Error codes
| Code | HTTP | When |
|---|---|---|
UNAUTHORIZED | 401 | Missing or invalid API key or JWT |
FORBIDDEN | 403 | Valid auth but insufficient permissions |
AGENT_NOT_FOUND | 404 | Agent ID does not exist |
TOKEN_INVALID | 422 | Token present but fails cryptographic validation |
TOKEN_EXPIRED | 422 | Token signature valid but expiry has passed |
TOKEN_REVOKED | 422 | Token valid but agent has been revoked |
RATE_LIMIT_EXCEEDED | 429 | Caller exceeded their rate limit tier |
VALIDATION_ERROR | 400 | Request body missing required fields or malformed |
INTERNAL_ERROR | 500 | Unexpected server error — always logged, never exposes stack traces |