> ## Documentation Index
> Fetch the complete documentation index at: https://docs.branduo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Errors

> OpenAPI error shape, HTTP statuses, and common error values.

OpenAPI errors use a small JSON object with `error` and `message`. This is **not** RFC 7807 Problem Details (`application/problem+json`). Clients should read `error` and `message` on the JSON body.

## Error format

```json theme={null}
{
  "error": "rate_limit",
  "message": "You reached the rate limit for this request. Please try again in a few minutes."
}
```

| Field     | Description                                 |
| --------- | ------------------------------------------- |
| `error`   | Machine-readable code for the failure.      |
| `message` | Human-readable explanation. May be omitted. |

## HTTP statuses

| Status | When you see it                                                                                               |
| ------ | ------------------------------------------------------------------------------------------------------------- |
| `200`  | Success. List and read endpoints return their resource body, not an error object.                             |
| `400`  | The request is invalid. Examples: bad `X-Platform-Id`, unsupported OAuth grant, or a key in the query string. |
| `401`  | The API key or access token is missing, invalid, or expired. OAuth can also return `invalid_grant`.           |
| `429`  | You exceeded the [rate limit](/developer/rate-limiting) for this IP and action.                               |
| `500`  | An unexpected server error. OAuth authorize may return `server_error` if a code cannot be issued.             |

`GET /v1/oauth/authorize` may **redirect** to Account Portal login when the brand has no session, instead of returning a JSON error.

## Error values

These `error` strings are returned by the public OpenAPI:

| `error`                     | Typical status | Meaning                                                                                   |
| --------------------------- | -------------- | ----------------------------------------------------------------------------------------- |
| `rate_limit`                | `429`          | The IP + action limit was exceeded. Retry later.                                          |
| `unauthorized`              | `401`          | Missing or invalid API key or access token.                                               |
| `invalid_grant`             | `401`          | The authorization code or refresh token is invalid or expired.                            |
| `invalid_request`           | `400`          | The token request is missing required fields, or an API key was sent in the query string. |
| `invalid_platform`          | `400`          | `X-Platform-Id` is not a UUID, or it is not an active platform.                           |
| `unsupported_grant_type`    | `400`          | `grant_type` must be `authorization_code` or `refresh_token`.                             |
| `unsupported_response_type` | `400`          | `response_type` on authorize must be `code`.                                              |
| `server_error`              | `500`          | Authorize could not issue an authorization code.                                          |

Generic authentication failures use `unauthorized` (or `401` with that body). Treat unknown `error` values as failures and surface `message` when present.

See [Authentication](/developer/authentication) for credential headers and the OAuth token flow.