Error Codes & Limits

Every failure returns a machine-readable AIP-Exxx error code — not a generic 400.

json

// Every error in the response looks like this:
{
  "verified": false,
  "errors": [
    { "code": "AIP-E202", "name": "MONETARY_LIMIT" },
    { "code": "AIP-E303", "name": "INTENT_DRIFT" }
  ],
  "detail": "Transaction amount $5,200.00 exceeds per-txn limit of $1,000.00"
}

HTTP Status Codes

Status	Meaning
200	Request succeeded — check "verified" for verification outcome
400	Malformed request body or missing required fields
401	Invalid or missing API key / JWT token
403	Authenticated but not authorized for this resource
404	Agent, key, or resource not found
429	Rate limit exceeded — back off and retry
500	Internal server error — contact support

AIP Error Taxonomy

E1xx — Envelope Errors

Code	Name	Description
AIP-E100	INVALID_SIGNATURE	Ed25519 cryptographic proof verification failed
AIP-E101	EXPIRED_ENVELOPE	Intent envelope TTL has been exceeded
AIP-E102	REPLAY_DETECTED	Entropy nonce reused — possible replay attack
AIP-E103	SCHEMA_INVALID	Envelope does not conform to AIP-1 schema
AIP-E104	VERSION_UNSUPPORTED	Protocol version not supported by this verifier

E2xx — Boundary Violations

Code	Name	Description
AIP-E200	ACTION_NOT_ALLOWED	Requested action is not in the agent's allowed_actions list
AIP-E201	ACTION_DENIED	Action is explicitly in the agent's denied_actions list
AIP-E202	MONETARY_LIMIT	Transaction amount exceeds per-txn or per-day monetary limit
AIP-E203	TIME_WINDOW_VIOLATION	Request is outside the agent's authorized time window
AIP-E204	GEO_RESTRICTION	Request originates from a restricted geography

Rate Limits

Rate limits are applied per IP or per API key. Every response includes rate limit headers.

Tier	Limit	Window
IP (unauthenticated)	60 requests	1 minute
API Key	300 requests	1 minute
Login attempts	10 attempts	5 minutes