
 			},
 			response: sdk.User{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrMalformedEntity, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrMalformedEntity), http.StatusBadRequest),
 		},
 		{
 			desc:     "register empty user",
 			client:   sdk.User{},
 			response: sdk.User{},
 			token:    token,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrMalformedEntity, http.StatusBadRequest),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, errors.ErrMalformedEntity), http.StatusBadRequest),
 		},
 		{
 			desc: "register user with every field defined",
@@ -249,7 +249,7 @@ func TestListClients(t *testing.T) {
 			token:    invalidToken,
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -257,7 +257,7 @@ func TestListClients(t *testing.T) {
 			token:    "",
 			offset:   offset,
 			limit:    limit,
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedList, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedList), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -265,7 +265,7 @@ func TestListClients(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    0,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrLimitSize, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrLimitSize), http.StatusInternalServerError),
 			response: nil,
 		},
 		{
@@ -273,7 +273,7 @@ func TestListClients(t *testing.T) {
 			token:    token,
 			offset:   offset,
 			limit:    110,
-			err:      errors.NewSDKErrorWithStatus(apiutil.ErrLimitSize, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, apiutil.ErrLimitSize), http.StatusInternalServerError),
 			response: []sdk.User(nil),
 		},
 		{
@@ -484,7 +484,7 @@ func TestListMembers(t *testing.T) {
 			groupID:  testsutil.GenerateUUID(t, idProvider),
 			page:     sdk.PageMetadata{},
 			response: []sdk.User(nil),
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:     "list clients with an invalid id",
@@ -497,6 +497,10 @@ func TestListMembers(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		fmt.Println()
+		fmt.Println(tc.desc)
+		fmt.Println()
+
 		repoCall := pRepo.On("CheckAdmin", mock.Anything, mock.Anything).Return(nil)
 		repoCall1 := cRepo.On("Members", mock.Anything, tc.groupID, mock.Anything).Return(mfclients.MembersPage{Members: convertClients(tc.response)}, tc.err)
 		membersPage, err := mfsdk.Members(tc.groupID, tc.page, tc.token)
@@ -553,7 +557,7 @@ func TestClient(t *testing.T) {
 			response: sdk.User{},
 			token:    invalidToken,
 			clientID: generateUUID(t),
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:     "view client with valid token and invalid client id",
@@ -567,7 +571,7 @@ func TestClient(t *testing.T) {
 			response: sdk.User{},
 			token:    invalidToken,
 			clientID: mocks.WrongID,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 	}
 
@@ -628,7 +632,7 @@ func TestProfile(t *testing.T) {
 			desc:     "view client with an invalid token",
 			response: sdk.User{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 	}
 
@@ -695,14 +699,14 @@ func TestUpdateClient(t *testing.T) {
 			client:   client1,
 			response: sdk.User{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:     "update client name with invalid id",
 			client:   client2,
 			response: sdk.User{},
 			token:    generateValidToken(t, svc, cRepo),
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedUpdate, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedUpdate), http.StatusInternalServerError),
 		},
 		{
 			desc: "update a user that can't be marshalled",
@@ -786,14 +790,14 @@ func TestUpdateClientTags(t *testing.T) {
 			client:   client1,
 			response: sdk.User{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:     "update client name with invalid id",
 			client:   client2,
 			response: sdk.User{},
 			token:    generateValidToken(t, svc, cRepo),
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedUpdate, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedUpdate), http.StatusInternalServerError),
 		},
 		{
 			desc: "update a user that can't be marshalled",
@@ -876,14 +880,14 @@ func TestUpdateClientIdentity(t *testing.T) {
 			client:   user,
 			response: sdk.User{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:     "update client name with invalid id",
 			client:   client2,
 			response: sdk.User{},
 			token:    generateValidToken(t, svc, cRepo),
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedUpdate, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedUpdate), http.StatusInternalServerError),
 		},
 		{
 			desc: "update a user that can't be marshalled",
@@ -899,7 +903,7 @@ func TestUpdateClientIdentity(t *testing.T) {
 			},
 			response: sdk.User{},
 			token:    generateValidToken(t, svc, cRepo),
-			err:      errors.NewSDKErrorWithStatus(fmt.Errorf("json: unsupported type: chan int"), http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, fmt.Errorf("json: unsupported type: chan int")), http.StatusInternalServerError),
 		},
 	}
 
@@ -950,6 +954,7 @@ func TestUpdateClientSecret(t *testing.T) {
 		token     string
 		response  sdk.User
 		err       error
+		repoErr   error
 	}{
 		{
 			desc:      "update client secret with valid token",
@@ -957,6 +962,7 @@ func TestUpdateClientSecret(t *testing.T) {
 			newSecret: "newSecret",
 			token:     token.AccessToken,
 			response:  rclient,
+			repoErr:   nil,
 			err:       nil,
 		},
 		{
@@ -965,7 +971,8 @@ func TestUpdateClientSecret(t *testing.T) {
 			newSecret: "newPassword",
 			token:     "non-existent",
 			response:  sdk.User{},
-			err:       errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			repoErr:   errors.ErrAuthentication,
+			err:       errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:      "update client secret with wrong old secret",
@@ -973,14 +980,15 @@ func TestUpdateClientSecret(t *testing.T) {
 			newSecret: "newSecret",
 			token:     token.AccessToken,
 			response:  sdk.User{},
+			repoErr:   apiutil.ErrInvalidSecret,
 			err:       errors.NewSDKErrorWithStatus(apiutil.ErrInvalidSecret, http.StatusBadRequest),
 		},
 	}
 
