Error Response Formats
Errors have two shapes depending on the source: Auth/middleware errors (401, 403, 429):success: false:
Error Codes
Authentication (401)
| Code | Description |
|---|---|
MISSING_API_KEY | No Authorization: Bearer header provided |
INVALID_KEY_FORMAT | Key present but wrong prefix (must start with circ_live_ or circ_test_) |
INVALID_API_KEY | API key not found or revoked |
UNAUTHORIZED | No Bearer token provided on a JWT-authenticated route |
INVALID_TOKEN | JWT is malformed, expired, or signature invalid |
Authorization (403)
| Code | Description |
|---|---|
ACCOUNT_SUSPENDED | Account billing is suspended. Contact support to reactivate |
FORBIDDEN | JWT does not have the required role |
ENDPOINT_NOT_INCLUDED | Your tier does not include this endpoint category. Response includes upgrade: true |
Rate Limiting (429)
| Code | Extra Fields | Description |
|---|---|---|
RATE_LIMIT_EXCEEDED | retryAfter (seconds) | Sliding window rate limit hit |
DAILY_QUOTA_EXCEEDED | limit, used | Daily request quota exhausted |
MONTHLY_QUOTA_EXCEEDED | limit, used | Monthly request quota exhausted |
Handler Errors (400)
When a handler returnssuccess: false, the API responds with the error message and metadata. These are domain-specific errors like invalid parameters or missing data.
Circuit Breaker (503)
When an upstream dependency is unavailable:retryAfterMs window.