Error reference
Stable API error codes returned in code, message, retryAfter, and docsUrl.
API errors return code, message, optional retryAfter, and docsUrl. Each code has a stable anchor, so docsUrl always points at the exact section below.
invalid_request
The request body, params, query, or manifest is not valid.
unauthorized
This endpoint requires a guest identity, publish token, or signed-in account.
forbidden
The credential is valid, but it cannot perform this action.
not_found
The route, artifact, version, session, or thread does not exist.
rate_limited
You hit a publish, comment, or report rate limit. Retry after retryAfter seconds.
payload_too_large
A file or artifact exceeds the publish size limits.
session_expired
The publish session expired before finalize.
session_finalized
You already finalized this publish session.
uploads_incomplete
Finalize ran before every required upload reached storage.
claim_token_invalid
The claim link isn't valid.
claim_token_expired
The claim link expired with the anonymous artifact window.
claim_token_used
You already used the claim link.
already_claimed
The artifact already has an owner.
slug_taken
Another artifact already uses that slug.
slug_reserved
artifact.cafe reserves that slug.
password_required
The artifact is password-protected and the request had no valid unlock cookie, publish token, or owner session.
invalid_password
The password you submitted to unlock a protected artifact is incorrect.
workspace_required
The artifact is visible to its workspace's members only. Retry with a member session or API key (Authorization: Bearer ack_...).
review_closed
The artifact's author has closed it to new feedback (its review mode is readonly or off), so comments, replies, reactions, and edits are refused. Deleting a comment you wrote, deleting a thread you manage, and resolving or reopening existing threads still work.
origin_not_allowed
A state-changing browser request came from an origin that isn't artifact.cafe, one of its workspace subdomains, or the host serving the request (a workspace's custom domain). Requests authorized by a Bearer token (publish token or API key) are never checked.
provisioning_failed
Enabling a workspace subdomain could not reach the DNS or hosting provider, so nothing was changed and the subdomain stays off. Retry after retryAfter seconds.
internal_error
The server hit an unexpected error.