Error codes

Every JSON API error uses the same envelope, so a client can branch on a stable code rather than parsing prose:

{
  "error": {
    "code": "SYNC_WEEKLY_LIMIT_REACHED",
    "message": "Cloud report limit reached. This scan stays local.",
    "requestId": "3f2b…",
    "details": { "daily": { "used": 5, "limit": 5, "resetsAt": "…" } }
  }
}

Field	Notes
`code`	Stable. Branch on this.
`message`	Human-readable. May change.
`requestId`	A fresh UUID per response, for correlating with server logs.
`details`	Optional, code-specific.

CLI messaging is friendlier, but it branches on the same codes.

General

Code	HTTP	Meaning
`BAD_REQUEST`	400	A required field is missing or malformed. Also used with an explicit 413 when a body exceeds the endpoint’s byte limit, because the wire contract has no payload-too-large code yet.
`VALIDATION_FAILED`	422	The shape was right but a value was not acceptable — a weak password, an invalid email, an invalid projection policy.
`UNAUTHENTICATED`	401	No credential, a malformed credential, or a credential that did not match.
`FORBIDDEN`	403	Authenticated, but not permitted — not a workspace member, an inactive account, or a plan limit.
`NOT_FOUND`	404	The resource does not exist, or exists and you may not know that.
`CONFLICT`	409	The operation collides with existing state — an email already registered, a binding owned by another workspace, an upload already finalized.
`RATE_LIMITED`	429	A throttle was exceeded. Wait and retry.
`INTERNAL`	500	Something failed on the server. The detail is in the server log, not in the response.

Device linking

Code	HTTP	Meaning
`DEVICE_LINK_EXPIRED`	410	The link request expired. Link requests live 10 minutes. Start a new one.
`DEVICE_LINK_ALREADY_CONSUMED`	409	The link request was already exchanged. A verifier cannot mint a second credential.
`DEVICE_LINK_NOT_APPROVED`	428	Nobody has approved the device in a browser yet. Keep polling `…/status`.
`DEVICE_REVOKED`	401	This device credential was revoked. Run `myrqen link` again.

Sync and reports

Code	HTTP	Meaning
`SYNC_DAILY_LIMIT_REACHED`	429	The plan’s daily cloud-report limit is reached. `details` carries both windows. The scan still runs locally.
`SYNC_WEEKLY_LIMIT_REACHED`	429	The plan’s weekly limit is reached.
`REPORT_EXPIRED`	410	The report passed its retention window and its contents were deleted. Your local files are unaffected.
`REPORT_SCHEMA_UNSUPPORTED`	422	The uploaded body failed schema validation, or the declared `schemaVersion` is not `1.0.0`.
`UNSAFE_PAYLOAD_REJECTED`	422	A progress or analytics event did not match its closed schema. This is the guard that stops source, prose, evidence, or secrets travelling through the progress path.

Code	HTTP	Meaning
`SHARE_PASSWORD_REQUIRED`	401	Supply the password in the `x-myrqen-share-password` header.
`SHARE_NOT_AVAILABLE`	404	The link is revoked, expired, or not permitted for this viewer — deliberately indistinguishable, so the response discloses nothing.

Too many wrong passwords on one link returns RATE_LIMITED: 10 attempts per 10 minutes. Correct attempts are not counted, so one attacker cannot lock out the link’s legitimate readers.

Client versions

Code	HTTP	Meaning
`CLIENT_VERSION_REVOKED`	403	This CLI version was revoked by the platform. Update.
`CLIENT_VERSION_TOO_OLD`	403	This CLI version is below the deployment’s minimum supported version.

Platform support

Operator-only. You will only see this on a deployment you run, acting as its platform administrator. The endpoints that produce it are not documented here.

Code	HTTP	Meaning
`SUPPORT_GRANT_REQUIRED`	403	A platform administrator asked for customer report content without an active support grant. A grant needs a written reason of at least 12 characters, a bounded expiry, and a password re-entry — and every use is audited.

Rate limits

Per-endpoint budgets from apps/web/lib/rate-limit.ts:

Surface	Limit	Window
Login	10	5 minutes
Login, per account	20	15 minutes
Signup	20	1 hour
Device-link creation	10	10 minutes
Device-link exchange	60	10 minutes
Share password attempts	10	10 minutes
Progress events	600	1 minute
Analytics, per principal	600	1 minute
Analytics, per address	1200	1 minute
Support-grant re-authentication (operator-only)	5	10 minutes

Login and recovery throttles are keyed on both the network and the account being signed in to, because a caller who rotates X-Forwarded-For has no trustworthy network identity to be throttled by.

Request body limits

Surface	Limit
Any JSON route	1 MiB
Report body upload	`MAX_REPORT_BYTES`, default 12 MiB
Progress events per request	25
Analytics events per request	50

A declared Content-Length over the limit is refused before a byte is read; a chunked body that lies about its size is refused mid-stream and the remainder is never buffered.

CLI exit codes

Code	Meaning
`0`	Success.
`1`	Any other failure.
`2`	The finding submission was rejected.
`3`	Out of scope, or not authorized.
`4`	The planned action is prohibited.

Getting started

Core concepts

Guides

Reference

Troubleshooting

General

Device linking

Sync and reports

Client versions

Platform support

Rate limits

Request body limits

CLI exit codes

​General

​Device linking

​Sync and reports

​Sharing

​Client versions

​Platform support

​Rate limits

​Request body limits

​CLI exit codes

General

Device linking

Sync and reports

Sharing

Client versions

Platform support

Rate limits

Request body limits

CLI exit codes