Theme

Introduction

Errors

The Cirro API uses conventional HTTP response codes to indicate the success or failure of an API request. In general, codes in the 2xx range indicate success, codes in the 4xx range indicate an error that failed given the information provided (e.g., a required parameter was omitted, etc.), and codes in the 5xx range indicate an error with Cirro's servers (these are rare).

Error response format

The body of any error response will be a JSON object with a single error key containing a human-readable message:

{ "error": "message" }

HTTP status codes

StatusMeaning
200 - OKThe request succeeded.
201 - CreatedThe resource was successfully created.
208 - Already ReportedA request with the same idempotency key was already processed. The original response is returned.
400 - Bad RequestThe request was invalid, often due to missing or invalid parameters.
401 - UnauthorizedThe access token is missing, expired, or invalid.
403 - ForbiddenThe request is not allowed. The authenticated app does not have permission to perform the action.
404 - Not FoundThe requested resource does not exist or does not belong to your space.
422 - Unprocessable EntityThe request was well-formed but could not be processed due to semantic errors (e.g., validation failures, invalid state transitions, duplicate entries).
500 - Internal Server ErrorSomething went wrong on Cirro's end (these are rare).

Authentication errors

Authentication errors return a 401 status code. These occur when the JWT access token is missing, malformed, or expired.

Error messageDescription
Access token is missingNo authorization token was provided in the request header.
Access token is expiredThe JWT token has passed its expiration time.
Can not maintain an access token for longer than 10 minThe token's exp claim is set more than 10 minutes in the future.
Can not verify the access tokenThe token signature does not match the expected key.
Access token can not be decodedThe token is malformed and cannot be parsed.
No space found for the token subjectThe sub claim does not match a valid app ID.
No user found for the token ownerThe token's resource owner could not be found.
Access DeniedThe authenticated token does not have the required permissions.

Validation errors

Validation errors return a 400 or 422 status code. A 400 is returned when required parameters are missing or have invalid formats. A 422 is returned when the parameters are well-formed but fail domain-level validation (e.g., a record is invalid or a state transition is not allowed).

Common validation error scenarios:

Error messageStatusDescription
<param> is missing400A required parameter was not provided.
<param> does not have a valid value400A parameter value is not in the allowed set.
Duplicate entry422A uniqueness constraint was violated (e.g., creating a duplicate record).
Validation failed: <details>422An ActiveRecord validation failed. The message includes specific field errors.
<event> cannot transition422A state transition was attempted that is not allowed from the current state.

Resource-specific errors

Users

Error messageStatusDescription
Can not find user in your space404The specified user does not exist or is not a member of your space.

Gigs

Error messageStatusDescription
The gig is already started, <params> cannot be updated422Certain gig attributes cannot be changed once the gig has started.
The gig is already started and cannot be deleted422A gig that has already started cannot be deleted.
The gig is already archived422Users cannot be invited to an archived gig.
Cannot find users: <ids> to invite422One or more user IDs provided for invitation do not exist in your space.
Users can not be invited until new terms are accepted422The space has pending terms that must be accepted before invitations can be sent.

Gig Results

Error messageStatusDescription
The given user is not a community member of your space403The user specified is not a community member in your space.
Gig does not belong to your space403The gig task referenced does not belong to your space.
No rewarded results are expected for the gig400The gig invitation is flagged as no_reward, so results cannot be submitted.

Gig Time Activities

Error messageStatusDescription
The given user is not a community member in your space.422The user specified is not a community member in your space.
Can not find gig in your space404The specified gig does not exist or does not belong to your space.
No rewarded time activities are expected for the gig400The gig invitation is flagged as no_reward, so time activities cannot be submitted.

Payouts

Error messageStatusDescription
The given user is not a community member of your space422The user specified is not a community member in your space.
You can not delete payouts which are already billed422A payout that has already been billed cannot be deleted.

Notification Topics

Error messageStatusDescription
only snake_case(lowercase letters) allowed400The topic name parameter must use snake_case format.

Idempotency

When you include an Idempotency-Key header in a create request and a previous request with the same key has already been processed, the API returns a 208 Already Reported status with the original response body. This is not an error — it indicates the request was already fulfilled.

Handling errors

We recommend writing code that handles errors gracefully. Here are some best practices:

  • Check the HTTP status code before parsing the response body.
  • Parse the error field from the JSON response to get a human-readable description of what went wrong.
  • Retry on 5xx errors with exponential backoff, as these indicate temporary server issues.
  • Do not retry 4xx errors without modifying the request, as the same request will produce the same error.
  • Use idempotency keys for create requests to safely retry without risking duplicate records.
Previous
Authentication