Error codes
The code lists are append-only: a code is never removed or reordered, and a client must tolerate codes it does not know.
Siteverify error-codes
Section titled “Siteverify error-codes”Returned in an HTTP 200 body with success: false. Every input, authentication or authorization failure is a 200. Treat any non-200 as “not verified”.
| Code |
|---|
missing-input-secret |
invalid-input-secret |
missing-input-response |
invalid-input-response |
bad-request |
timeout-or-duplicate |
sitekey-secret-mismatch |
site-disabled |
quota-exceeded |
internal-error |
plan-required |
plan-restricted |
API error codes
Section titled “API error codes”Body: { "error": { "code", "message", "requestId" } }. Branch on code, not on message.
| Code | HTTP status |
|---|---|
bad-request |
400 |
not-found |
404 |
payload-too-large |
413 |
invalid-site-key |
400 |
hostname-not-allowed |
400 |
site-disabled |
400 |
challenge-expired |
400 |
challenge-invalid |
400 |
pow-invalid |
400 |
rate-limited |
429 |
quota-exceeded |
400 |
internal-error |
500 |
unsupported-media-type |
415 |
app-not-allowed |
400 |
plan-required |
402 |
plan-restricted |
402 |
Added by the assessment endpoints
Section titled “Added by the assessment endpoints”| Code | HTTP status |
|---|---|
unauthorized |
401 |
expired |
410 |
service-unavailable |
503 |
feature-disabled |
403 |
Reason codes
Section titled “Reason codes”The array index is the bit position in the encoded bitmap. Reasons explain a score; log them.
| Bit | Code |
|---|---|
| 0 | AUTOMATION |
| 1 | UNEXPECTED_ENVIRONMENT |
| 2 | TOO_MUCH_TRAFFIC |
| 3 | UNEXPECTED_USAGE_PATTERNS |
| 4 | DATACENTER_IP |
| 5 | ANONYMIZER |
| 6 | INTEGRITY_FAILED |
| 7 | LOW_CONFIDENCE_SCORE |
| 8 | NETWORK_MISMATCH |
| 9 | PLAN_RESTRICTED |