RSX API / Errors
Error reference.
Every RFC 7807 type URL the platform emits points at a page below. The shape of every error is documented in the getting started guide.
| Status | Error | Meaning |
|---|---|---|
| 401 | missing-api-key | The request reached an authenticated endpoint without an Authorization header. |
| 401 | invalid-api-key | The supplied key is malformed or not recognised by the platform. |
| 401 | revoked-api-key | The key exists but has been revoked, or its rotation grace window has ended. |
| 403 | invalid-scope | The key is valid but doesn't hold the scope this endpoint requires (scopes look like project:group:action). |
| 401 | invalid-admin-token | Key-management endpoints (/platform/v1/keys/*) authenticate with the platform admin token, not an API key. |
| 401 | invalid-token | A JWT-authenticated endpoint rejected the bearer token: missing, malformed, expired, wrong issuer/audience, or not signed by a known key. Also returned by RSX ID for an unrecognised, expired, or reused refresh token. |
| 429 | rate-limit-exceeded | Your key's token bucket is empty. Every response carries X-RateLimit-* headers. |
| 400 | missing-idempotency-key | All add actions require an Idempotency-Key header so a retried request can't create a duplicate. |
| 422 | idempotency-key-reuse | This Idempotency-Key was already used with a different request body — that's a client bug, not a retry. |
| 404 | key-not-found | No API key exists with the requested id (platform/v1). |
| 404 | widget-not-found | No widget exists with the requested id (example/v1 — the reference service). |
| 404 | identity-not-linked | The external identity (a Discord or GitHub user) is well-formed, but no RSX ID has it connected and verified. Distinct from account-not-found, which means an RSX account id didn't exist, and from a 400, which means the request itself was malformed. |
| 404 | account-not-found | No RSX ID account exists with the requested id (id/v1, admin surface). |
| 401 | invalid-credentials | Login failed: the email/handle or password is incorrect. The same error is returned for an unknown account and a wrong password, on purpose — RSX ID never reveals whether an identifier exists. |
| 409 | email-taken | An account already uses this email address. |
| 409 | handle-taken | The requested @handle is already in use or is reserved by the platform. |
| 409 | handle-reserved | The @handle was recently released by another account and is held in a 14-day cooldown, reclaimable only by its prior owner (anti-impersonation). |
| 403 | account-suspended | The account is temporarily suspended by a platform admin. Login and access are blocked while suspended. |
| 403 | account-terminated | The account has been permanently terminated by a platform admin. |
| 400 | invalid-verification-token | The email-verification token is invalid, already used, or expired. |
| 400 | invalid-reset-token | The password-reset token is invalid, already used, or expired. |
| 403 | email-not-verified | The action requires a verified email address — e.g. enabling a developer account. |
| 403 | developer-only | This endpoint (developer self-service API keys) needs an RSX ID developer account. |
| 403 | private-scope | A developer key may only be scoped to public endpoints. One or more requested scopes are private (admin-issued keys only). |
| 409 | key-limit-reached | A developer account has reached its maximum number of active API keys. |
| 401 | invalid-client | The OIDC `client_id` is not registered with RSX ID, or the client has been revoked. |
| 400 | invalid-redirect-uri | The OIDC `redirect_uri` does not exactly match one registered for this client (exact-match only — no trailing slashes or path differences). |
| 404 | not-found | The requested resource or endpoint does not exist (or is not publicly available). |
| 410 | version-sunset | This API version passed its published sunset date and no longer serves requests (§6.8 — deprecations are announced with Deprecation/Sunset headers well before this). |
| 500 | internal-error | Something failed on our side. The response's requestId identifies the exact request in our logs. |