REST API

Error reference

Every error code the API returns, with its status and what to do.

Errors are application/problem+json (RFC 9457). Branch on code, never on title or detail: codes are stable, the wording can change. Every response carries X-Request-Id; quote it when you contact support.

Code	Status	Meaning
`malformed_request`	400	Malformed request. The request could not be parsed. Check the JSON body, headers and URL.
`invalid_token`	400	Invalid or expired link. This link is invalid, has expired or was already used. Request a new one.
`idempotency_key_required`	400	Idempotency key required. This endpoint requires an Idempotency-Key header.
`unauthorized`	401	Authentication required. Sign in, or send a valid API key in the Authorization header.
`invalid_api_key`	401	Invalid API key. The API key is missing, malformed, unknown, expired or revoked.
`invalid_credentials`	401	Invalid credentials. The email address or password is incorrect.
`mfa_required`	401	Two-factor authentication required. Enter the code from your authenticator app to finish signing in.
`forbidden`	403	Forbidden. Your role does not allow this action.
`origin_not_allowed`	403	Origin not allowed. This website is not on the allowed web origins of the project environment. Add it in the dashboard under Settings, or call the API from your server.
`insufficient_scope`	403	Insufficient scope. The API key does not have the scope this endpoint requires.
`csrf_failed`	403	CSRF check failed. The CSRF token is missing or does not match the session. Reload the page and retry.
`email_not_verified`	403	Email not verified. Verify your email address before doing this.
`account_disabled`	403	Account disabled. This account is disabled. Contact support to restore access.
`feature_disabled`	403	Feature not available. This feature is not enabled for this deployment or organization.
`reauthentication_required`	403	Sign in again. For your security, sign out and sign in again, then retry within 15 minutes.
`invitation_email_mismatch`	403	Invitation for another address. This invitation was sent to a different email address. Sign in with that address to accept it.
`not_found`	404	Not found. The requested resource does not exist.
`link_not_found`	404	Link not found. No active link matches this URL.
`method_not_allowed`	405	Method not allowed. This endpoint does not support the HTTP method used.
`request_timeout`	408	Request timeout. The request body did not arrive in time.
`conflict`	409	Conflict. The request conflicts with the current state of the resource.
`signup_closed`	403	Registration is closed. New accounts cannot be created right now. If you already have an account, sign in.
`email_taken`	409	Email already registered. An account with this email address already exists. Sign in or reset your password.
`version_conflict`	409	Version conflict. The resource was changed by another request. Load it again and retry.
`path_taken`	409	Short path already taken. Another link on this domain already uses this short path. Choose another one.
`path_reserved`	409	Short path reserved. This short path belonged to a deleted link and stays reserved for 90 days, so old traffic never reaches a new destination. Choose another one.
`resource_type_key_taken`	409	Resource type key already taken. This environment already has a resource type with this key (archived ones keep theirs). Choose another key.
`template_pattern_taken`	409	URL pattern already in use. Another URL template of this environment already uses this path prefix (letter case ignored). Choose another pattern or archive the other template.
`resource_limit_reached`	409	Resource limit reached. This environment reached the limit of resource types or URL templates. Archive or reuse an existing one.
`idempotency_key_in_progress`	409	Idempotency key in progress. A request with this Idempotency-Key is still being processed. Retry shortly.
`slug_taken`	409	Slug already taken. Another organization or project already uses this slug. Choose another one.
`domain_taken`	409	Domain already in use. This domain is already connected to a project. If it is yours, remove it there first; a claim that was never verified frees up after 7 days.
`last_owner`	409	Owner required. An organization always keeps exactly one owner with full access. Transfer ownership to another member first.
`already_member`	409	Already a member. This person is already a member of the organization.
`invitation_expired`	410	Invitation expired. This invitation has expired. Ask an owner or admin of the organization to resend it.
`invitation_revoked`	410	Invitation revoked. This invitation was withdrawn. Ask an owner or admin of the organization for a new one.
`payload_too_large`	413	Payload too large. The request body exceeds the size limit of this endpoint.
`unsupported_media_type`	415	Unsupported media type. Send the request body as application/json.
`validation_failed`	422	Request validation failed. One or more fields are invalid.
`url_blocked`	422	Destination URL blocked. A destination URL is listed as dangerous (phishing or malware) or uses a forbidden scheme. Links cannot point to it.
`idempotency_key_reused`	422	Idempotency key reused. This Idempotency-Key was already used with a different request.
`rate_limited`	429	Too many requests. Rate limit exceeded. Retry after the time in the Retry-After header.
`internal_error`	500	Internal server error. Something went wrong on our side. Retry later and quote the request_id if it persists.
`service_unavailable`	503	Service unavailable. The service is temporarily unavailable. Retry later.