Errors & Rate Limits
Error shape
Most endpoints return errors as:
{ "error": true, "message": "Human-readable description" }A few endpoints (notably Orders) return a short machine-readable error code
instead of a boolean, e.g. { "error": "workspace_id_required" } — check each endpoint’s own error
table for the exact shape it uses.
Status codes
| Status | Meaning |
|---|---|
400 | Bad request — invalid or missing fields in the body/query |
401 | Missing or invalid Authorization header |
402 | Insufficient wallet/credit balance |
403 | Authenticated, but not allowed to perform this action |
404 | Resource (or workspace) not found, or not owned by your team |
429 | Rate limited — back off and retry |
500 | Internal error — safe to retry with backoff |
Rate limits
The API enforces a global limit of 5,000 requests per minute per IP address. Sensitive operations have tighter, endpoint-specific limits — for example, Cloudflare Domains connect is limited to 10 calls per 5 minutes per team, since it validates live third-party credentials on every call.
A 429 response includes standard RateLimit-* headers. Respect them and back off — don’t
tight-loop retries.
Workspace scoping errors
Almost every non-list endpoint requires X-Workspace-Id. Forgetting it, or passing a workspace UID
your API key’s team doesn’t own, returns 400 or 404 rather than silently operating on the wrong
workspace — if you get an unexpected 404, check that header first.