 	for _, tc := range cases {
-		repoCall := cRepo.On("RetrieveByID", mock.Anything, user.ID).Return(convertClient(tc.response), tc.err)
-		repoCall1 := cRepo.On("RetrieveByIdentity", mock.Anything, user.Credentials.Identity).Return(convertClient(tc.response), tc.err)
-		repoCall2 := cRepo.On("UpdateSecret", mock.Anything, mock.Anything).Return(convertClient(tc.response), tc.err)
+		repoCall := cRepo.On("RetrieveByID", mock.Anything, user.ID).Return(convertClient(tc.response), tc.repoErr)
+		repoCall1 := cRepo.On("RetrieveByIdentity", mock.Anything, user.Credentials.Identity).Return(convertClient(tc.response), tc.repoErr)
+		repoCall2 := cRepo.On("UpdateSecret", mock.Anything, mock.Anything).Return(convertClient(tc.response), tc.repoErr)
 		uClient, err := mfsdk.UpdatePassword(tc.oldSecret, tc.newSecret, tc.token)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		assert.Equal(t, tc.response, uClient, fmt.Sprintf("%s: expected %v got %v\n", tc.desc, tc.response, uClient))
@@ -1044,14 +1052,14 @@ func TestUpdateClientOwner(t *testing.T) {
 			client:   client2,
 			response: sdk.User{},
 			token:    invalidToken,
-			err:      errors.NewSDKErrorWithStatus(errors.ErrAuthentication, http.StatusUnauthorized),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(errors.ErrAuthentication, sdk.ErrInvalidJWT), http.StatusUnauthorized),
 		},
 		{
 			desc:     "update client name with invalid id",
 			client:   client2,
 			response: sdk.User{},
 			token:    generateValidToken(t, svc, cRepo),
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedUpdate, http.StatusInternalServerError),
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(apiutil.ErrValidation, sdk.ErrFailedUpdate), http.StatusInternalServerError),
 		},
 		{
 			desc: "update a user that can't be marshalled",
@@ -1113,6 +1121,7 @@ func TestEnableClient(t *testing.T) {
 		token    string
 		client   sdk.User
 		response sdk.User
+		repoErr  error
 		err      errors.SDKError
 	}{
 		{
@@ -1121,6 +1130,7 @@ func TestEnableClient(t *testing.T) {
 			token:    generateValidToken(t, svc, cRepo),
 			client:   disabledClient1,
 			response: endisabledClient1,
+			repoErr:  nil,
 			err:      nil,
 		},
 		{
@@ -1129,7 +1139,8 @@ func TestEnableClient(t *testing.T) {
 			token:    generateValidToken(t, svc, cRepo),
 			client:   enabledClient1,
 			response: sdk.User{},
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedEnable, http.StatusInternalServerError),
+			repoErr:  sdk.ErrFailedEnable,
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(sdk.ErrFailedEnable, sdk.ErrFailedEnable), http.StatusInternalServerError),
 		},
 		{
 			desc:     "enable non-existing client",
@@ -1137,14 +1148,15 @@ func TestEnableClient(t *testing.T) {
 			token:    generateValidToken(t, svc, cRepo),
 			client:   sdk.User{},
 			response: sdk.User{},
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedEnable, http.StatusNotFound),
+			repoErr:  sdk.ErrFailedEnable,
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(sdk.ErrFailedEnable, errors.ErrNotFound), http.StatusNotFound),
 		},
 	}
 
 	for _, tc := range cases {
 		repoCall := pRepo.On("CheckAdmin", mock.Anything, mock.Anything).Return(nil)
-		repoCall1 := cRepo.On("RetrieveByID", mock.Anything, tc.id).Return(convertClient(tc.client), tc.err)
-		repoCall2 := cRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(convertClient(tc.response), tc.err)
+		repoCall1 := cRepo.On("RetrieveByID", mock.Anything, tc.id).Return(convertClient(tc.client), tc.repoErr)
+		repoCall2 := cRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(convertClient(tc.response), tc.repoErr)
 		eClient, err := mfsdk.EnableUser(tc.id, tc.token)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		assert.Equal(t, tc.response, eClient, fmt.Sprintf("%s: expected %v got %v\n", tc.desc, tc.response, eClient))
@@ -1239,6 +1251,7 @@ func TestDisableClient(t *testing.T) {
 		token    string
 		client   sdk.User
 		response sdk.User
+		repoErr  error
 		err      errors.SDKError
 	}{
 		{
@@ -1248,6 +1261,7 @@ func TestDisableClient(t *testing.T) {
 			client:   enabledClient1,
 			response: disenabledClient1,
 			err:      nil,
+			repoErr:  nil,
 		},
 		{
 			desc:     "disable disabled client",
@@ -1255,7 +1269,8 @@ func TestDisableClient(t *testing.T) {
 			token:    generateValidToken(t, svc, cRepo),
 			client:   disabledClient1,
 			response: sdk.User{},
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedDisable, http.StatusInternalServerError),
+			repoErr:  sdk.ErrFailedDisable,
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(sdk.ErrFailedDisable, sdk.ErrFailedDisable), http.StatusInternalServerError),
 		},
 		{
 			desc:     "disable non-existing client",
@@ -1263,14 +1278,15 @@ func TestDisableClient(t *testing.T) {
 			client:   sdk.User{},
 			token:    generateValidToken(t, svc, cRepo),
 			response: sdk.User{},
-			err:      errors.NewSDKErrorWithStatus(sdk.ErrFailedDisable, http.StatusNotFound),
+			repoErr:  sdk.ErrFailedDisable,
+			err:      errors.NewSDKErrorWithStatus(errors.Wrap(sdk.ErrFailedDisable, errors.ErrNotFound), http.StatusNotFound),
 		},
 	}
 
 	for _, tc := range cases {
 		repoCall := pRepo.On("CheckAdmin", mock.Anything, mock.Anything).Return(nil)
-		repoCall1 := cRepo.On("RetrieveByID", mock.Anything, tc.id).Return(convertClient(tc.client), tc.err)
-		repoCall2 := cRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(convertClient(tc.response), tc.err)
+		repoCall1 := cRepo.On("RetrieveByID", mock.Anything, tc.id).Return(convertClient(tc.client), tc.repoErr)
+		repoCall2 := cRepo.On("ChangeStatus", mock.Anything, mock.Anything).Return(convertClient(tc.response), tc.repoErr)
 		dClient, err := mfsdk.DisableUser(tc.id, tc.token)
 		assert.Equal(t, tc.err, err, fmt.Sprintf("%s: expected error %s, got %s", tc.desc, tc.err, err))
 		assert.Equal(t, tc.response, dClient, fmt.Sprintf("%s: expected %v got %v\n", tc.desc, tc.response, dClient))

provision/api/endpoint.go

@@ -4,6 +4,8 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/provision"
 )
 
@@ -11,12 +13,11 @@ func doProvision(svc provision.Service) endpoint.Endpoint {
 	return func(_ context.Context, request interface{}) (interface{}, error) {
 		req := request.(provisionReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		token := req.token
 
 		res, err := svc.Provision(token, req.Name, req.ExternalID, req.ExternalKey)
-
 		if err != nil {
 			return provisionRes{Error: err.Error()}, nil
 		}
@@ -39,7 +40,7 @@ func getMapping(svc provision.Service) endpoint.Endpoint {
 	return func(_ context.Context, request interface{}) (interface{}, error) {
 		req := request.(mappingReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		return svc.Mapping(req.token)
 	}

provision/api/transport.go

@@ -3,6 +3,7 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 
 	kithttp "github.com/go-kit/kit/transport/http"
@@ -68,12 +69,12 @@ func encodeResponse(_ context.Context, w http.ResponseWriter, response interface
 
 func decodeProvisionRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	if r.Header.Get("Content-Type") != contentType {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := provisionReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	return req, nil
@@ -81,7 +82,7 @@ func decodeProvisionRequest(_ context.Context, r *http.Request) (interface{}, er
 
 func decodeMappingRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	if r.Header.Get("Content-Type") != contentType {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := mappingReq{token: apiutil.ExtractBearerToken(r)}
@@ -90,26 +91,40 @@ func decodeMappingRequest(_ context.Context, r *http.Request) (interface{}, erro
 }
 
 func encodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	switch {
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerToken:
+		errors.Contains(err, apiutil.ErrBearerToken):
 		w.WriteHeader(http.StatusUnauthorized)
-	case errors.Contains(err, errors.ErrUnsupportedContentType):
+	case errors.Contains(err, apiutil.ErrUnsupportedContentType):
 		w.WriteHeader(http.StatusUnsupportedMediaType)
 	case errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrMissingID,
-		err == apiutil.ErrBearerKey:
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrBearerKey):
 		w.WriteHeader(http.StatusBadRequest)
 	case errors.Contains(err, errors.ErrConflict):
 		w.WriteHeader(http.StatusConflict)
-
 	default:
 		w.WriteHeader(http.StatusInternalServerError)
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
 		w.Header().Set("Content-Type", contentType)
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

