Errors and cookies

Changes made with the session cookieCopy Anchor Link

Every change under the authenticated routes that carries the session cookie must come from the dashboard: any other Origin answers 403 invalid_request. Tenant apps live under the dashboard's own site, so the cookie's SameSite=Lax does not stop their pages, and CORS hides only the answer. A client with a bearer token, such as the CLI, is not asked.

Error ResponsesCopy Anchor Link

A refusal carries a machine code, one of a fixed set, beside today's words in error and whatever the next step needs (needs, missing, suggestion, install_url, ...). The dashboard leads on from the code and never prints the words; the CLI reads error. The staff and machine routes answer with error alone.

All errors return JSON:

{
  "code": "project_stopped",
  "error": "description of what went wrong"
}

Common status codes:

• 400: bad request, an input that is not valid
• 401: unauthorized, a token that is missing or not valid
• 403: forbidden, a role that does not allow it
• 404: not found
• 500: internal server error