Developer portal
Errors & status codes
Every failure path should be actionable for operators and engineers.
Last updated: 2026-06-09
Error envelope
Typical error body
{
"status": "error",
"message": "Invalid API key. Check the pilot token and try again.",
"requestId": "req_01JABCDEF",
"detail": "optional string or validation object"
}Send X-Request-Id on requests; the same value is echoed on error responses for support correlation.
Envelope fields
| Code | Meaning | Typical cause | Suggested fix |
|---|---|---|---|
| — | status | "error" on failure paths | Branch client logic on HTTP status first, then parse message. |
| — | message | Human-readable explanation | Surface to operators; log for engineering. |
| — | requestId | Correlation id from X-Request-Id middleware | Include in support tickets for 500 errors. |
| — | detail | Optional string or structured validation errors | Use for form-level fixes in integrations. |
HTTP status codes
| Code | Meaning | Typical cause | Suggested fix |
|---|---|---|---|
| 400 | Bad request | Malformed JSON or missing required headers. | Validate Content-Type and JSON syntax before retrying. |
| 401 | Unauthorized | Missing or invalid API key in Authorization, x-api-key, or query param. | Send Bearer <key> or x-api-key with a valid tenant token. |
| 402 | Payment required | Feature not included in current entitlements (e.g. Monitor schedules, remediation automate). | Upgrade via billing portal or contact sales for enterprise tier. |
| 403 | Forbidden | Valid key but insufficient role (viewer attempting write) or wrong admin key. | Use operator or admin role key; check RBAC matrix. |
| 404 | Not found | Scan, schedule, share link, or resource id does not exist or expired. | Verify id and tenant scope; share links expire per expiresHours. |
| 413 | Payload too large | CBOM ingest or upload exceeds size limit. | Split large CBOM documents or use cloud pull integration. |
| 422 | Unprocessable entity | Invalid payload shape, unsupported scenario, or infeasible constraints. | Fix field errors in response detail; relax constraints and retry. |
| 429 | Too many requests | Per-key rate limit exceeded (default 300 requests per minute) or public endpoint limit. | Backoff with jitter; cache results; request higher limit for production. |
| 500 | Internal server error | Unexpected backend failure; includes requestId in response. | Retry with exponential backoff; contact support with requestId if persistent. |
| 503 | Service unavailable | Persistence disabled, auth DB unreachable, or admin API not configured. | Retry shortly; schedules require Postgres persistence enabled. |
| 501 | Not implemented | Problem type not yet supported on live solver path (routing, allocation). | Use type schedule for live jobs, or follow Labs roadmap. |
Retry guidance
Found an issue? Report documentation feedback