Errors

2mee uses standard HTTP status codes and a consistent JSON error body.

Error body

{
  "error": {
    "code": "invalid_signature",
    "message": "The webhook-signature header did not match the request body.",
    "requestId": "req_01HZX9..."
  }
}

Field	Notes
code	A stable, machine-readable string. Branch on this, not the message.
message	Human-readable explanation. May change; don’t parse it.
requestId	Quote this when contacting support — it locates the request in our logs.

Status codes

Status	When	What to do
200 / 202	Success / accepted	Proceed. 202 means queued for async processing.
400	Malformed request (bad JSON, missing required field)	Fix the payload; do not retry unchanged.
401	Missing/invalid auth or signature	Check your secret/token and signing. Don’t retry unchanged.
403	Authenticated but not allowed (e.g. provider not enabled)	Request access; don’t retry.
404	Unknown resource (e.g. bad inboundKey)	Check the URL. Don’t retry.
409	Duplicate (idempotency key already seen)	Treat as success.
413	Payload too large (over 256 KB)	Reduce the body. Don’t retry unchanged.
422	Well-formed but semantically invalid	Fix the values; don’t retry unchanged.
429	Rate limited	Back off and retry per Retry-After. See rate limits.
5xx	Server error	Retry with exponential backoff.

Retry guidance

• Retry on 429, 5xx, timeouts and connection errors — with exponential backoff and jitter.
• Do not retry 400, 401, 403, 404, 409, 413, 422 without changing the request — they won’t succeed on repeat.

This mirrors how 2mee treats your endpoints on the outbound side — see retries & idempotency.