Authorization error codes
Every public API error code emitted by Authorization, with its HTTP status, its type and a page per code.
Error codes emitted by Authorization. Each code links to its own page with the cause and the action to take.
| Code | Type | HTTP | Description |
|---|---|---|---|
addon_not_active | authorization_error | 403 | The functionality belongs to an add-on that is not active for the company right now. |
company_read_only | authorization_error | 403 | The person who issued the credential has read-only access (level view) to the effective company: their role in the account lets them see that tax ID, not write to it. The effective level is the lower of the one stored on the credential and the one the person holds today. |
emitter_capability_restricted | authorization_error | 403 | The person who issued the credential has the section or action required by the operation withdrawn in the effective company. It is the same per-module restriction the company administrator set for them in the web app, and it applies even if their access level to the tax ID is operate. |
feature_not_available_in_plan | authorization_error | 403 | The feature is not included in the company plan. |
forbidden_action | authorization_error | 403 | The action is refused even though the scope is right. The usual reasons are: your credential reaches the tax ID through an account relation (access granted to your account, or a managed account) and the operation belongs to the account that owns the tax ID — request logs, events, webhook endpoints, account billing, automation usage and writes of connected payment credentials are never available through a relation; the tax ID belongs to a managed account whose holder already pays for it, so its provider can read it and edit its data but can no longer activate, deactivate or archive it; the person who issued the credential is not an owner or admin of the account, or the credential does not reach every tax ID of the account; or the resource belongs to a shared catalogue, or the change travels through a different endpoint. |
insufficient_scope | authorization_error | 403 | The key authenticates correctly but does not carry the scope this operation requires. Scopes are granted when the key is issued and are not widened at call time. |
max_api_keys_exceeded | authorization_error | 422 | The company reached the number of API keys its plan allows. |
max_webhook_endpoints_exceeded | authorization_error | 422 | The company reached the number of webhook endpoints its add-on tier allows. |
module_not_available_in_sandbox | authorization_error | 403 | The resource belongs to a module vetoed in test mode. Sandbox never touches AEAT, banks or real billing, so those modules stay out on purpose. |
portfolio_max_api_keys_exceeded | authorization_error | 422 | The account already holds the maximum number of ACTIVE credentials that a portfolio allows. The cap applies once the account has two or more real tax IDs and is counted over all the active credentials of the account, not per tax ID, so adding another tax ID to mint its credential will not let you create this one either. |
scope_not_allowed_by_plan | authorization_error | 422 | One of the requested scopes belongs to a module that the plan does not include, so the key would be born with a permission that could never be exercised. |
scope_not_allowed_in_sandbox | authorization_error | 422 | A test key cannot be born with scopes of modules vetoed in sandbox. |
Related
Error codes by category
Find an error by the category that emits it.
Full reference table
All codes, HTTP statuses, types and descriptions in one reference.
Error model
Interpret the error envelope and handle errors by code.