API errors

Overview

Clients should branch on HTTP status and structured error type, then retain safe request identifiers for investigation.

• 400: invalid or unsupported request shape.
• 401/403: missing authentication or insufficient authority.
• 404: unknown scoped resource.
• 409: conflicting state.
• 429: quota or rate boundary.
• 5xx: transient service or upstream failure; retry only when safe.

Production checklist

• Keep credentials in a server-side secret store.
• Set explicit cost, latency, privacy, provider, and regional constraints.
• Capture route and evaluation evidence for incident review.
• Test timeouts, cancellation, fallback, and denied-policy paths before rollout.