error message:
details object with per-field messages, so parse details when you get a 400:
GET /vault/register also returns the existing vault in details on a 409. Access errors from the API gateway (for example, an API key without Trigger access) use a different shape: { "code": 403, "message": "..." }.
This page covers the price-order and shared (auth, vault, deposit) endpoints. For DCA endpoint errors (/orders/dca, /orders/history/dca, /orders/dca/cancel, /confirm-cancel), see DCA errors.
Authentication errors apply everywhere
Every endpoint exceptPOST /auth/challenge and POST /auth/verify requires a JWT in the Authorization: Bearer <token> header. A missing, malformed, or expired token returns:
401. When you see a 401 on an authenticated call, re-run the challenge-response flow to get a fresh token. The tables below list the errors specific to each endpoint on top of this shared 401. The DCA endpoints share this 401 rule; their endpoint-specific errors are on the DCA pages.
Authentication
POST /auth/challenge
POST /auth/verify
Vault
GET /vault
GET /vault/register
Deposit
POST /deposit/craft
Orders
POST /orders/price
PATCH /orders/price/
POST /orders/price/cancel/
POST /orders/price/confirm-cancel/
History
GET /orders/history
Related
DCA Errors
Errors for the DCA create, track, and cancel endpoints.
Integration Flow
The full call sequence and order state machine.
Manage Orders
Update, cancel, and recover orders.