readers/api/endpoint.go

@@ -7,6 +7,7 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
 	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/readers"
 	tpolicies "github.com/mainflux/mainflux/things/policies"
@@ -18,10 +19,10 @@ func listMessagesEndpoint(svc readers.MessageRepository, tc tpolicies.AuthServic
 		req := request.(listMessagesReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		if err := authorize(ctx, req, tc, ac); err != nil {
-			return nil, errors.Wrap(errors.ErrAuthorization, err)
+			return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrAuthorization, err))
 		}
 		page, err := svc.ReadAll(req.chanID, req.pageMeta)
 		if err != nil {

readers/api/transport.go

@@ -6,6 +6,7 @@ package api
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 
 	kithttp "github.com/go-kit/kit/transport/http"
@@ -71,72 +72,72 @@ func MakeHandler(svc readers.MessageRepository, tc tpolicies.AuthServiceClient,
 func decodeList(_ context.Context, r *http.Request) (interface{}, error) {
 	offset, err := apiutil.ReadUintQuery(r, offsetKey, defOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	limit, err := apiutil.ReadUintQuery(r, limitKey, defLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	format, err := apiutil.ReadStringQuery(r, formatKey, defFormat)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	subtopic, err := apiutil.ReadStringQuery(r, subtopicKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	publisher, err := apiutil.ReadStringQuery(r, publisherKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	protocol, err := apiutil.ReadStringQuery(r, protocolKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	name, err := apiutil.ReadStringQuery(r, nameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	v, err := apiutil.ReadFloatQuery(r, valueKey, 0)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	comparator, err := apiutil.ReadStringQuery(r, comparatorKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	vs, err := apiutil.ReadStringQuery(r, stringValueKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	vd, err := apiutil.ReadStringQuery(r, dataValueKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	vb, err := apiutil.ReadBoolQuery(r, boolValueKey, false)
-	if err != nil && err != errors.ErrNotFoundParam {
+	if err != nil && err != apiutil.ErrNotFoundParam {
 		return nil, err
 	}
 
 	from, err := apiutil.ReadFloatQuery(r, fromKey, 0)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	to, err := apiutil.ReadFloatQuery(r, toKey, 0)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	req := listMessagesReq{
@@ -183,28 +184,42 @@ func encodeResponse(_ context.Context, w http.ResponseWriter, response interface
 }
 
 func encodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	switch {
 	case errors.Contains(err, nil):
-	case errors.Contains(err, errors.ErrInvalidQueryParams),
+	case errors.Contains(err, apiutil.ErrInvalidQueryParams),
 		errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrMissingID,
-		err == apiutil.ErrLimitSize,
-		err == apiutil.ErrOffsetSize,
-		err == apiutil.ErrInvalidComparator:
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrLimitSize),
+		errors.Contains(err, apiutil.ErrOffsetSize),
+		errors.Contains(err, apiutil.ErrInvalidComparator):
 		w.WriteHeader(http.StatusBadRequest)
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerToken:
+		errors.Contains(err, apiutil.ErrBearerToken):
 		w.WriteHeader(http.StatusUnauthorized)
 	case errors.Contains(err, readers.ErrReadMessages):
 		w.WriteHeader(http.StatusInternalServerError)
-
 	default:
 		w.WriteHeader(http.StatusInternalServerError)
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
 		w.Header().Set("Content-Type", contentType)
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

things/clients/api/endpoints.go

@@ -7,7 +7,9 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
 	mfclients "github.com/mainflux/mainflux/pkg/clients"
+	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/things/clients"
 )
 
@@ -15,7 +17,7 @@ func createClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(createClientReq)
 		if err := req.validate(); err != nil {
-			return createClientRes{}, err
+			return createClientRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.CreateThings(ctx, req.token, req.client)
 		if err != nil {
@@ -34,7 +36,7 @@ func createClientsEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(createClientsReq)
 		if err := req.validate(); err != nil {
-			return clientsPageRes{}, err
+			return clientsPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		page, err := svc.CreateThings(ctx, req.token, req.Clients...)
 		if err != nil {
@@ -57,7 +59,7 @@ func viewClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(viewClientReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		c, err := svc.ViewClient(ctx, req.token, req.id)
@@ -72,7 +74,7 @@ func listClientsEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listClientsReq)
 		if err := req.validate(); err != nil {
-			return mfclients.ClientsPage{}, err
+			return mfclients.ClientsPage{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		pm := mfclients.Page{
@@ -110,7 +112,7 @@ func listMembersEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listMembersReq)
 		if err := req.validate(); err != nil {
-			return memberPageRes{}, err
+			return memberPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		page, err := svc.ListClientsByGroup(ctx, req.token, req.groupID, req.Page)
 		if err != nil {
@@ -124,7 +126,7 @@ func updateClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		cli := mfclients.Client{
@@ -144,7 +146,7 @@ func updateClientTagsEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientTagsReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		cli := mfclients.Client{
@@ -163,11 +165,12 @@ func updateClientSecretEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientCredentialsReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.UpdateClientSecret(ctx, req.token, req.id, req.Secret)
 		if err != nil {
 			return nil, err
+
 		}
 		return updateClientRes{Client: client}, nil
 	}
@@ -177,7 +180,7 @@ func updateClientOwnerEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientOwnerReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		cli := mfclients.Client{
@@ -197,7 +200,7 @@ func enableClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(changeClientStatusReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.EnableClient(ctx, req.token, req.id)
 		if err != nil {
@@ -211,7 +214,7 @@ func disableClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(changeClientStatusReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.DisableClient(ctx, req.token, req.id)
 		if err != nil {

things/clients/api/transport.go

@@ -123,27 +123,27 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
 	var sharedID, ownerID string
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefClientStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	o, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	l, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	m, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	n, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	t, err := apiutil.ReadStringQuery(r, api.TagKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	oid, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
@@ -151,7 +151,7 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
 	}
 	visibility, err := apiutil.ReadStringQuery(r, api.VisibilityKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	switch visibility {
 	case api.MyVisibility:
@@ -167,7 +167,7 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listClientsReq{
 		token:    apiutil.ExtractBearerToken(r),
@@ -185,14 +185,14 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeUpdateClient(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientReq{
 		token: apiutil.ExtractBearerToken(r),
 		id:    bone.GetValue(r, "thingID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -200,14 +200,14 @@ func decodeUpdateClient(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeUpdateClientTags(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientTagsReq{
 		token: apiutil.ExtractBearerToken(r),
 		id:    bone.GetValue(r, "thingID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -215,14 +215,14 @@ func decodeUpdateClientTags(_ context.Context, r *http.Request) (interface{}, er
 
