# Errors

An error answers an HTTP status and a JSON body with a sentence for people and, when there is one, a code for programs:

```json
{ "message": "This key does not have the assets:write scope.", "code": "SCOPE_REQUIRED" }
```

Branch on `code` (stable), show `message` (it may change).

| Status | Code | Meaning |
|---|---|---|
| 400 | (none) | A field is missing or has the wrong shape; the message names it |
| 400 | `CREDENTIAL_IN_URL` | A key or token was sent in the URL; send it in the Authorization header, and revoke it |
| 401 | `INVALID_API_KEY` | The key is unknown, revoked or expired, or its creator is no longer an owner or admin |
| 401 | `INVALID_TOKEN` | The access token is expired or revoked, or the app was disconnected |
| 401 | `API_KEY_HEADER` | The key was sent as `X-API-Key`; use `Authorization: Bearer` |
| 403 | `SCOPE_REQUIRED` | The key or token lacks the scope this needs |
| 403 | `SESSION_REQUIRED` | This part of FortWatch is dashboard-only |
| 403 | `LIMIT_REACHED` | A plan limit (scans per day, schedules per asset, …) |
| 403 | `PLAN_UPGRADE_REQUIRED` | The plan does not include this |
| 403 | `EXTRA_PURCHASE_NOT_ALLOWED` | This needs a paid slot; add it in the dashboard |
| 403 | `OWNERSHIP_NOT_VERIFIED` | The asset's ownership is not proven yet |
| 403 | `WORKSPACE_SUSPENDED`, `WORKSPACE_NOT_ACTIVE`, `BILLING_REQUIRED` | The workspace can read but not change anything now |
| 403 | `MFA_SETUP_REQUIRED` | The workspace requires two-factor authentication and the key's creator has none |
| 404 | (none) | Not found in your workspace |
| 409 | `SCAN_IN_PROGRESS` | The asset is already being scanned; the body carries that scan |
| 422 | `VERIFICATION_FAILED` | The ownership proof was not found |
| 429 | `RATE_LIMITED` | Past the request budget; wait `Retry-After` seconds |

The OAuth endpoints answer OAuth's own error shape instead: see [OAuth apps](/oauth#errors).