In general, this API returns the appropriate HTTP return codes in order to signal an error condition, and provides additional details in the payload. This payload is encoded following the same rules as normal return data.
This API has to make exceptions to this principle wherever mandated by the OAuth RFCs, which take precedence.
The following are the HTTP response codes for the different HTTP methods.
Situation | HTTP Status | Notes | Returned by POST | Returned by GET |
Query completed successfully | 200 OK | No | Yes | |
Normal execution. The request has succeeded. | 201 Created | The operation results in the creation of a new resource. | Yes | No |
Delete operation completed successfully | 204 No Content | No | No | |
Request has malformed, missing or non-compliant JSON body or URL parameters | 400 Bad Request | The requested operation will not be carried out. | Yes | No |
Authorization header missing or invalid token | 401 Unauthorized | The operation was refused access. | Yes | Yes |
Token invalid, has incorrect scope or a security policy was violated | 403 Forbidden | The operation was refused access. | Yes | Yes |
The operation was refused as too many requests have been made within a certain timeframe. | 429 Too Many Requests | Throttling is a NFR. | Yes | Yes |
Something went wrong on the API gateway or micro-service | 500 Internal Server Error | The operation failed. | Yes | Yes |
Service may return other standard HTTP status codes (e.g. from gateways and other edge devices) as described in RFC 7231 – Section 6.