Every error returns the same envelope.
Branch on error.code. It is stable. error.message is written for humans and may change.
Status codes
Error codes
Auth failures
401 responses also carry a WWW-Authenticate header.
error="invalid_request" means no key was presented. error="invalid_token" means a key was presented and rejected.
Retries
Retry 429 and 5xx only. Back off exponentially and cap attempts. Write requests accept an Idempotency-Key header, so a retry never creates a second Session, Claim or Payment.
Last modified on July 25, 2026