Skip to main content

Envelope

Every error response uses the same shape:
The errorCode is stable across releases. Switch on it programmatically. The message is meant for humans and may change.

Status codes

Common error codes

  • MISSING_CREDENTIAL - no supported credential was supplied (401).
  • INVALID_API_KEY - x-api-key is invalid or revoked (401).
  • INSUFFICIENT_SCOPE or API_KEY_SCOPE_INSUFFICIENT - key valid but missing a required scope (403). Includes required field listing the needed scopes.
  • NOT_FOUND - the resource doesn’t exist or belongs to another organization (404). The API never reveals which.
  • IDEMPOTENCY_KEY_REUSED - same Idempotency-Key header sent with a different request.
  • VALIDATION_ERROR - the request is structurally valid but semantically rejected, such as a template missing a subject or sender profile.

Cross-organization access

Reading or writing a resource that belongs to another organization always returns 404 — never 403. This prevents an attacker (or a confused integration) from enumerating which IDs exist in other orgs.