In programming terms this is a totally unexceptional problem, obviously all the APIs here are standard ones, except for the part where identifying somebody's retinas against Civilization's database is something that not just anybody is supposed to be able to do, if you're not a hospital, which means that the retinal scanner in question has a cryptographic cert that is not actually supposed to leave that machine.
This is actually fine. Everything is fine. He called in that problem as soon as it became obvious, and somebody in admin should be talking to low-level Exception Handling about approving the request he's about to make into the person-identification API -