Error Catalogue

Every error response from the API follows RFC 7807, the problem-plus-json format, and includes a correlation ID -- always include that when you contact support, since it lets the exact request be traced through the platform's logs. The common codes to know: a 400 validation error means the request body failed schema validation, so check the errors array for the specific fields. A 401 means your access token is missing, expired or malformed. A 403 can mean either insufficient scope, or insufficient auth strength if you attempted a privileged operation without stepping up with MFA. A 404 is intentionally indistinguishable between a resource that doesn't exist and one that exists in a tenant you can't access -- that's deliberate, to avoid leaking cross-tenant existence. A 409 conflict means a concurrent update changed the resource since you last read it, so re-fetch and retry with the current ETag. And a 429 means you're rate limited -- respect the Retry-After header. Breaking changes always ship as a brand new version path, and the prior version stays available through its published deprecation window, with a Deprecation header naming the sunset date.