Errors - Branduo

OpenAPI errors use a small JSON object with error and message. This is not RFC 7807 Problem Details (application/problem+json). Clients should read error and message on the JSON body.

Error format

{
  "error": "rate_limit",
  "message": "You reached the rate limit for this request. Please try again in a few minutes."
}

Field	Description
`error`	Machine-readable code for the failure.
`message`	Human-readable explanation. May be omitted.

HTTP statuses

Status	When you see it
`200`	Success. List and read endpoints return their resource body, not an error object.
`400`	The request is invalid. Examples: bad `X-Platform-Id`, unsupported OAuth grant, or a key in the query string.
`401`	The API key or access token is missing, invalid, or expired. OAuth can also return `invalid_grant`.
`429`	You exceeded the rate limit for this IP and action.
`500`	An unexpected server error. OAuth authorize may return `server_error` if a code cannot be issued.

GET /v1/oauth/authorize may redirect to Account Portal login when the brand has no session, instead of returning a JSON error.

Error values

These error strings are returned by the public OpenAPI:

`error`	Typical status	Meaning
`rate_limit`	`429`	The IP + action limit was exceeded. Retry later.
`unauthorized`	`401`	Missing or invalid API key or access token.
`invalid_grant`	`401`	The authorization code or refresh token is invalid or expired.
`invalid_request`	`400`	The token request is missing required fields, or an API key was sent in the query string.
`invalid_platform`	`400`	`X-Platform-Id` is not a UUID, or it is not an active platform.
`unsupported_grant_type`	`400`	`grant_type` must be `authorization_code` or `refresh_token`.
`unsupported_response_type`	`400`	`response_type` on authorize must be `code`.
`server_error`	`500`	Authorize could not issue an authorization code.

Generic authentication failures use unauthorized (or 401 with that body). Treat unknown error values as failures and surface message when present. See Authentication for credential headers and the OAuth token flow.