Errors

Errors use Problem Details (RFC 9457) with Content-Type: application/problem+json:

{
  "type": "https://httpstatuses.com/409",
  "title": "Conflict",
  "status": 409,
  "detail": "Account is managed by another source.",
  "code": "managed_elsewhere"
}

Rely on status and, where present, the machine-readable code (code, or a code at the start of detail such as WEBHOOK_HOST_NOT_ALLOWED). detail is human-readable and may change.

Status	Meaning	What to do
`400`	Malformed request, or `TENANT_CODE_REQUIRED` — the `X-Tenant-Code` header is missing.	Fix the request.
`401`	Missing, invalid or expired credentials (no reason given).	Check the secret, client state and IP allowlist with your IT administrator.
`403`	Missing scope, a target host not on the client's list, or the organisation is suspended (`TENANT_SUSPENDED`).	Ask your IT administrator.
`404`	Resource not found, or `TENANT_NOT_FOUND` — unknown tenant code for this API host.	Check ids and the tenant code.
`409`	Conflict: duplicate, `MANAGED_ELSEWHERE`, concurrent change.	Look the resource up; don't retry blindly.
`422`	Validation failed; `errors` maps fields to messages.	Fix the listed fields.
`429`	Rate limit — see rate limits.	Wait `Retry-After` seconds.
`5xx`	Temporary problem on our side.	Retry with backoff.

The OAuth token endpoint returns OAuth errors ({"error": "invalid_client"}) instead of Problem Details, and the SCIM server returns SCIM errors (urn:ietf:params:scim:api:messages:2.0:Error).