# Errors

\
The Sway Charts REST API relies on the standard HTTP status codes for communicating errors. Codes in the range of `400-499` indicate an error on the client side which can be fixed by amending the request and re-trying. Codes in the range of `500-599` indicate a server-side error.

The Sway Charts REST API _does not_ use any custom status codes. Each error is reported via the status code; the response body includes an internal error code (if applicable) as well as the error description.

| Status code                  | Error                                                                                                                                          | Additional information                                                                                                                                              |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 400 Bad Request              | Client sent a malformed request, such as missing Host header or a semantically incorrect request                                               | The client should not repeat the request without modifications                                                                                                      |
| 401 Unauthorized             | Client is not authorized in the system.                                                                                                        |                                                                                                                                                                     |
| 403 Forbidden                | Client submitted a request without the required condition                                                                                      | For security reasons, 403 Forbidden status code is not used to indicate resources for which the client has no permissions. In this case the 404 status code is used |
| 404 Not Found                | Either the resource does not exist or client is not permitted to access the resource.                                                          |                                                                                                                                                                     |
| 405 Method Not Allowed       | HTTP method specified in request is not permitted for this resource                                                                            | Response must contain an Allow header with the list of supported methods.                                                                                           |
| 406 Not Acceptable           | The API doesn't support the specified representation format                                                                                    |                                                                                                                                                                     |
| 409 Conflict                 | The API understood the request but there are semantic issues with the request and the request could not be validated                           | Used to indicate application-level errors, see [application-level errors](https://api.swaycharts.io/developers/#/DXtrade-REST-API?id=application-level-errors)      |
| 412 Precondition Failed      | Conditional request failed                                                                                                                     | See [conditional requests](https://api.swaycharts.io/developers/#/DXtrade-REST-API?id=conditional-requests)                                                         |
| 413 Request Entity Too Large | REST API refuses to process a request because request size is greater than a pre-defined threshold                                             | Security measure to avoid DDoS attacks                                                                                                                              |
| 415 Unsupported Media Type   | Client sends the message body in a format that the server does not understand (neither in `application/xml` nor in `application/json` format). |                                                                                                                                                                     |
| 429 Too Many Requests        | The user sent too many request in a given amount of time.                                                                                      | See [http://tools.ietf.org/html/rfc6585](http://tools.ietf.org/html/rfc6585)                                                                                        |
| 500 Internal Server Error    | An unexpected error occurred on server. Request is not processed.                                                                              |                                                                                                                                                                     |

Application level errors are reported in a response as special _"error"_ objects containing the following data:

* **errorCode**: Error code; distinct for different distinct errors
* **description**: Human-readable description of the issue (in English; subject to change without changes in API version)

```json
// JSON

{
    "errorCode": "153",
    "description": "Description"
}
```

```xml
// XML

<error>
    <errorCode>153</errorCode>
    <description>Description</description>
</error>
```

The following errors may be triggered by any resource of the API:

* **Request comes from the non-authenticated client**
  * `Status code`: 401 Unauthorized
  * `Error code`: 1
  * `Description`: Authorization required
* **Malformed HMAC signature (HMAC authentication failed due to malformed HMAC signature header.** [**See HMAC auth**](../authentication-and-authorization/hmac-authentication)**)**
  * `Status code`: 400 Bad Request
  * `Error code`: 11
  * `Description`: Malformed HMAC signature
* **HMAC signature too old (more than a permitted amount of time passed since the request was created.** [**See HMAC auth**](../authentication-and-authorization/hmac-authentication)**)**
  * `Status code`: 401 Unauthorized
  * `Error code`: 12
  * `Description`: HMAC signature too old
* **HMAC signature mismatch (HMAC signature check failed; authentication failed.**[ **See HMAC auth**](../authentication-and-authorization/hmac-authentication)**)**
  * `Status code`: 401 Unauthorized
  * `Error code`: 13
  * `Description`: HMAC signature mismatch
