• 400 Bad Request — a required field is missing or a rule was broken. Check the body against the rules on the relevant page.
• 401 Unauthorized — invalid API key or no session. See Authentication Methods.
• 402 Payment Required — not enough credit. See The Credit System.
• 403 Forbidden — the URL is blacklisted, or the resource belongs to another account.
• 404 Not Found — no flow, node or record with that id.
• 422 Unprocessable Entity — validation failed. Work through the items in the message array.
• 500 Internal Server Error — an unexpected server error. Retry after a short delay.
• 504 Gateway Timeout — a background call exceeded 50 seconds. See Limits and Timeouts.

The standard shape:

Validation errors, where message is an array:

And from the auth layer:

• 401 but the key looks right — the header name is wrong; use x-api-key, not Authorization.
• 401 on a key that used to work — it was revoked (enabled: false). Create a new one.
• 402 — the balance is exhausted; check remaining via GET /api/users/api-keys.
• 403 on a scrape — the target URL is blacklisted.
• 400, POST rejected — method: "POST" in browser mode; switch to http or use fill_form.
• 400, capture rejected — capture_network in http mode; switch to browser.
• 504 on a template endpoint — the microservice call ran long; retry.

• 500, 502, 503, 504 — retry with exponential backoff, at most three times (2 s, 4 s, 8 s).
• 400, 401, 402, 403, 404, 422 — do not retry; fix the request or the account first.
• Scraping requests already retry internally as many times as options.retry_count allows.