Status Codes

• 200 OK — Request successful
• 201 Created — New object created
• 202 Accepted — Request accepted, processing ongoing
• 204 No Content — Request successful, no body returned
• 302 Found — Redirect to a short-lived download URL (Download Testimony)
• 400 Bad Request — Invalid input (password reset with a wrong or expired token)
• 401 Unauthorized — Missing or invalid authentication
• 403 Forbidden — Authenticated but not allowed: wrong role, not the owner, email not verified, or a guest-only endpoint called with a token
• 404 Not Found — Resource does not exist
• 405 Method Not Allowed — Unsupported HTTP method
• 409 Conflict — Conflict with the current state: invalid state transition, duplicate offer, concurrent modification
• 422 Unprocessable Content — Validation errors and business-rule violations
• 429 Too Many Requests — Rate limit exceeded, see the Retry-After header
• 500 Internal Server Error — Unexpected server error
• 502 Bad Gateway — Stripe could not be reached (Accept Offer)

All error responses return a JSON object with a message field. See Error Responses for details.