Errors

All errors return a JSON body with an error string. Some add extra fields (issues, scope, Retry-After).

Error reference

HTTP	Body error	Meaning
400	invalid_request (+ issues)	Body failed validation.
401	unauthorized	Missing / bad / revoked / expired key, or suspended org.
403	insufficient_scope (+ scope)	Key lacks the required scope.
403	high_sensitivity_requires_elevated	Live key, high-sensitivity class, org not elevated.
404	not_found	Request / grant not found under your org.
409	grant_not_viewable	Grant revoked, paused, or over its view cap.
429	rate_limited (+ Retry-After)	Slow down.

Key-minting errors (console)

These surface in the console when you try to mint a key, as 409:

Body error	Meaning
live_requires_verification	Org not verified — can't mint a live key.
dpa_required	DPA not accepted — can't mint a live key.

See Getting started for how to clear both gates.

Handling notes

• 401 is deliberately opaque. Every auth failure looks identical, so don't try to branch on the reason — re-check the key and org status out of band.
• 400 includes issues. Use the issues array to point callers at the exact invalid field.
• 429 includes Retry-After. Always honor it — see Rate limits.

Next: API reference →