Errors

Partner API responses carry a JSON body with a status boolean and a message. Use the HTTP status code as the primary signal.

Status codes

Code	Meaning	React by
200	Success.	Read data / count. Note some handlers return { "status": false } at 200 for business-rule rejections (see below).
401	Authentication failed — missing, malformed, revoked, or expired key.	Check the key is sent and current. Do not retry with the same key if it’s revoked/expired — rotate.
403	Authorized, but not allowed — the key lacks the scope, or the brand lacks the entitlement.	Confirm your key’s scopes and your brand’s entitlements. Retrying won’t help until they’re changed.
404	The route or record doesn’t exist for you.	Check the path; for /.../{id}, confirm the id belongs to your company.
429	Rate limit exceeded (enforced at the gateway).	Back off and retry — see Rate limits.
5xx	Server error.	Retry with backoff; if it persists, contact OpenBrix support with the timestamp.

401 messages

{ "status": false, "message": "No API key provided." }
{ "status": false, "message": "Invalid API key." }

The second covers all of: malformed, unknown prefix, revoked, expired, or a secret that doesn’t match the stored hash. The API deliberately does not distinguish these, to avoid leaking which keys exist.

403 messages

{ "status": false, "message": "This API key does not have the '<scope>' scope." }

A scope failure names the missing scope. An entitlement failure is also a 403 — it means your brand isn’t entitled to that service regardless of scope.

The { "status": false } at 200 pattern

Some business-rule rejections (for example, acting on a record in a state that doesn’t allow it) return HTTP 200 with { "status": false, "message": "<reason>" } rather than a 4xx. Always check the status field, not just the HTTP code, before treating a 200 as success.