Errors
Errors are JSON: {"code": "...", "message": "...", "status": 400}. The message is for you; the code is stable.
| Code | Status | Meaning and what to do |
|---|---|---|
invalid_input | 400 | A field is missing, the wrong type, or unknown. The message names the field. Fix the input; don't retry as is. |
disclosure_ack_required | 400 | The customer must acknowledge the Idaho disclosure on the hosted signing page. |
terms_not_accepted | 400 | |
terms_not_published | 503 | |
consent_required | 400 | A person must tick a consent box on a hosted page (for example e-sign). Send them the link. |
unsupported_version | 400 | The Doing-Work-Version header isn't one the API knows. Use 2026-11-01. |
bad_signature | 400 | A signature didn't verify. |
invalid_link | 400 | The link was used, expired, or replaced by a newer one. Get a new link. |
invalid_request | 400 | An OAuth request is malformed. |
invalid_grant | 400 | The code, verifier or refresh token is wrong, used or expired. Start sign-in again. |
unsupported_grant_type | 400 | Use authorization_code or refresh_token. |
invalid_target | 400 | The resource parameter doesn't match this server. |
invalid_scope | 400 | The requested scope isn't offered. |
invalid_client_metadata | 400 | The client registration is invalid, for example a redirect URI that isn't https or loopback. |
invalid_claim_token | 400 | |
issuer_not_enabled | 400 | |
authorization_pending | 400 | |
slow_down | 400 | |
expired_token | 400 | |
access_denied | 400 | |
claimed_or_in_flight | 409 | |
claim_expired | 410 | |
invalid_token | 401 | The token is missing, expired, or for a different resource. Refresh it or sign in again. |
session_required | 403 | A person has to be signed in on a browser for this step. |
owner_cannot_leave | 409 | The owner can't leave a shop. Ownership moves only by transfer. |
owner_role_fixed | 409 | The owner's role can't be changed. |
unauthenticated | 401 | No token was sent. Sign in first. |
forbidden | 403 | This worker's role can't do this, or it needs a person's own sign-in rather than an agent token. Tell the person who can. |
human_only | 403 | This step happens on a hosted page the person opens themselves. Send them the link; don't try another route. |
feature_unavailable | 403 | This isn't available for this shop or place yet. |
private_beta | 403 | This is invite only for now. Tell the person to email contact@doingwork.work. |
not_found | 404 | No such record, or this worker can't see it. |
conflict | 409 | The record is in the wrong state for this, for example sending a quote that's already signed. Read it again and pick the next step. |
checklist_open | 409 | |
payment_pending | 409 | A bank (ACH) payment for this invoice is still clearing, which takes a few business days. Don't ask the customer to pay again. Wait for invoice.paid or invoice.payment_failed. |
payments_not_set_up | 409 | The shop hasn't connected Stripe. The owner does that on a hosted page. |
payments_paused | 409 | |
idempotency_in_progress | 409 | A request with this Idempotency-Key is still running. Wait and retry with the same key. |
idempotency_key_reused | 422 | This Idempotency-Key was used with a different body. Use a new key for a new request. |
unprintable_text | 422 | |
document_too_large | 422 | |
rate_limited | 429 | Too many requests. Wait for the Retry-After time, then retry. |
payload_too_large | 413 | |
internal | 500 | Something broke on our side. Retry later with the same Idempotency-Key. |
not_supported | 501 | Not supported yet. |