 func decodeUpdateClientCredentials(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientCredentialsReq{
 		token: apiutil.ExtractBearerToken(r),
 		id:    bone.GetValue(r, "thingID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -230,14 +230,14 @@ func decodeUpdateClientCredentials(_ context.Context, r *http.Request) (interfac
 
 func decodeUpdateClientOwner(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientOwnerReq{
 		token: apiutil.ExtractBearerToken(r),
 		id:    bone.GetValue(r, "thingID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -245,12 +245,12 @@ func decodeUpdateClientOwner(_ context.Context, r *http.Request) (interface{}, e
 
 func decodeCreateClientReq(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	var c mfclients.Client
 	if err := json.NewDecoder(r.Body).Decode(&c); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 	req := createClientReq{
 		client: c,
@@ -262,12 +262,12 @@ func decodeCreateClientReq(_ context.Context, r *http.Request) (interface{}, err
 
 func decodeCreateClientsReq(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	c := createClientsReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&c.Clients); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return c, nil
@@ -285,23 +285,23 @@ func decodeChangeClientStatus(_ context.Context, r *http.Request) (interface{},
 func decodeListMembersRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefClientStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	o, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	l, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	m, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listMembersReq{
 		token: apiutil.ExtractBearerToken(r),

things/clients/service.go

@@ -80,6 +80,7 @@ func (svc service) CreateThings(ctx context.Context, token string, clis ...mfcli
 		cli.CreatedAt = time.Now()
 		clients = append(clients, cli)
 	}
+
 	return svc.clients.Save(ctx, clients...)
 }
 
@@ -309,7 +310,7 @@ func (svc service) identify(ctx context.Context, token string) (string, error) {
 	req := &upolicies.IdentifyReq{Token: token}
 	res, err := svc.uauth.Identify(ctx, req)
 	if err != nil {
-		return "", errors.Wrap(errors.ErrAuthentication, err)
+		return "", err
 	}
 	return res.GetId(), nil
 }
@@ -336,7 +337,7 @@ func (svc service) checkAdmin(ctx context.Context, subject, object, action strin
 	}
 	res, err := svc.uauth.Authorize(ctx, req)
 	if err != nil {
-		return errors.Wrap(errors.ErrAuthorization, err)
+		return err
 	}
 	if !res.GetAuthorized() {
 		return errors.ErrAuthorization

things/groups/api/endpoints.go

@@ -7,6 +7,8 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 	mfgroups "github.com/mainflux/mainflux/pkg/groups"
 	"github.com/mainflux/mainflux/things/groups"
 )
@@ -15,7 +17,7 @@ func createGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(createGroupReq)
 		if err := req.validate(); err != nil {
-			return createGroupRes{}, err
+			return createGroupRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		group, err := svc.CreateGroups(ctx, req.token, req.Group)
@@ -31,7 +33,7 @@ func createGroupsEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(createGroupsReq)
 		if err := req.validate(); err != nil {
-			return groupPageRes{}, err
+			return groupPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		gs, err := svc.CreateGroups(ctx, req.token, req.Groups...)
@@ -46,7 +48,7 @@ func viewGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(groupReq)
 		if err := req.validate(); err != nil {
-			return viewGroupRes{}, err
+			return viewGroupRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		group, err := svc.ViewGroup(ctx, req.token, req.id)
@@ -62,7 +64,7 @@ func updateGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateGroupReq)
 		if err := req.validate(); err != nil {
-			return updateGroupRes{}, err
+			return updateGroupRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		group := mfgroups.Group{
@@ -85,7 +87,7 @@ func enableGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(changeGroupStatusReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		group, err := svc.EnableGroup(ctx, req.token, req.id)
 		if err != nil {
@@ -99,7 +101,7 @@ func disableGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(changeGroupStatusReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		group, err := svc.DisableGroup(ctx, req.token, req.id)
 		if err != nil {
@@ -113,7 +115,7 @@ func listGroupsEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listGroupsReq)
 		if err := req.validate(); err != nil {
-			return groupPageRes{}, err
+			return groupPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		page, err := svc.ListGroups(ctx, req.token, req.GroupsPage)
 		if err != nil {
@@ -132,7 +134,7 @@ func listMembershipsEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listMembershipReq)
 		if err := req.validate(); err != nil {
-			return membershipPageRes{}, err
+			return membershipPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		page, err := svc.ListMemberships(ctx, req.token, req.clientID, req.GroupsPage)

things/groups/api/transport.go

@@ -88,43 +88,43 @@ func MakeHandler(svc groups.Service, mux *bone.Mux, logger logger.Logger) http.H
 func decodeListMembershipRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefGroupStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	level, err := apiutil.ReadNumQuery[uint64](r, api.LevelKey, api.DefLevel)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	offset, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	limit, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	parentID, err := apiutil.ReadStringQuery(r, api.ParentKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	ownerID, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	name, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	meta, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	dir, err := apiutil.ReadNumQuery[int64](r, api.DirKey, -1)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listMembershipReq{
 		token:    apiutil.ExtractBearerToken(r),
@@ -150,48 +150,49 @@ func decodeListMembershipRequest(_ context.Context, r *http.Request) (interface{
 func decodeListGroupsRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefGroupStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	level, err := apiutil.ReadNumQuery[uint64](r, api.LevelKey, api.DefLevel)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	offset, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	limit, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	parentID, err := apiutil.ReadStringQuery(r, api.ParentKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	ownerID, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	name, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	meta, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	tree, err := apiutil.ReadBoolQuery(r, api.TreeKey, false)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	dir, err := apiutil.ReadNumQuery[int64](r, api.DirKey, -1)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
+
 	req := listGroupsReq{
 		token: apiutil.ExtractBearerToken(r),
 		tree:  tree,
@@ -214,11 +215,11 @@ func decodeListGroupsRequest(_ context.Context, r *http.Request) (interface{}, e
 
 func decodeGroupCreate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	var g mfgroups.Group
 	if err := json.NewDecoder(r.Body).Decode(&g); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 	req := createGroupReq{
 		Group: g,
@@ -230,11 +231,11 @@ func decodeGroupCreate(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeGroupsCreate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := createGroupsReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req.Groups); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -242,14 +243,14 @@ func decodeGroupsCreate(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeGroupUpdate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateGroupReq{
 		id:    bone.GetValue(r, "chanID"),
 		token: apiutil.ExtractBearerToken(r),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 	return req, nil
 }

things/groups/service.go

@@ -214,7 +214,7 @@ func (svc service) checkAdmin(ctx context.Context, subject, object, action strin
 	}
 	res, err := svc.uauth.Authorize(ctx, req)
 	if err != nil {
-		return errors.Wrap(errors.ErrAuthorization, err)
+		return err
 	}
 	if !res.GetAuthorized() {
 		return errors.ErrAuthorization

things/policies/api/grpc/endpoint.go

@@ -7,6 +7,8 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/things/clients"
 	"github.com/mainflux/mainflux/things/policies"
 )
@@ -40,7 +42,7 @@ func identifyEndpoint(svc clients.Service) endpoint.Endpoint {
 		}
 		id, err := svc.Identify(ctx, req.secret)
 		if err != nil {
-			return identityRes{}, err
+			return identityRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		return identityRes{id: id}, nil
 	}

