Skip to main content

Error Code Reference

Every Orbit API error response carries a machine-readable code, human-readable message, HTTP status, and contextual details. This page is generated from the canonical ERROR_CODES registry in packages/shared/src/errors.ts and lists every code in that registry — 732 in total — grouped by domain. Every code listed here is one the SDK and meta.docs_url link against. Some route handlers also return operational codes that are not yet in the registry and so are absent from the table below, so treat the code on any server response as authoritative even when it is not listed here.
HTTP status codes shown reflect the canonical status documented in the source. Some codes are reused at multiple call sites with different statuses (e.g. VALIDATION_ERROR may surface as 400 or 422); the table picks the dominant value. Treat the status field on the response envelope as authoritative for any given response.

Error Response Format

The meta.docs_url on an error envelope is a bare /errors/<CODE> path, and docs redirects every /errors/* URL to this page with an HTTP 307 — so follow the link when you can read the page, and when you cannot, the anchor /reference/error-codes#CODE_NAME (case-insensitive) is the stable per-code target no /errors/* URL will ever claim.

Worked example — a 422 envelope end to end

From a code to a runbook

When an error carries a code that has no dedicated runbook page yet, route it by CLASS — do not read the description column as the only hint. If the runbook for a code exists, it is linked from the Troubleshooting hub — the docs_url anchor on this page is the fallthrough, not the only destination.

Authentication

Validation

The four pre-send validation gates INVALID_PHONE_NUMBER, INVALID_FROM_NUMBER, INVALID_EMAIL, and MISSING_REQUIRED_FIELD share one decode-and-fix walkthrough on the validation gates runbook: read error.details for the field-level hint, pre-flight the value with GET /api/v1/numbers/lookup/{phoneNumber} or an E.164 formatter, correct the named field, and re-send once. | ATTACHMENT_TOO_LARGE | 422 | 422 — POST /inbox/tickets/:id/attachments refused to register a ticket attachment because the declared size_bytes exceeds the per-attachment ceiling (TICKET_ATTACHMENT_MAX_BYTES, 25 MiB). | | INVALID_CURSOR | 400 | HTTP 400 — a cursor-paginated list endpoint rejected the cursor query parameter because it is malformed, truncated, tampered, or no longer resolves to a row in the current result window. | | TURNSTILE_REQUIRED | 422 | 422 — a public, unauthenticated anti-bot endpoint rejected a submission because the Cloudflare Turnstile token was missing, malformed, or failed siteverify (fail-closed when the Turnstile secret is configured). |

Resources

Rate Limiting

Messaging

The re-authentication / Embedded Sign-up family from WHATSAPP_TOKEN_EXCHANGE_FAILED through WHATSAPP_CONNECTION_NOT_FOUND (token exchange, selection, ownership, business-verification, and the platform-side Meta app flag) shares one recovery walkthrough on WhatsApp re-authentication and connection recovery.

Telegram

Email (test-mode gate)

Crypto envelope

Voice

KBA caller verification

The seven codes below fire on the knowledge-based caller-verification flow (POST /api/v1/voice/kba/:callId/start, /verify, plus the sensitive action gate). The consolidated runbook is KBA caller-verification session errors; the flow concept lives on KBA caller verification.

Video rooms

Agent

Agent Eval

Billing

Presence federation

Tenant / Multi-tenancy

System

Audit #WAVE-O-FOUNDATION — Orby

Audit #AGT-001 — confirmation-gate redemption

Audit #AGT-007 — custom-tool dispatch body cap

Audit #AGT-002 — accurate cost cap

Audit #WAVE-O-NEW-ENDPOINTS

Video / Rooms (server-side fallback codes)

Numbers / Provisioning

Compliance (DSAR / RMD / Residency / Traceback)

Campaigns / Journeys

Contacts / Imports

CDP public ingest (signed-HMAC track API)

Co-browse (live screen-share)


Handling Errors in Code

Node.js — retrying 429 with backoff

Python

The Python SDK subclasses OrbitError per HTTP class — OrbitAuthenticationError (401/403), OrbitRateLimitError (429, carries retry_after), OrbitClientError (other 4xx), and OrbitServerError (5xx) — so catch a subclass when you want the specific class. OrbitError itself catches every API failure.

Go

Java, C#, PHP, Ruby

The Java, C#, PHP, and Ruby SDKs are pre-publish — not yet on Maven Central, NuGet, Packagist, or RubyGems, so the registry blocks on the per-language SDK pages describe the future registry shape. Vendor the source from the monorepo (sdk-java, sdk-csharp, sdk-php, sdk-ruby) and use the SDK anyway: its escape-hatch client call — client.request (Java and Ruby), client.RequestAsync (C#), or $client->request (PHP) — covers the whole API surface, errors included. Each language page walks the same model end to end. An Orbit-originated OrbitError carries error_code / status_code / request_id; the escape hatch throws the same typed error subclasses as the typed methods, so the catch taxonomy matches every other sample on this page.
The Devotel and DevotelApiError aliases are exported for compatibility with early-access code but Orbit / OrbitApiError are the canonical names in @devotel-orbit/node v0.2+.
A first-party Python SDK is on the roadmap but not yet shipped. Until then, decode the JSON response body and read meta.request_id / error.code / error.message directly from any HTTP client.
Always include the request_id from the error response meta when contacting Orbit support. This allows us to trace the exact request through our infrastructure.