Skip to main content
Failed requests return JSON. Authentication failures and missing API-key permissions use an error field; most other failures, including denied access to a resource, use message.

Status codes

Response shapes

Returned when credentials are missing or invalid.
Either the key is missing a permission (error) or access to the resource was denied (message).
Unified failure envelope. On stack detail routes, another team’s stack is indistinguishable from a missing one.
errors maps field names to messages.
Same status as validation, different body. Quota refusals do not return 402.
v1 operations include Retry-After (seconds). See Rate limits.

MCP errors

MCP JSON-RPC refusals use { "jsonrpc": "2.0", "error": { "code", "message" } }. id is omitted on 401, 403, and 429 refusals made before the message is read. Common JSON-RPC codes:
  • -32000 — rate limited
  • -32001 — unauthorized
  • -32002 — subscription required (data.reason = subscription_required, plus data.upgrade_url)