API
Errors
The Arrota API error format, every HTTP status it returns, and which errors are safe to retry.
Updated
On this page
Error format
Errors return a JSON body with a human-readable error. Some add a machine-readable code, and validation errors add fields:
{
"error": "Please correct the highlighted fields.",
"fields": {
"work_email": "A valid email address is required.",
"issue_date": "Use a date in YYYY-MM-DD form."
}
}{
"error": "That record is not eligible for third-party verification. Only active records issued by an organisation can be checked.",
"code": "RECORD_NOT_ELIGIBLE"
}Branch on the HTTP status and code. The error text is written for people and may change. Responses do not include a request or correlation ID.
Status codes
| Status | Meaning | Retry? |
|---|---|---|
| 200 | Success. For issuance, the credential already existed. | |
| 202 | Accepted: a credential was issued or a verification request created. | |
| 400 | The request is invalid: body, query parameter, cursor or business rule. | No. Fix the request. |
| 401 | The API key is missing, malformed, unknown or revoked. | No. Check the key. |
| 403 | The key lacks the scope, the plan lacks API access, or the action is not allowed for this organisation or record. | No. |
| 404 | The resource does not exist or is not yours. | No. |
| 429 | Rate limit reached. | Yes, after Retry-After seconds. |
| 500 | Something failed on Arrota's side. | Yes, with backoff (see below). |
| 503 | The API is temporarily unavailable. | Yes, with backoff. |
Error codes
code | Status | Endpoint |
|---|---|---|
SELF_ATTESTATION_BLOCKED | 400 | Issue a credential |
DOMAIN_NOT_ALLOWED | 400 | Issue a credential |
TEMPLATE_NOT_ALLOWED | 400 | Issue a credential |
TEMPLATE_TYPE_MISMATCH | 400 | Issue a credential |
SEAT_CAP | 403 | Issue a credential |
RECORD_NOT_ELIGIBLE | 403 | Submit a verification request |
DISCLOSURE_REFUSED | 403 | Submit a verification request |
Retrying safely
- Wait for
Retry-Afteron429, and back off exponentially on500and503. - Retrying a credential issuance is safe when you send the same body with an explicit
issue_date. See Idempotency. - Do not blindly retry
POST /api/v1/verifications: each accepted call creates a new request. If it returns500with arequest_id, the request exists already. - Never retry
400,401,403or404unchanged.