Startnext API — Error Codes
Every error response carries the same envelope:
{
"error": "insufficient_scope",
"error_description": "This endpoint requires the \"orders:read\" scope"
}
Branch on error — it is stable and machine-readable. error_description is meant for
humans, may be null, and may change without notice.
Treat the lists below as the codes you may encounter, not as a closed set: new codes can appear when endpoints gain validation. Handle the ones you care about and fall back on the HTTP status for the rest. See also Error Handling in the Developer Guide.
Common codes
Authentication, permissions, validation and rate limiting produce these on any endpoint that can answer with the given status.
error |
HTTP | Error family |
|---|---|---|
auth_required |
401 | UnauthorizedError |
forbidden |
403 | ForbiddenError |
insufficient_project_plan |
403 | ForbiddenError |
insufficient_role |
403 | ForbiddenError |
insufficient_scope |
403 | ForbiddenError |
invalid_api_key |
401, 403 | ForbiddenError, UnauthorizedError |
invalid_csrf_token |
403 | ForbiddenError |
invalid_token |
401 | UnauthorizedError |
invalid_value |
400 | ValidationError |
key_project_mismatch |
403 | ForbiddenError |
missing_field |
400 | ValidationError |
not_found |
404 | NotFoundError |
project_access_denied |
403 | ForbiddenError |
project_not_found |
404 | NotFoundError |
rate_limit_exceeded |
429 | RateLimitError |
user_not_found |
401 | UnauthorizedError |
Endpoint-specific codes
Only the endpoints listed here return these.
error |
HTTP | Returned by |
|---|---|---|
funding_not_successful |
403 | GET /project/{link_caption}/orders |
Framework codes (non-conformant)
These values are sent by myty framework code itself (CSRF middleware, request-body parsing, the generic not-found/bad-request helpers). They are listed so this catalog is complete, but they break two promises this API otherwise makes:
- Not a machine-readable token. The value is prose with spaces, so you cannot branch
on it the way the Developer Guide describes for
error. - No description. They are sent without an
error_description; the field isnull.
If you receive one of these, branch on the HTTP status instead of the error value.
error |
HTTP | Error family | error_description |
|---|---|---|---|
access denied |
403 | ForbiddenError |
– (always null) |
bad request |
400 | ValidationError |
– (always null) |
invalid content type |
400 | ValidationError |
– (always null) |
invalid csrf token |
403 | ForbiddenError |
– (always null) |
resource not found |
404 | NotFoundError |
– (always null) |
Error families
Each error response references one of these schemas. The interactive API reference shows the possible codes per response.
| Family | Status | Meaning |
|---|---|---|
UnauthorizedError |
401 | The credential is missing, invalid or expired |
ForbiddenError |
403 | The credential is valid but not sufficient — scope, role or project mismatch |
NotFoundError |
404 | The resource does not exist or is not visible to this credential |
ValidationError |
400, 422 | The request is well-formed but its values are not |
ConflictError |
409 | The operation conflicts with the current state |
RateLimitError |
429 | Rate limit exceeded — see the Retry-After header |
Error |
any | Fallback envelope without a fixed set of codes |