Errors

Every error response is an RFC 7807 application/problem+json envelope. Branch your error handling on the stable code string, not the human-readable detail.

Envelope

{
  "type": "https://api.secfix.com/problems/not_found",
  "title": "Not Found",
  "status": 404,
  "detail": "No asset found for the given id.",
  "instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
  "code": "not_found",
  "requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2"
}

Always include the requestId when contacting support — it correlates your request with our logs. The instance field is included on some errors (for example 404 not_found) and omitted on others.

Request ids

Send an X-Request-Id header to use your own correlation id. We echo the accepted value back on the X-Request-Id response header of every request, and it appears as requestId in error envelopes. To be accepted, the value must be 1–64 characters of A–Z, a–z, 0–9, -, or _. Anything longer, empty, or containing other characters is replaced with an id we generate. If your tracing ids exceed 64 characters, shorten them before sending, or omit the header and record the id we return instead. Omitting the header is always safe — we generate one for you either way.

Common codes

HTTP	`code`	Meaning
400	`validation_failed`	The request body, parameters, or a required header are invalid — e.g. an unknown tag key, `tags` in a bulk update, or a missing/too-long `Idempotency-Key`.
400	`malformed_request`	The request body could not be parsed (e.g. invalid JSON).
401	`unauthorized`	Missing or invalid access token.
401	`token_superseded`	The token was replaced by a newer one (single active token). Fetch a fresh token.
401	`invalid_client`	The `client_id` / `client_secret` pair on `POST /oauth/token` is invalid.
403	`scope_required`	The token lacks the access required by the endpoint. See Scopes.
403	`resource_not_writable`	The resource cannot be modified (e.g. an employee row).
404	`not_found`	The resource does not exist, or is not in your workspace.
405	`method_not_allowed`	The HTTP method is not supported on this path.
409	`idempotency_conflict`	An `Idempotency-Key` was reused with a different request body.
413	`payload_too_large`	The request body exceeds the allowed size.
415	`unsupported_media_type`	The `Content-Type` is not supported (writes require `application/json`).
429	`rate_limited`	You exceeded your rate limit. See Rate limits.
500	`internal_error`	An unexpected server error. Retry later; include the `requestId` if it persists.

The token endpoint may also return unsupported_grant_type (400) for an invalid grant_type.

Get started

Core concepts

Guides

Envelope

Request ids

Common codes

​Envelope

​Request ids

​Common codes

Envelope

Request ids

Common codes