The card payment link was created. Eight keys.

status is the literal active, and amount_usd and original_amount echo the numbers as you sent them rather than as they were stored — the stored values carry two decimal places.

The account is not verified. Both codes use the ordinary envelope and both carry meta.

The request carried no key, a key that could not be parsed, or a key that did not verify.

A 401 has two different body shapes, and which one you get depends on the layer that refused you, not on the status code.

Authentication runs in middleware, ahead of every controller, and that layer answers with error and code — no success, no message. All five middleware codes are listed below. It also runs before validation, so a request with no key and an invalid body comes back as a 401 rather than a 422.

Six operations — create, read and cancel on payment links, and the same three on card payments — can also return a 401 from inside the controller, in the ordinary {success, code, message} envelope with code: INVALID_API_KEY. That one means the key verified but its own record is incomplete: it carries no creating user, which is how these six reach your payment links. The fault is the key record, not the account, and the key has to be replaced. The same six pair it with 404 USER_NOT_FOUND — "User associated with API key not found" — for the case where that user existed and no longer does. The other ten operations cannot produce it.

Do not switch on the status code to decide which shape to parse. Test for the key you need: the middleware envelope has error, the ordinary envelope has success and message.

Four refusals share this status, in three different envelopes. The two shared ones are described under the shared 403; the other two are this operation's own and use the ordinary {success, code, message} envelope.

BUSINESS_TENANT_PAUSED — your account is paused. CARD_PAYMENTS_NOT_ENABLED — card payments are not enabled on your account; the message says "tenant" where the rest of this documentation says account.

The key verified, but the user it was created by no longer exists.

The request was understood and refused.

errors is optional, including on code: VALIDATION_FAILED. The field-by-field map is what a failed validator produces; other refusals carry the same code with a prose message and no errors key at all. Read message first and treat errors as extra detail when it is there.

When errors is present, its values are not always arrays of strings. A validator emits {"<field>": ["<message>", ...]}, but other 422s on this API put a single string or a single integer under a key of their own. Type the map's values as unknown and inspect before you index.

Several 422s carry no errors key: among them WALLET_NOT_FOUND, USD_ACCOUNT_NOT_ENABLED, EXCHANGE_RATE_UNAVAILABLE and WEBHOOK_ALREADY_EXISTS. The codes that can reach a given operation are listed on that operation.

Two independent limiters run on every operation, and they answer with different bodies, different codes and different headers.

By client IP — 100 requests per 60 seconds. This one runs before authentication, so unauthenticated requests count against it too, and every integrator behind the same egress IP shares one budget. Its refusal carries code: RATE_LIMIT_EXCEEDED, in the ordinary envelope plus a retry_after.

By API key — the key's own limit per 60 seconds, 60 when a key is minted and settable between 1 and 10000. Its refusal carries code: rate_limit_exceeded in the middleware envelope.

The two codes differ in case as well as in shape, and that is the only reliable way to tell which limiter refused you.

Both windows are fixed rather than rolling: the window opens with its first request and the counter resets wholesale when it expires. retry_after, in whole seconds, is on both bodies and is the value to back off on.

Only the IP limiter sets Retry-After. A 429 from the per-key limiter carries no Retry-After at all, so read retry_after from the body rather than the header.

A successful response carries four counters: X-RateLimit-Limit-IP and X-RateLimit-Remaining-IP for the IP limiter, X-RateLimit-Limit and X-RateLimit-Remaining for the key limiter. There is no reset header on either pair.

Something failed on our side, or in a system we depend on.

Only code is contractual. message is not. Two codes reach this status here: SYSTEM_DATABASE_ERROR and CARD_PAYMENT_ERROR, the latter when the call to the card platform fails. Neither message is a documented string — do not parse it, do not match on it, and do not show it to a payer.