Errors
Every refusal from the API is an RFC 9457 problem document with a stable code. This page says what each code means and what to do about it.
Switch on code, show detail to a person, and log requestId — support can find a single request by it. The type link points back at the matching heading below.
{
"type": "https://www.jobapplicationtracking.com/developers/errors#insufficient_scope",
"title": "Insufficient scope",
"status": 403,
"detail": "This credential was not granted applications:write.",
"code": "insufficient_scope",
"requestId": "01JQ7W4T9K2P8N6B0R5XZ3H1MC"
}missing_credential
HTTP 401Credential required
No Authorization header arrived. Send `Authorization: Bearer <key or access token>`; a credential in the query string is never read.
invalid_credential
HTTP 401Invalid credential
The credential was not recognised. Check for a truncated copy-paste, and check you are calling the deployment it belongs to.
credential_revoked
HTTP 401Credential revoked
The key was revoked, or the access token was withdrawn by the person who granted it. Issue a new one; retrying will not help.
credential_expired
HTTP 401Credential expired
The access token has passed its lifetime. Exchange the refresh token for a new one and retry once.
insufficient_scope
HTTP 403Insufficient scope
The credential is real but was not granted the scope this operation needs. The WWW-Authenticate header names the missing scope; re-issue the key with it, or ask for it in the next authorization request.
credential_restricted
HTTP 403Credential restricted
This credential is confined to one organization and the request named a different one. Use the organization it was issued for.
sandbox_only
HTTP 403Sandbox only
This operation exists only in the sandbox. Call it with a jat_test_ credential.
forbidden
HTTP 403Forbidden
The account this credential acts as is not allowed to do this — usually a role an organization has not granted it. Read /me and the organization membership before retrying.
not_found
HTTP 404Not found
No such resource, or none this account may see. The two are deliberately the same answer, so a 404 is never proof that something does not exist.
method_not_allowed
HTTP 405Method not allowed
The path exists but not with that method. The Allow header lists the ones it does answer.
validation_failed
HTTP 400Validation failed
The request body or parameters did not match the schema. The errors array names each field and why it was rejected.
conflict
HTTP 409Conflict
The change collided with the current state — a name already taken, or a row somebody else removed. Read the resource again and decide what to send.
unprocessable
HTTP 422Unprocessable request
The request was well formed but asks for something the product does not allow, such as deleting the only board on an account.
rate_limited
HTTP 429Too many requests
Too many requests. Wait for the number of seconds in Retry-After; RateLimit-Reset says when the window turns over.
idempotency_key_reused
HTTP 422Idempotency key reused
That Idempotency-Key was used for a different request body. Generate a new key per distinct request, and reuse a key only to retry the identical one.
idempotency_request_in_progress
HTTP 409Idempotent request already in progress
The first request carrying this key has not finished. Wait and retry; do not send it a second time in parallel.
payload_too_large
HTTP 413Payload too large
The body is bigger than this endpoint accepts. Split an import into smaller batches, or upload a smaller file.
unsupported_media_type
HTTP 415Unsupported media type
Send Content-Type: application/json, or the multipart type the endpoint documents for a file.
precondition_failed
HTTP 412Precondition failed
The If-Match you sent no longer describes the resource, so the write was refused rather than overwriting somebody. Read it again, decide, and retry with the new ETag.
internal_error
HTTP 500Internal error
Something broke on our side. Retry once; if it persists, contact support and quote the requestId.