Error handling

The envelope

Most failures use a single envelope. path names the offending field when the error is about input and is null otherwise.

{
  "errors": [
    {
      "code": "Forbidden",
      "path": null,
      "message": "Forbidden"
    }
  ]
}

Which status code goes with which situation is listed under status codes.

These endpoints use a different response structure:

POST /oauth/token follows RFC 6749 and answers with a flat error field.
POST /codes reports a rejected item inside the 200 OK body’s errors array rather than failing the request.
Batch rendering uses the same codes and errors structure.