Errors
REST and MCP share the same public error categories. This page lists interface signals only — not internal review reasoning or scoring logic.
Error envelope
{
"error": "permission_denied",
"resource": "risk",
"action": "write",
"requiredAccess": "read-write"
}
Status meanings
| Status | Meaning |
|---|---|
400 | Body failed Zod validation. errors[] lists field paths. |
401 | Missing, malformed, or revoked API key. |
403 | permission_denied — RBAC role lacks the required permission. |
404 | Resource does not exist, or is hidden by row-level filtering. |
409 | Idempotency conflict (duplicate event, already-linked control, last-admin guard). |
422 | Logical validation failure (e.g. evidence hash malformed). |
429 | Rate limit. Honor Retry-After. |
5xx | Server error. Safe to retry with exponential backoff. |
Rate limits (per key)
| Surface | Limit |
|---|---|
| REST | 600 requests / minute, burst 30 / second |
| MCP | 120 tool calls / minute, burst 10 / second |
Mint separate keys per workload to isolate quotas.