Error Handling

All API errors follow a consistent format.

Error Response Format

{
  "error": {
    "code": "ERROR_CODE",
    "message": "Human-readable error description",
    "status": 400
  }
}

Code	Status	Description
`INVALID_PARAMS`	400	Request parameters are missing or invalid
`UNAUTHORIZED`	401	Authentication required or credentials invalid
`FORBIDDEN`	403	Authenticated but insufficient permissions
`ASSET_NOT_FOUND`	404	Requested asset does not exist
`NOT_FOUND`	404	Requested resource does not exist
`CONFLICT`	409	Resource already exists (e.g., duplicate filename at same path)
`PAYLOAD_TOO_LARGE`	413	File exceeds maximum upload size (100MB)
`RATE_LIMITED`	429	Too many requests — try again later
`INTERNAL_ERROR`	500	Unexpected server error

Status	Meaning
`200`	Success
`201`	Resource created
`204`	Success with no content (e.g., delete)
`400`	Bad request
`401`	Unauthorized
`403`	Forbidden
`404`	Not found
`409`	Conflict
`413`	Payload too large
`429`	Rate limited
`500`	Internal server error

Magic link requests: 3 per email per 15-minute window
API key requests: No rate limiting at the API layer (use vault settings for per-vault limits)