Errors

Every failure carries one shape, whatever caused it: one error body across the suite rather than one per endpoint. A source’s own status and body are never passed through.

{
  "code": 429,
  "timestamp": 1751975600361,
  "message": "Unauthorized: USAGE_EXCEEDED"
}

Status	When
`401`	The `Authorization` header is missing or malformed, or the API key was rejected.
`403`	The API key is valid but is not permitted to call this endpoint, or is not linked to an active account.
`404`	No consent link you created, or passbook OTP you sent, in the last 30 days carries the `request_id` sent.
`422`	The request failed our validation, or the source would not accept the details in it.
`429`	The key is not cleared for this endpoint, or is sending too many requests. Nothing was called.
`503`	The source could not be reached, or authentication is temporarily unavailable.
`500`	Something failed on our side.

The code is stable. The message is prose and its wording may change.

A 200 that says no

A registration the source holds nothing for is an answer, not a failure. It comes back as 200 with a reason naming what did not hold. A few reasons say the source reached no conclusion, for a reason outside your request, rather than settling the question against you: bank-account-unsettled when the banking network could not settle the account, and in the orchestrated flow source-unavailable and details-refused for a check that answered nothing. The verdict is in reasons, not in the status code: an empty list means the check passed. What each check can conclude is listed with it in the API reference.

Get started

Reference

A 200 that says no

​A 200 that says no

A 200 that says no