Standard statuses are 401 invalid authentication, 403 insufficient access, 404 unavailable resource, 422 validation failure, and 429 rate-limit exceeded. Validation responses contain message and field-keyed errors arrays.
The limit is 120 requests per minute per token/IP combination. Back off on 429, add jitter, and resume from the last successful cursor. Responses use Cache-Control: private, no-store. Record the X-Request-Id response header in secure operational logs and include it when contacting support; never include the bearer token.
