Return codes
Return and error codes
| Code | Meaning | Cause | Recommended action |
|---|---|---|---|
200 | Success | The request was processed. In the JSON envelope, status is 0. | — |
206 | Partial Content | Sign-in requires an MFA step. | Complete the challenge through the returned linkURL. |
400 | Bad Request | Invalid parameters or format, missing credential, Basic sent to a route that requires a Bearer token, or missing CF-Turnstile-Response header. | Review parameters, headers and body. |
401 | Unauthorized | Nonexistent user, invalid password, or a token that has expired or has an invalid signature, issuer or audience. | Check the credentials or obtain a new token. |
403 | Forbidden | User access rule (blocked connection, time window, filters, session limit), host different from the configured one, or Turnstile token rejected. | Use the host provided by the administrator and check the user’s rules on the STCP platform. |
404 | Not Found | File, link or resource not found, or link expired. | Check the endpoint and whether the link is still valid. |
405 | Method Not Allowed | The HTTP method is not supported on the endpoint. | Use the method given in the API reference. |
500 | Internal Server Error | Internal failure. | Try again; if it persists, contact support. |
503 | Service Unavailable | External validation service unavailable, such as Cloudflare Turnstile. | Try again; if it persists, contact the administrator. |
Response envelope
Most operations respond with a JSON object with the fields below, plus each operation’s own fields:
| Field | Description |
|---|---|
status | 0 on success. |
description | Result description. |
apiver | API and product version that responded (e.g. v2 (9.0.1)). |
user | Authenticated user, when applicable. |
time | Server date and time of the response. |
{
"status": 0,
"description": "<description returned by the API>",
"apiver": "v2 (9.0.1)",
"user": "<user>",
"time": "<date and time>"
}The error body format varies between endpoints: handle the HTTP status first and, when available, use the returned description. The token endpoints (/auth/token and /oauth2/token) use the OAuth 2.0 error format (error, error_description, error_uri). See API codes and events.