things/policies/api/grpc/transport.go

@@ -82,17 +82,17 @@ func encodeError(err error) error {
 	case errors.Contains(err, nil):
 		return nil
 	case errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrInvalidAuthKey,
-		err == apiutil.ErrMissingID,
-		err == apiutil.ErrMissingPolicySub,
-		err == apiutil.ErrMissingPolicyObj,
-		err == apiutil.ErrMalformedPolicyAct,
-		err == apiutil.ErrMalformedPolicy,
-		err == apiutil.ErrMissingPolicyOwner,
-		err == apiutil.ErrBearerKey:
+		errors.Contains(err, apiutil.ErrInvalidAuthKey),
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrMissingPolicySub),
+		errors.Contains(err, apiutil.ErrMissingPolicyObj),
+		errors.Contains(err, apiutil.ErrMalformedPolicyAct),
+		errors.Contains(err, apiutil.ErrMalformedPolicy),
+		errors.Contains(err, apiutil.ErrMissingPolicyOwner),
+		errors.Contains(err, apiutil.ErrBearerKey):
 		return status.Error(codes.InvalidArgument, err.Error())
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerToken:
+		errors.Contains(err, apiutil.ErrBearerToken):
 		return status.Error(codes.Unauthenticated, err.Error())
 	case errors.Contains(err, errors.ErrAuthorization):
 		return status.Error(codes.PermissionDenied, err.Error())

things/policies/api/http/endpoints.go

@@ -7,6 +7,8 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/things/clients"
 	"github.com/mainflux/mainflux/things/policies"
 )
@@ -15,7 +17,7 @@ func identifyEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(identifyReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		id, err := svc.Identify(ctx, req.secret)
@@ -53,7 +55,7 @@ func connectEndpoint(svc policies.Service) endpoint.Endpoint {
 		cr := request.(createPolicyReq)
 
 		if err := cr.validate(); err != nil {
-			return addPolicyRes{}, err
+			return addPolicyRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		if len(cr.Actions) == 0 {
 			cr.Actions = policies.PolicyTypes
@@ -77,7 +79,7 @@ func connectThingsEndpoint(svc policies.Service) endpoint.Endpoint {
 		cr := request.(createPoliciesReq)
 
 		if err := cr.validate(); err != nil {
-			return listPolicyRes{}, err
+			return listPolicyRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		if len(cr.Actions) == 0 {
 			cr.Actions = policies.PolicyTypes
@@ -129,7 +131,7 @@ func listPoliciesEndpoint(svc policies.Service) endpoint.Endpoint {
 		lpr := request.(listPoliciesReq)
 
 		if err := lpr.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		pm := policies.Page{
 			Limit:   lpr.limit,

things/policies/api/http/transport.go

@@ -87,12 +87,12 @@ func MakeHandler(csvc clients.Service, psvc policies.Service, mux *bone.Mux, log
 
 func decodeConnectThing(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, apiutil.ErrUnsupportedContentType
 	}
 
 	req := createPolicyReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -110,11 +110,11 @@ func decodeDisconnectThing(_ context.Context, r *http.Request) (interface{}, err
 
 func decodeConnectList(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := createPoliciesReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -122,7 +122,7 @@ func decodeConnectList(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeIdentify(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := identifyReq{secret: apiutil.ExtractThingKey(r)}
@@ -132,12 +132,12 @@ func decodeIdentify(_ context.Context, r *http.Request) (interface{}, error) {
 
 func decodeCanAccess(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := authorizeReq{Object: bone.GetValue(r, "chanID")}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -145,11 +145,11 @@ func decodeCanAccess(_ context.Context, r *http.Request) (interface{}, error) {
 
 func decodeUpdatePolicy(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := policyReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -158,27 +158,27 @@ func decodeUpdatePolicy(_ context.Context, r *http.Request) (interface{}, error)
 func decodeListPolicies(_ context.Context, r *http.Request) (interface{}, error) {
 	o, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	l, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	c, err := apiutil.ReadStringQuery(r, api.ClientKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	g, err := apiutil.ReadStringQuery(r, api.GroupKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	a, err := apiutil.ReadStringQuery(r, api.ActionKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	oid, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	req := listPoliciesReq{

things/policies/service.go

@@ -278,7 +278,7 @@ func (svc service) usersAuthorize(ctx context.Context, subject, object, action,
 	}
 	res, err := svc.auth.Authorize(ctx, req)
 	if err != nil {
-		return errors.Wrap(errors.ErrAuthorization, err)
+		return err
 	}
 	if !res.GetAuthorized() {
 		return errors.ErrAuthorization

twins/api/http/endpoint.go

@@ -7,15 +7,16 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/twins"
 )
 
 func addTwinEndpoint(svc twins.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(addTwinReq)
-
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		twin := twins.Twin{
@@ -40,7 +41,7 @@ func updateTwinEndpoint(svc twins.Service) endpoint.Endpoint {
 		req := request.(updateTwinReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		twin := twins.Twin{
@@ -63,7 +64,7 @@ func viewTwinEndpoint(svc twins.Service) endpoint.Endpoint {
 		req := request.(viewTwinReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		twin, err := svc.ViewTwin(ctx, req.token, req.id)
@@ -90,7 +91,7 @@ func listTwinsEndpoint(svc twins.Service) endpoint.Endpoint {
 		req := request.(listReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		page, err := svc.ListTwins(ctx, req.token, req.offset, req.limit, req.name, req.metadata)
@@ -130,7 +131,7 @@ func removeTwinEndpoint(svc twins.Service) endpoint.Endpoint {
 
 		err := req.validate()
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		if err := svc.RemoveTwin(ctx, req.token, req.id); err != nil {
@@ -146,7 +147,7 @@ func listStatesEndpoint(svc twins.Service) endpoint.Endpoint {
 		req := request.(listStatesReq)
 
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		page, err := svc.ListStates(ctx, req.token, req.offset, req.limit, req.id)

twins/api/http/transport.go

@@ -6,6 +6,7 @@ package http
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -88,12 +89,12 @@ func MakeHandler(svc twins.Service, logger logger.Logger, instanceID string) htt
 
 func decodeTwinCreation(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), contentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := addTwinReq{token: apiutil.ExtractBearerToken(r)}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(errors.ErrMalformedEntity, err))
 	}
 
 	return req, nil
@@ -101,7 +102,7 @@ func decodeTwinCreation(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeTwinUpdate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), contentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	req := updateTwinReq{
@@ -109,7 +110,7 @@ func decodeTwinUpdate(_ context.Context, r *http.Request) (interface{}, error) {
 		id:    bone.GetValue(r, "twinID"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -127,22 +128,22 @@ func decodeView(_ context.Context, r *http.Request) (interface{}, error) {
 func decodeList(_ context.Context, r *http.Request) (interface{}, error) {
 	l, err := apiutil.ReadUintQuery(r, limitKey, defLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	o, err := apiutil.ReadUintQuery(r, offsetKey, defOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	n, err := apiutil.ReadStringQuery(r, nameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	m, err := apiutil.ReadMetadataQuery(r, metadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	req := listReq{
@@ -159,12 +160,12 @@ func decodeList(_ context.Context, r *http.Request) (interface{}, error) {
 func decodeListStates(_ context.Context, r *http.Request) (interface{}, error) {
 	l, err := apiutil.ReadUintQuery(r, limitKey, defLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	o, err := apiutil.ReadUintQuery(r, offsetKey, defOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	req := listStatesReq{
@@ -196,18 +197,23 @@ func encodeResponse(_ context.Context, w http.ResponseWriter, response interface
 }
 
