Function oauth_error_json 

pub fn oauth_error_json(err: &AuthError) -> String

The RFC 7628 server error challenge for a failed OAUTHBEARER validation, byte for byte what Kafka 4.3.1’s OAuthBearerSaslServer.jsonErrorResponse sends.

AuthError::InsufficientScope renders as {"status":"insufficient_scope", "scope":"[a, b]"}: the required scope in Java’s List.toString form, after the ", " separator Kafka writes before the scope field. Every other error renders as {"status":"invalid_token"}. No krabka validator produces an openid-configuration field, so the challenge never carries one.

The broker sends this as the server’s first message after a failed validation. The JVM OAuthBearerSaslClient treats any non-empty first server message as an error and replies with a single \x01 kvsep, and the broker then completes the failure handshake.