API errors and request diagnostics
Read the HTTP status and error code before retrying.
Editorial update: October 30, 2026In this guide
Website-email errors
| Response | Meaning and action |
|---|---|
| 400 INVALID_INPUT | Check JSON, fields, recipients and the required idempotency key. |
| 401 INVALID_DELIVERY_KEY | Check the project key and whether it was rotated or stopped. |
| 403 INVALID_SENDER | from does not belong to the project’s permitted domain. |
| 402 TRANSACTIONAL_QUOTA_REQUIRED / TRANSACTIONAL_QUOTA_EXHAUSTED | No current quota or quota is exhausted; check purchase and activation. |
| 409 IDEMPOTENCY_CONFLICT | The same key was reused for different content; review the business event. |
| 404 NOT_FOUND | Check the ID and project key; other projects’ messages are inaccessible. |
| 429 PUBLIC_RATE_LIMIT | Wait before retrying; rate limiting differs from exhausted quota. |
Typical error shape
{"error":"IDEMPOTENCY_CONFLICT"}OAuth errors
- invalid_client: check Basic authentication, client_id and the current secret.
- invalid_grant: an invalid code/refresh token, mismatched verifier or callback, or a revoked grant. Obtain new consent when needed.
- access_denied: the user denied access; do not repeatedly force consent.
- INVALID_TOKEN on resource reads: check the access token, its lifetime and the mailbox granted.
What to retain for diagnostics
Keep endpoint, timestamp, HTTP status, error code and message ID when present. Remove Authorization, secrets, bodies and activation links from logs and screenshots. Do not fix a timeout by generating a new sending key for the same event.