 func encodeError(_ context.Context, err error, w http.ResponseWriter) {
+	var wrapper error
+	if errors.Contains(err, apiutil.ErrValidation) {
+		wrapper, err = errors.Unwrap(err)
+	}
+
 	switch {
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerToken:
+		errors.Contains(err, apiutil.ErrBearerToken):
 		w.WriteHeader(http.StatusUnauthorized)
-	case errors.Contains(err, errors.ErrInvalidQueryParams):
+	case errors.Contains(err, apiutil.ErrInvalidQueryParams):
 		w.WriteHeader(http.StatusBadRequest)
-	case errors.Contains(err, errors.ErrUnsupportedContentType):
+	case errors.Contains(err, apiutil.ErrUnsupportedContentType):
 		w.WriteHeader(http.StatusUnsupportedMediaType)
 	case errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrMissingID,
-		err == apiutil.ErrNameSize,
-		err == apiutil.ErrLimitSize:
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrNameSize),
+		errors.Contains(err, apiutil.ErrLimitSize):
 		w.WriteHeader(http.StatusBadRequest)
 	case errors.Contains(err, errors.ErrNotFound):
 		w.WriteHeader(http.StatusNotFound)
@@ -224,9 +230,19 @@ func encodeError(_ context.Context, err error, w http.ResponseWriter) {
 		w.WriteHeader(http.StatusInternalServerError)
 	}
 
+	if wrapper != nil {
+		err = errors.Wrap(wrapper, err)
+	}
+
 	if errorVal, ok := err.(errors.Error); ok {
 		w.Header().Set("Content-Type", contentType)
-		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errorVal.Msg()}); err != nil {
+
+		errMsg := errorVal.Msg()
+		if errorVal.Err() != nil {
+			errMsg = fmt.Sprintf("%s : %s", errMsg, errorVal.Err().Msg())
+		}
+
+		if err := json.NewEncoder(w).Encode(apiutil.ErrorRes{Err: errMsg}); err != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	}

users/clients/api/endpoints.go

@@ -7,7 +7,9 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
 	mfclients "github.com/mainflux/mainflux/pkg/clients"
+	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/users/clients"
 )
 
@@ -15,7 +17,7 @@ func registrationEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(createClientReq)
 		if err := req.validate(); err != nil {
-			return createClientRes{}, err
+			return createClientRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.RegisterClient(ctx, req.token, req.client)
 		if err != nil {
@@ -34,7 +36,7 @@ func viewClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(viewClientReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		client, err := svc.ViewClient(ctx, req.token, req.id)
@@ -49,7 +51,7 @@ func viewProfileEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(viewProfileReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		client, err := svc.ViewProfile(ctx, req.token)
@@ -66,7 +68,7 @@ func listClientsEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listClientsReq)
 		if err := req.validate(); err != nil {
-			return mfclients.ClientsPage{}, err
+			return mfclients.ClientsPage{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		pm := mfclients.Page{
@@ -105,7 +107,7 @@ func listMembersEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listMembersReq)
 		if err := req.validate(); err != nil {
-			return memberPageRes{}, err
+			return memberPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		page, err := svc.ListMembers(ctx, req.token, req.groupID, req.Page)
 		if err != nil {
@@ -119,7 +121,7 @@ func updateClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		client := mfclients.Client{
@@ -139,7 +141,7 @@ func updateClientTagsEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientTagsReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		client := mfclients.Client{
@@ -158,7 +160,7 @@ func updateClientIdentityEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientIdentityReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.UpdateClientIdentity(ctx, req.token, req.id, req.Identity)
 		if err != nil {
@@ -182,7 +184,7 @@ func passwordResetRequestEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(passwResetReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		if err := svc.GenerateResetToken(ctx, req.Email, req.Host); err != nil {
 			return nil, err
@@ -199,7 +201,7 @@ func passwordResetEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(resetTokenReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		if err := svc.ResetSecret(ctx, req.Token, req.Password); err != nil {
 			return nil, err
@@ -212,7 +214,7 @@ func updateClientSecretEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientSecretReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.UpdateClientSecret(ctx, req.token, req.OldSecret, req.NewSecret)
 		if err != nil {
@@ -226,7 +228,7 @@ func updateClientOwnerEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateClientOwnerReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		client := mfclients.Client{
@@ -246,7 +248,7 @@ func issueTokenEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(loginClientReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		token, err := svc.IssueToken(ctx, req.Identity, req.Secret)
@@ -265,7 +267,7 @@ func refreshTokenEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(tokenReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		token, err := svc.RefreshToken(ctx, req.RefreshToken)
@@ -285,7 +287,7 @@ func enableClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(changeClientStatusReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.EnableClient(ctx, req.token, req.id)
 		if err != nil {
@@ -299,7 +301,7 @@ func disableClientEndpoint(svc clients.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(changeClientStatusReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		client, err := svc.DisableClient(ctx, req.token, req.id)
 		if err != nil {

users/clients/api/transport.go

@@ -165,32 +165,32 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
 	var sharedID, ownerID string
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefClientStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	o, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	l, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	m, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	n, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	i, err := apiutil.ReadStringQuery(r, api.IdentityKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	t, err := apiutil.ReadStringQuery(r, api.TagKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	oid, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
@@ -198,7 +198,7 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
 	}
 	visibility, err := apiutil.ReadStringQuery(r, api.VisibilityKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	switch visibility {
 	case api.MyVisibility:
@@ -214,7 +214,7 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listClientsReq{
 		token:    apiutil.ExtractBearerToken(r),
@@ -233,14 +233,14 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeUpdateClient(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientReq{
 		token: apiutil.ExtractBearerToken(r),
 		id:    bone.GetValue(r, "id"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -248,14 +248,14 @@ func decodeUpdateClient(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeUpdateClientTags(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientTagsReq{
 		token: apiutil.ExtractBearerToken(r),
 		id:    bone.GetValue(r, "id"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -263,14 +263,14 @@ func decodeUpdateClientTags(_ context.Context, r *http.Request) (interface{}, er
 
 func decodeUpdateClientIdentity(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientIdentityReq{
 		token: apiutil.ExtractBearerToken(r),
 		id:    bone.GetValue(r, "id"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -278,13 +278,13 @@ func decodeUpdateClientIdentity(_ context.Context, r *http.Request) (interface{}
 
 func decodeUpdateClientSecret(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientSecretReq{
 		token: apiutil.ExtractBearerToken(r),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -292,13 +292,13 @@ func decodeUpdateClientSecret(_ context.Context, r *http.Request) (interface{},
 
