Errors
Public API integrations should treat validation, authentication, authorization, not-found, conflict, and rate-limit responses as normal control flow.
Current common error shape
{
"success": false,
"error": "Not authorized for the specified organization",
"statusCode": 403
}Status guide
| HTTP | Code | Meaning | Action |
|---|---|---|---|
| 400 | VALIDATION_ERROR | Request body, path, or query is invalid. | Fix the supplied fields and retry with the same API key. |
| 401 | UNAUTHORIZED | API key is missing, malformed, inactive, or invalid. | Check the Authorization header and key status. |
| 403 | FORBIDDEN | The key is valid but lacks organization, module, or scope permission. | Check API key organization status, scopes, and role permissions. |
| 404 | NOT_FOUND | The resource does not exist or is unavailable to the authenticated key. | Verify IDs and tenant mapping. Do not assume cross-org existence is disclosed. |
| 409 | CONFLICT | A concurrent update, duplicate, or incompatible workflow state blocked the request. | Fetch latest state, apply idempotency where available, and retry safely. |
| 429 | RATE_LIMIT_EXCEEDED | The API key or endpoint rate limit was exceeded. | Back off and retry after the documented window. |
| 500 | INTERNAL_ERROR | QuickRCM failed unexpectedly. | Retry when safe and provide request metadata to support. |
Tenant-safe not found behavior
A 404 can mean the resource does not exist or is unavailable to the authenticated key. Do not rely on public APIs to disclose tenant boundary details.
{
"success": false,
"error": "Resource not found",
"statusCode": 404
}