APDU Response Codes

What Are APDU Response Codes?

apdu-response-codes/" class="glossary-term-link" data-term="APDU response codes" data-definition="Two-byte status codes in APDU responses." data-category="Protocol">APDU response codes -- also called status words -- are two-byte values (SW1-SW2) appended to every response APDU returned by a smart card. They indicate whether a command succeeded, completed with a warning, or failed with a specific error condition. Every smart card interaction, from selecting an application to verifying a PIN, ends with a status word that the host software must interpret before proceeding.

The status word system is defined by ISO 7816-4 and extended by application-specific standards such as EMV, GlobalPlatform, and ICAO 9303 for ePassports.

Status Word Structure

The two bytes SW1 and SW2 are interpreted together:

Common Status Words

Engineers encounter these status words most frequently when developing smart card applications:

• 9000 -- command executed successfully without error
• 6100 -- response data available; issue GET RESPONSE with Le = SW2
• 6283 -- selected file deactivated (invalidated)
• 6982 -- security status not satisfied (authentication required)
• 6983 -- authentication method blocked (PIN locked)
• 6984 -- reference data not usable (key corrupted)
• 6985 -- conditions of use not satisfied
• 6A82 -- file or application not found
• 6A86 -- incorrect parameters P1-P2
• 6D00 -- instruction code not supported or invalid
• 6E00 -- class (CLA) not supported

Handling in Application Code

Robust smart card middleware must check the status word after every APDU exchange. A common pattern is to treat SW1=61 as a signal to issue a GET RESPONSE command to retrieve remaining data, and to map error codes to domain-specific exceptions. For SCP03 secure channels, status words are also covered by the session MAC, so tampering with the response code is detectable.

When debugging card interactions, the ATR parser and APDU trace tools are invaluable for correlating status words with the command sequence that produced them.