 func decodePasswordResetRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, apiutil.ErrUnsupportedContentType
 	}
 
 	var req passwResetReq
 
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	req.Host = r.Header.Get("Referer")
@@ -307,12 +307,12 @@ func decodePasswordResetRequest(_ context.Context, r *http.Request) (interface{}
 
 func decodePasswordReset(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	var req resetTokenReq
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -320,14 +320,14 @@ func decodePasswordReset(_ context.Context, r *http.Request) (interface{}, error
 
 func decodeUpdateClientOwner(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateClientOwnerReq{
 		token: apiutil.ExtractBearerToken(r),
 		id:    bone.GetValue(r, "id"),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -335,11 +335,11 @@ func decodeUpdateClientOwner(_ context.Context, r *http.Request) (interface{}, e
 
 func decodeCredentials(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := loginClientReq{}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return req, nil
@@ -352,12 +352,12 @@ func decodeRefreshToken(_ context.Context, r *http.Request) (interface{}, error)
 }
 func decodeCreateClientReq(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	var c mfclients.Client
 	if err := json.NewDecoder(r.Body).Decode(&c); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 	req := createClientReq{
 		client: c,
@@ -379,39 +379,39 @@ func decodeChangeClientStatus(_ context.Context, r *http.Request) (interface{},
 func decodeListMembersRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefClientStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	o, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	l, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	m, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	n, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	i, err := apiutil.ReadStringQuery(r, api.IdentityKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	t, err := apiutil.ReadStringQuery(r, api.TagKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	oid, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listMembersReq{
 		token: apiutil.ExtractBearerToken(r),

users/clients/service.go

@@ -466,7 +466,7 @@ func (svc service) authorize(ctx context.Context, subject, object, action string
 func (svc service) Identify(ctx context.Context, token string) (string, error) {
 	claims, err := svc.tokens.Parse(ctx, token)
 	if err != nil {
-		return "", errors.Wrap(errors.ErrAuthentication, err)
+		return "", err
 	}
 	if claims.Type != jwt.AccessToken {
 		return "", errors.ErrAuthentication

users/groups/api/endpoints.go

@@ -7,6 +7,8 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 	mfgroups "github.com/mainflux/mainflux/pkg/groups"
 	"github.com/mainflux/mainflux/users/groups"
 )
@@ -15,7 +17,7 @@ func createGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(createGroupReq)
 		if err := req.validate(); err != nil {
-			return createGroupRes{}, err
+			return createGroupRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		group, err := svc.CreateGroup(ctx, req.token, req.Group)
@@ -31,7 +33,7 @@ func viewGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(groupReq)
 		if err := req.validate(); err != nil {
-			return viewGroupRes{}, err
+			return viewGroupRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		group, err := svc.ViewGroup(ctx, req.token, req.id)
@@ -47,7 +49,7 @@ func updateGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updateGroupReq)
 		if err := req.validate(); err != nil {
-			return updateGroupRes{}, err
+			return updateGroupRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		group := mfgroups.Group{
@@ -70,7 +72,7 @@ func enableGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(changeGroupStatusReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		group, err := svc.EnableGroup(ctx, req.token, req.id)
 		if err != nil {
@@ -84,7 +86,7 @@ func disableGroupEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(changeGroupStatusReq)
 		if err := req.validate(); err != nil {
-			return nil, err
+			return nil, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		group, err := svc.DisableGroup(ctx, req.token, req.id)
 		if err != nil {
@@ -98,7 +100,7 @@ func listGroupsEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listGroupsReq)
 		if err := req.validate(); err != nil {
-			return groupPageRes{}, err
+			return groupPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		page, err := svc.ListGroups(ctx, req.token, req.GroupsPage)
 		if err != nil {
@@ -117,7 +119,7 @@ func listMembershipsEndpoint(svc groups.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listMembershipReq)
 		if err := req.validate(); err != nil {
-			return membershipPageRes{}, err
+			return membershipPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		page, err := svc.ListMemberships(ctx, req.token, req.clientID, req.GroupsPage)

users/groups/api/transport.go

@@ -95,43 +95,43 @@ func MakeHandler(svc groups.Service, mux *bone.Mux, logger logger.Logger) http.H
 func decodeListMembershipRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefGroupStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	level, err := apiutil.ReadNumQuery[uint64](r, api.LevelKey, api.DefLevel)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	offset, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	limit, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	parentID, err := apiutil.ReadStringQuery(r, api.ParentKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	ownerID, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	name, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	meta, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	dir, err := apiutil.ReadNumQuery[int64](r, api.DirKey, -1)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listMembershipReq{
 		token:    apiutil.ExtractBearerToken(r),
@@ -157,47 +157,47 @@ func decodeListMembershipRequest(_ context.Context, r *http.Request) (interface{
 func decodeListGroupsRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefGroupStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	level, err := apiutil.ReadNumQuery[uint64](r, api.LevelKey, api.DefLevel)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	offset, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	limit, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	parentID, err := apiutil.ReadStringQuery(r, api.ParentKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	ownerID, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	name, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	meta, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	tree, err := apiutil.ReadBoolQuery(r, api.TreeKey, false)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	dir, err := apiutil.ReadNumQuery[int64](r, api.DirKey, -1)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listGroupsReq{
 		token: apiutil.ExtractBearerToken(r),
@@ -222,39 +222,39 @@ func decodeListGroupsRequest(_ context.Context, r *http.Request) (interface{}, e
 func decodeListParentsRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefGroupStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	level, err := apiutil.ReadNumQuery[uint64](r, api.LevelKey, api.DefLevel)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	offset, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	limit, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	ownerID, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	name, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	meta, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	tree, err := apiutil.ReadBoolQuery(r, api.TreeKey, false)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listGroupsReq{
 		token: apiutil.ExtractBearerToken(r),
@@ -279,39 +279,39 @@ func decodeListParentsRequest(_ context.Context, r *http.Request) (interface{},
 func decodeListChildrenRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefGroupStatus)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	level, err := apiutil.ReadNumQuery[uint64](r, api.LevelKey, api.DefLevel)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	offset, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	limit, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	ownerID, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	name, err := apiutil.ReadStringQuery(r, api.NameKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	meta, err := apiutil.ReadMetadataQuery(r, api.MetadataKey, nil)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	tree, err := apiutil.ReadBoolQuery(r, api.TreeKey, false)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	st, err := mfclients.ToStatus(s)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	req := listGroupsReq{
 		token: apiutil.ExtractBearerToken(r),
@@ -335,11 +335,11 @@ func decodeListChildrenRequest(_ context.Context, r *http.Request) (interface{},
 
 func decodeGroupCreate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	var g mfgroups.Group
 	if err := json.NewDecoder(r.Body).Decode(&g); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 	req := createGroupReq{
 		Group: g,
@@ -351,14 +351,14 @@ func decodeGroupCreate(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodeGroupUpdate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	req := updateGroupReq{
 		id:    bone.GetValue(r, "groupID"),
 		token: apiutil.ExtractBearerToken(r),
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 	return req, nil
 }

