Error codes#
π΄ Errors arrive with HTTP 200#
The status code is not enough
Validation, "not found", duplicates and conflicts all return 200 with
success: false. Decide by the response body.
Status codes the API actually uses#
| Code | When |
|---|---|
| 200 | nearly everything, including application errors |
| 204 | CORS preflight, some payment return addresses |
| 401 | missing, invalid, expired or revoked token |
| 403 | denied permission |
| 404 | non-existent resource or action β returns HTML |
| 429 | exceeded rate limit, with a Retry-After header |
| 500 | unhandled exception β returns HTML |
Result codes#
The number in the code field.
Result codes DO NOT correspond to HTTP statuses
They look similar and do not match. 400 means permission denied, 404 means
rate limit exceeded, 403 means an invalid token.
The common ones#
| Code | Meaning |
|---|---|
0 |
success |
2 |
validation failed |
102 |
user not found |
103 |
not signed in |
106 |
session expired |
108 |
invalid password |
109 |
account inactive |
110 |
wrong credentials |
400 |
permission denied |
402 |
access token expired |
403 |
access token invalid |
404 |
rate limit exceeded |
602 |
missing required field |
607 |
operation not permitted |
616 |
item not found |
Ranges#
| Range | Area |
|---|---|
| 100β110 | user and sign-in |
| 200β206 | images and files |
| 300β304 | database |
| 400β404 | permissions and tokens |
| 500β504 | API calls |
| 600β616 | data and operations |
| 700β703 | tasks |
| 800β804 | request processing |
Examples#
Not signed in (HTTP 401):
Denied (HTTP 403):
Rate limited (HTTP 429, header Retry-After: 240):
{"success":false,"message":"Too many requests, retry in 240s","exception":null,"data":null,"code":404}
Missing data (HTTP 200):
That last example has no data and no exception key
The envelope is not consistent. Read each key defensively.
An unknown filter type#
A typo in a filter name gives a 500, not a validation error
And returns HTML. Check filter names in the CRUD pattern.