Startnext API — Error Codes

Every error response carries the same envelope:

{
    "error": "insufficient_scope",
    "error_description": "This endpoint requires the \"orders:read\" scope"
}

Branch on error — it is stable and machine-readable. error_description is meant for humans, may be null, and may change without notice.

Treat the lists below as the codes you may encounter, not as a closed set: new codes can appear when endpoints gain validation. Handle the ones you care about and fall back on the HTTP status for the rest. See also Error Handling in the Developer Guide.

Common codes

Authentication, permissions, validation and rate limiting produce these on any endpoint that can answer with the given status.

error HTTP Error family
auth_required 401 UnauthorizedError
forbidden 403 ForbiddenError
insufficient_project_plan 403 ForbiddenError
insufficient_role 403 ForbiddenError
insufficient_scope 403 ForbiddenError
invalid_api_key 401, 403 ForbiddenError, UnauthorizedError
invalid_csrf_token 403 ForbiddenError
invalid_token 401 UnauthorizedError
invalid_value 400 ValidationError
key_project_mismatch 403 ForbiddenError
missing_field 400 ValidationError
not_found 404 NotFoundError
project_access_denied 403 ForbiddenError
project_not_found 404 NotFoundError
rate_limit_exceeded 429 RateLimitError
user_not_found 401 UnauthorizedError

Endpoint-specific codes

Only the endpoints listed here return these.

error HTTP Returned by
funding_not_successful 403 GET /project/{link_caption}/orders

Framework codes (non-conformant)

These values are sent by myty framework code itself (CSRF middleware, request-body parsing, the generic not-found/bad-request helpers). They are listed so this catalog is complete, but they break two promises this API otherwise makes:

  1. Not a machine-readable token. The value is prose with spaces, so you cannot branch on it the way the Developer Guide describes for error.
  2. No description. They are sent without an error_description; the field is null.

If you receive one of these, branch on the HTTP status instead of the error value.

error HTTP Error family error_description
access denied 403 ForbiddenError – (always null)
bad request 400 ValidationError – (always null)
invalid content type 400 ValidationError – (always null)
invalid csrf token 403 ForbiddenError – (always null)
resource not found 404 NotFoundError – (always null)

Error families

Each error response references one of these schemas. The interactive API reference shows the possible codes per response.

Family Status Meaning
UnauthorizedError 401 The credential is missing, invalid or expired
ForbiddenError 403 The credential is valid but not sufficient — scope, role or project mismatch
NotFoundError 404 The resource does not exist or is not visible to this credential
ValidationError 400, 422 The request is well-formed but its values are not
ConflictError 409 The operation conflicts with the current state
RateLimitError 429 Rate limit exceeded — see the Retry-After header
Error any Fallback envelope without a fixed set of codes