users/groups/service.go

@@ -191,7 +191,7 @@ func (svc service) authorizeByID(ctx context.Context, subject, object, action st
 func (svc service) identify(ctx context.Context, token string) (string, error) {
 	claims, err := svc.tokens.Parse(ctx, token)
 	if err != nil {
-		return "", errors.Wrap(errors.ErrAuthentication, err)
+		return "", err
 	}
 	if claims.Type != AccessToken {
 		return "", errors.ErrAuthentication

users/policies/api/grpc/endpoint.go

@@ -7,6 +7,8 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/users/clients"
 	"github.com/mainflux/mainflux/users/policies"
 )
@@ -16,12 +18,12 @@ func authorizeEndpoint(svc policies.Service) endpoint.Endpoint {
 		req := request.(authReq)
 
 		if err := req.validate(); err != nil {
-			return authorizeRes{}, err
+			return authorizeRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		aReq := policies.AccessRequest{Subject: req.subject, Object: req.object, Action: req.action, Entity: req.entityType}
 		err := svc.Authorize(ctx, aReq)
 		if err != nil {
-			return authorizeRes{}, err
+			return authorizeRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		return authorizeRes{authorized: true}, err
 	}

users/policies/api/grpc/transport.go

@@ -80,16 +80,16 @@ func encodeError(err error) error {
 	case errors.Contains(err, nil):
 		return nil
 	case errors.Contains(err, errors.ErrMalformedEntity),
-		err == apiutil.ErrInvalidAuthKey,
-		err == apiutil.ErrMissingID,
-		err == apiutil.ErrMissingPolicySub,
-		err == apiutil.ErrMissingPolicyObj,
-		err == apiutil.ErrMalformedPolicyAct,
-		err == apiutil.ErrMalformedPolicy,
-		err == apiutil.ErrMissingPolicyOwner:
+		errors.Contains(err, apiutil.ErrInvalidAuthKey),
+		errors.Contains(err, apiutil.ErrMissingID),
+		errors.Contains(err, apiutil.ErrMissingPolicySub),
+		errors.Contains(err, apiutil.ErrMissingPolicyObj),
+		errors.Contains(err, apiutil.ErrMalformedPolicyAct),
+		errors.Contains(err, apiutil.ErrMalformedPolicy),
+		errors.Contains(err, apiutil.ErrMissingPolicyOwner):
 		return status.Error(codes.InvalidArgument, err.Error())
 	case errors.Contains(err, errors.ErrAuthentication),
-		err == apiutil.ErrBearerToken:
+		errors.Contains(err, apiutil.ErrBearerToken):
 		return status.Error(codes.Unauthenticated, err.Error())
 	case errors.Contains(err, errors.ErrAuthorization):
 		return status.Error(codes.PermissionDenied, err.Error())

users/policies/api/http/endpoints.go

@@ -7,6 +7,8 @@ import (
 	"context"
 
 	"github.com/go-kit/kit/endpoint"
+	"github.com/mainflux/mainflux/internal/apiutil"
+	"github.com/mainflux/mainflux/pkg/errors"
 	"github.com/mainflux/mainflux/users/policies"
 )
 
@@ -14,7 +16,7 @@ func authorizeEndpoint(svc policies.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(authorizeReq)
 		if err := req.validate(); err != nil {
-			return authorizeRes{}, err
+			return authorizeRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		aReq := policies.AccessRequest{
 			Subject: req.Subject,
@@ -35,7 +37,7 @@ func createPolicyEndpoint(svc policies.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(createPolicyReq)
 		if err := req.validate(); err != nil {
-			return addPolicyRes{}, err
+			return addPolicyRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		policy := policies.Policy{
@@ -56,7 +58,7 @@ func updatePolicyEndpoint(svc policies.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(updatePolicyReq)
 		if err := req.validate(); err != nil {
-			return updatePolicyRes{}, err
+			return updatePolicyRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 
 		policy := policies.Policy{
@@ -78,7 +80,7 @@ func listPolicyEndpoint(svc policies.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(listPolicyReq)
 		if err := req.validate(); err != nil {
-			return listPolicyRes{}, err
+			return listPolicyRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		pm := policies.Page{
 			Total:   req.Total,
@@ -101,7 +103,7 @@ func deletePolicyEndpoint(svc policies.Service) endpoint.Endpoint {
 	return func(ctx context.Context, request interface{}) (interface{}, error) {
 		req := request.(deletePolicyReq)
 		if err := req.validate(); err != nil {
-			return deletePolicyRes{}, err
+			return deletePolicyRes{}, errors.Wrap(apiutil.ErrValidation, err)
 		}
 		policy := policies.Policy{
 			Subject: req.Subject,

users/policies/api/http/transport.go

@@ -64,12 +64,12 @@ func MakeHandler(svc policies.Service, mux *bone.Mux, logger logger.Logger) http
 
 func decodeAuthorize(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	var authReq authorizeReq
 	if err := json.NewDecoder(r.Body).Decode(&authReq); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	return authReq, nil
@@ -77,12 +77,12 @@ func decodeAuthorize(_ context.Context, r *http.Request) (interface{}, error) {
 
 func decodePolicyCreate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 
 	var m policies.Policy
 	if err := json.NewDecoder(r.Body).Decode(&m); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	req := createPolicyReq{
@@ -96,11 +96,11 @@ func decodePolicyCreate(_ context.Context, r *http.Request) (interface{}, error)
 
 func decodePolicyUpdate(_ context.Context, r *http.Request) (interface{}, error) {
 	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
-		return nil, errors.ErrUnsupportedContentType
+		return nil, errors.Wrap(apiutil.ErrValidation, apiutil.ErrUnsupportedContentType)
 	}
 	var m policies.Policy
 	if err := json.NewDecoder(r.Body).Decode(&m); err != nil {
-		return nil, errors.Wrap(errors.ErrMalformedEntity, err)
+		return nil, errors.Wrap(apiutil.ErrValidation, errors.Wrap(err, errors.ErrMalformedEntity))
 	}
 
 	req := updatePolicyReq{
@@ -116,31 +116,31 @@ func decodePolicyUpdate(_ context.Context, r *http.Request) (interface{}, error)
 func decodeListPoliciesRequest(_ context.Context, r *http.Request) (interface{}, error) {
 	total, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	offset, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	limit, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	ownerID, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	subject, err := apiutil.ReadStringQuery(r, api.SubjectKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	object, err := apiutil.ReadStringQuery(r, api.ObjectKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 	action, err := apiutil.ReadStringQuery(r, api.ActionKey, "")
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(apiutil.ErrValidation, err)
 	}
 
 	req := listPolicyReq{

users/policies/service.go

@@ -169,7 +169,7 @@ func (svc service) checkPolicy(ctx context.Context, clientID string, p Policy) e
 func (svc service) identify(ctx context.Context, token string) (string, error) {
 	claims, err := svc.tokens.Parse(ctx, token)
 	if err != nil {
-		return "", errors.Wrap(errors.ErrAuthentication, err)
+		return "", err
 	}
 	if claims.Type != AccessToken {
 		return "", errors.ErrAuthentication