API errors and troubleshooting

Every v1 failure uses this envelope:

{
  "error": { "code": "invalid_token", "message": "Invalid token" }
}

Status	Meaning
400	A required parameter is missing or malformed.
401	The bearer token is missing, malformed, or invalid.
403	The authenticated key cannot perform the operation.
404	The website or resource does not exist.
429	Too many requests; retry with backoff.
500	Unexpected service failure; retry later.

Common codes are bad_request, missing_auth, invalid_token, website_not_found, forbidden, and internal_error. A key only works with its own website ID. Never log the bearer token while troubleshooting.