Errors
An error answers an HTTP status and a JSON body with a sentence for people and, when there is one, a code for programs:
{ "message": "This key does not have the assets:write scope.", "code": "SCOPE_REQUIRED" }Branch on code (stable), show message (it may change).
| Status | Code | Meaning |
|---|---|---|
| 400 | (none) | A field is missing or has the wrong shape; the message names it |
| 400 | CREDENTIAL_IN_URL | A key or token was sent in the URL; send it in the Authorization header, and revoke it |
| 401 | INVALID_API_KEY | The key is unknown, revoked or expired, or its creator is no longer an owner or admin |
| 401 | INVALID_TOKEN | The access token is expired or revoked, or the app was disconnected |
| 401 | API_KEY_HEADER | The key was sent as X-API-Key; use Authorization: Bearer |
| 403 | SCOPE_REQUIRED | The key or token lacks the scope this needs |
| 403 | SESSION_REQUIRED | This part of FortWatch is dashboard-only |
| 403 | LIMIT_REACHED | A plan limit (scans per day, schedules per asset, …) |
| 403 | PLAN_UPGRADE_REQUIRED | The plan does not include this |
| 403 | EXTRA_PURCHASE_NOT_ALLOWED | This needs a paid slot; add it in the dashboard |
| 403 | OWNERSHIP_NOT_VERIFIED | The asset's ownership is not proven yet |
| 403 | WORKSPACE_SUSPENDED, WORKSPACE_NOT_ACTIVE, BILLING_REQUIRED | The workspace can read but not change anything now |
| 403 | MFA_SETUP_REQUIRED | The workspace requires two-factor authentication and the key's creator has none |
| 404 | (none) | Not found in your workspace |
| 409 | SCAN_IN_PROGRESS | The asset is already being scanned; the body carries that scan |
| 422 | VERIFICATION_FAILED | The ownership proof was not found |
| 429 | RATE_LIMITED | Past the request budget; wait Retry-After seconds |
The OAuth endpoints answer OAuth's own error shape instead: see OAuth apps.