Error handling - Thing Identity

The envelope

Most failures use a single envelope. path names the offending field when the error is about input and is null otherwise.

{
  "errors": [
    {
      "code": "Forbidden",
      "path": null,
      "message": "Forbidden"
    }
  ]
}

Which status code goes with which situation is listed under status codes.

Endpoints that answer differently

Two endpoints do not use the envelope, and each documents its own failures:

POST /oauth/token follows RFC 6749 and answers with a flat error field.
POST /codes reports a rejected item inside the 200 OK body rather than failing the request.