ERROR HANDLINGHTTP Codes & Envelopes

Errors & Status Codes

Softymize uses conventional HTTP response codes to indicate request outcomes. In general, 2xx codes indicate success, 4xx codes indicate client-side errors (such as missing variables or invalid API keys), and 5xx codes indicate transient server or upstream gateway issues.

RFC 7807 AlignedMachine-Readable CodesUnique Request IDs

HTTP Status Codes Summary

The table below summarizes all primary HTTP status codes returned across the Softymize REST API:

HTTP CodeStatusMeaning & Recommended Action
200 OKSuccessThe request succeeded. Messages were dispatched or queued into Redis successfully.
201 CreatedSuccessA new resource was created successfully (e.g. registered a new webhook subscription).
400 Bad RequestClient ErrorMalformed JSON payload, invalid syntax, or missing required body boundaries.
401 UnauthorizedAuth ErrorMissing, invalid, or revoked API key. Verify X-Softymize-API-Key header.
403 ForbiddenPermissionsThe API key lacks the required permission scope (e.g. whatsapp:send), client IP is blocked, or origin domain is unauthorized.
404 Not FoundNot FoundThe requested endpoint, webhook ID, or template identifier could not be located.
422 UnprocessableValidationSemantic validation failed (e.g. missing placeholder variables in WhatsApp template, invalid E.164 phone, or unverified email domain).
429 Rate LimitedRate LimitToo many requests sent within a 60-second window. Inspect Retry-After header and apply backoff.
500 Server ErrorServer IssueUnexpected error on the Softymize gateway. Safe to retry using an exponential backoff loop.
502 / 503 / 504UpstreamTemporary outage or latency on upstream telecom gateways (Meta Cloud API or AWS SES).

Standardized JSON Error Envelope

Every error response returned by Softymize follows a consistent JSON structure across all channels:

Authentication Failure (HTTP 401)
HTTP 401 UnauthorizedJSON
{
"success": false,
"error": {
"code": "UNAUTHENTICATED",
"message": "Missing X-Softymize-API-Key header or invalid API key provided.",
"doc_url": "https://docs.softymize.com/api-docs/authentication"
},
"meta": {
"request_id": "req_8a1b2c3d4e5f6g7h",
"timestamp": "2026-10-17T18:55:00Z"
}
}
Parameter Validation Failure (HTTP 422)
HTTP 422 Validation ErrorJSON
{
"success": false,
"error": {
"code": "VARIABLE_COUNT_MISMATCH",
"message": "Template 'order_confirmation_v2' expects 4 variables [customer_name, order_id, amount, delivery_date], but only 3 were supplied.",
"field": "variables",
"doc_url": "https://docs.softymize.com/api-docs/whatsapp#parameters"
},
"meta": {
"request_id": "req_9f8a3c4b12d34e5f",
"timestamp": "2026-10-17T18:55:02Z"
}
}
Envelope Fields Breakdown:
  • success (boolean): Always false on errors.
  • error.code (string): A machine-readable programmatic code (e.g. VARIABLE_COUNT_MISMATCH).
  • error.message (string): A clear, human-readable explanation of why the request failed and how to resolve it.
  • error.doc_url (string): Direct link to the relevant developer documentation section.
  • meta.request_id (string): Unique request tracing ID (e.g. req_8a1b2c3d...). Always provide this ID when reaching out to Softymize Technical Support.

Comprehensive Error Code Dictionary

Error CodeCategoryHTTP StatusCause & Resolution
UNAUTHENTICATEDSecurity401Missing or invalid X-Softymize-API-Key. Generate a new secret key in workspace settings.
FORBIDDEN_SCOPESecurity403The API key lacks the required permission scope (e.g. whatsapp:send or email:send).
FORBIDDEN_IPSecurity403Your server's outgoing IP address is not included in the key's allowed IP whitelist.
FORBIDDEN_DOMAINSecurity403Request's Origin or Referer header does not match your workspace allowed domains.
TEMPLATE_NOT_APPROVEDWhatsApp422Template slug is pending or rejected in Meta WhatsApp Manager. Ensure template is Approved.
VARIABLE_COUNT_MISMATCHWhatsApp422Supplied variable count does not match the approved template's body placeholders.
PHONE_NOT_ON_WHATSAPPWhatsApp422The recipient phone number is not registered on WhatsApp or has blocked business messaging.
UNVERIFIED_SENDER_DOMAINEmail422The sender domain in from_email has not configured SPF/DKIM DNS records.
SUPPRESSION_LIST_ACTIVEEmail422Recipient address was previously bounced or marked spam. Removed to protect sender reputation.
RATE_LIMIT_EXCEEDEDTraffic429Exceeded sliding-window plan rate limits. Sleep for the duration specified in Retry-After.

Client-Side Error Handling Best Practices

Follow these golden rules when handling API responses in your production backend:

Do NOT Auto-Retry on 4xx Errors

HTTP 400, 401, 403, and 422 indicate deterministic parameter or permission bugs. Retrying identical requests will always produce the same error. Fix the payload first!

Safe to Retry on 429 & 5xx

HTTP 429 (rate limits) and 5xx (transient gateway hiccups) should be retried automatically using exponential backoff with randomized jitter and an idempotency key.

Production Error Handling Wrapper (Node.js)JavaScript
const axios = require('axios');
async function callSoftymizeApi(endpoint, payload) {
try {
const response = await axios.post(`https://api.softymize.com/api/v1${endpoint}`, payload, {
headers: {
'X-Softymize-API-Key': process.env.SOFTYMIZE_API_KEY,
'Content-Type': 'application/json'
}
});
return response.data;
} catch (err) {
if (err.response) {
const { status, data } = err.response;
const requestId = data.meta?.request_id;
const errorCode = data.error?.code;
console.error(`[Softymize API Error ${status}] Code: ${errorCode} | Request ID: ${requestId}`);
switch (status) {
case 401:
// Invalid API Key - alert devops
throw new Error('Softymize API Key is invalid or expired.');
case 403:
// Scope or permission mismatch
throw new Error(`Permission Denied: ${data.error?.message}`);
case 422:
// Validation error - do not retry automatically!
console.error('Payload validation failed:', data.error);
throw new Error(`Validation Error: ${data.error?.message}`);
case 429:
// Rate limited - inspect retry_after
const retrySeconds = data.error?.retry_after || 10;
console.warn(`Rate limited. Need to wait ${retrySeconds}s before next call.`);
break;
case 500:
case 502:
case 503:
// Server error - safe to retry with exponential backoff
console.warn('Transient server error. Scheduling retry...');
break;
default:
throw err;
}
} else {
// Network or connection timeout
console.error('Network Error:', err.message);
}
throw err;
}
}

Technical Support & Request Tracing

Every HTTP response from Softymize includes a unique X-Request-Id header (e.g. req_8a1b2c3d4e5f6g7h) that is indexed across our distributed log cluster. If you encounter an unexpected issue, contact Softymize Engineering at [email protected] with your request_id for sub-second log traces.