Errors
Every error the Shared Registry endpoints return, and how to handle each one
The registry endpoints use the standard error format:
{
"error": "FORBIDDEN",
"message": "This account is not an active Shared Registry member",
"statusCode": 403
}
Error reference#
| Status | error |
message |
Cause and fix |
|---|---|---|---|
| 400 | INVALID_REQUEST |
Describes the invalid field | The body does not match the schema. Common causes: a digest that is not 64 lowercase hexadecimal characters, more than five identifiers, an unknown context or category, or attest_human_review that is not true. Fix the request. Do not retry it unchanged. |
| 401 | UNAUTHORIZED |
Invalid or missing API key or API key has been revoked |
The key is missing, wrong or revoked. Check the Authorization header. |
| 403 | FORBIDDEN |
Missing required scope: registry:check (or registry:submit) |
The key does not carry the scope for this endpoint. A moderation key cannot call the registry. Use your registry key, or ask Omnifence for a key with the scope. |
| 403 | FORBIDDEN |
This account is not an active Shared Registry member |
Your membership is pending or suspended. Contact Omnifence. |
| 403 | FORBIDDEN |
Your membership does not allow reports in category: <category> |
Your membership does not include this category. Do not report it, or ask Omnifence to review your membership. |
| 403 | ACCOUNT_TERMINATED |
Client account has been terminated |
Your Omnifence account is terminated. Contact support. |
| 404 | NOT_FOUND |
Registry entry not found |
Revoke only: the entry does not exist, or another member reported it. |
| 429 | RATE_LIMITED |
Daily Shared Registry check quota of <quota> reached |
Check only: you used today's check quota. It resets at 00:00 UTC. Continue without the registry and re-check later. See Daily check quota. |
| 429 | RATE_LIMITED |
Rate limit exceeded |
You exceeded your account's per-minute or per-second limit. Wait for the retry-after header. See Rate limiting. |
| 503 | SERVICE_UNAVAILABLE |
Varies | The registry cannot answer right now. Retry later with backoff. |
Handling errors in a sign-up flow#
A failed check must not block legitimate users. Treat a 429, a 5xx or a timeout as "no answer":
continue the sign-up and re-check the user later with context periodic. Treat a 400, 401 or
403 as a bug or a configuration problem in your integration, and alert your team.
Handling errors when you report#
A failed report leaves other members unprotected, so retry 429 and 5xx responses with backoff
until the report succeeds. Reporting the same user again is safe: it refreshes the same entry. Fix
400 and 403 responses before you retry.