Errors & retries

HTTP status codes and actionable recovery.

RFC 9457 problems

Failed /v1 requests return application/problem+json with type, title, status, detail, instance, code and invalid_params (empty when there are no field-level details). Log the X-Request-ID response header for tracing. The type URL identifies the specific failure; the table shows representative codes.

HTTP 429 · synthetic
{
  "type": "https://ohlc.io/problems/rate-limit",
  "title": "Rate limit",
  "status": 429,
  "detail": "Account request allowance is temporarily exhausted.",
  "instance": "/v1/eod",
  "code": "rate-limit",
  "invalid_params": []
}

Status codes

401
invalid-api-key

Verify the bearer token and revocation status.

403
capability-not-entitled

Check plan, key scope, market, IP and origin permissions.

403
mutual-funds-not-entitled

Mutual funds (NMFQ and FSRV listings) need the Commercial or Scale plan.

404
symbol-not-resolved

Check the ticker, qualify it as MIC:TICKER, and use the correct symbol_at date.

404
resource-not-found

Check the path and record ID; unknown /v1 paths return it.

405
method-not-allowed

Use a method listed in the response's Allow header.

409
authorization-changed

Retry with the current entitlement; exports may not be ready.

422
invalid-request

Correct the query or request body; read the problem detail.

429
rate-limit

Honor Retry-After; concurrency-limit is also a 429.

429
daily-credit-limit

Daily credits are spent; retry after 00:00 UTC (Retry-After) or upgrade.

500
internal-error

Use bounded retries and retain the X-Request-ID header.

501
dataset-unavailable

No source is connected to this dataset; no retry changes the answer.

503
query-timeout

Narrow the request; when Retry-After is present (data-busy, movers), retry after it.

Retry deliberately

Honor Retry-After in seconds for 429. X-RateLimit-Reset is a Unix timestamp for token-bucket recovery. Use bounded backoff for transient errors. Correct invalid parameters and credentials before retrying. Unknown /v1 paths return 404 resource-not-found, and a method the resource does not take returns 405 method-not-allowed with an Allow header, both before authentication.