Errors

Every error (except the token endpoint’s, which follow RFC 6749) has the same body:

{
  "error": {
    "code": "validation_error",
    "message": "The request is not valid.",
    "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d",
    "details": [{ "field": "query.limit", "message": "Input should be less than or equal to 200" }]
  }
}

• Branch on code, never on message. Messages may change.
• details is present for some codes: field errors for validation_error, missing scopes for insufficient_scope.
• Every response, including errors, carries X-Request-ID. Quote it when you contact support.

Status	code	Meaning	What to do
400	validation_error	A parameter or body field is missing, malformed or unknown	Fix the request; see details
400	invalid_cursor	The cursor is corrupt or belongs to another query	Restart from the first page
401	invalid_credentials	Missing, unknown, expired or revoked credential	Check the key; create a new one if needed
403	insufficient_scope	The credential lacks a scope	Add the scope listed in details
403	permission_denied	The action is not allowed for this workspace or role	Ask a workspace admin
403	plan_not_allowed	The workspace’s plan does not include this	Upgrade the plan
403	quota_exceeded	A plan limit is reached, such as scans this billing period	Wait for the next period or upgrade
403	target_not_authorized	The DAST or pentest target is not approved for the workspace	Approve the target in the dashboard first
404	not_found	It does not exist in your workspace	Check the id. Ids from other workspaces are never found
405	method_not_allowed	Wrong HTTP method for the path	Check the reference
409	conflict	It cannot be done in the current state	Read the message; refresh the resource
409	idempotency_conflict	The Idempotency-Key was used for a different request, or that request is still running	Use a new key, or retry later
413	payload_too_large	The body is over 1 MiB	Send less
415	unsupported_media_type	The body is not application/json	Set Content-Type: application/json
429	rate_limited	Too many requests	Wait for Retry-After seconds
500	internal_error	Something failed on our side	Retry with backoff; quote the request id
501	not_implemented	The operation is not enabled yet for your deployment	Use the dashboard for now
502	upstream_unavailable	A DevSecure service this operation needs did not answer	Retry with backoff
503	service_unavailable	The API is temporarily unavailable	Retry with backoff

Unknown query parameters and unknown body fields are rejected with validation_error rather than ignored, so typos surface immediately.