application/problem+json. Use the stable code field in your error-handling logic. The detail text explains the error for a person and can change. Each endpoint’s reference lists its responses and examples.
Choose the next action
This table covers common cases, not every endpoint-specific code. A timeout does not guarantee that work stopped. Repeating example generation can save another example. Each feedback submission creates a new record, even if you send the same feedback again. Experimental Research also saves answers and follow-up turns; repeating a request can create another thread or turn.
Research answer generation can take up to 210 seconds. Set your client timeout longer than 210 seconds. A
504 TIMEOUT does not make retrying safe: generation may continue, and repeating the request can create another thread or turn.
For lockfile analysis, retain the accepted job ID and check its status instead of resubmitting. A new submission is a new analysis and can consume quota again. Synchronous SBOM generation has no saved result to resume.
Rate-limit headers
Operations that document usage headers can returnX-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset on successful or rate-limited responses when usage information is available. The trio is omitted when that information is unavailable; the credential type alone does not guarantee it.
X-RateLimit-Reset is an absolute Unix timestamp in seconds, not a delay. Use these values to pace requests, while handling 429 and honoring Retry-After: concurrent requests or other quotas can still exhaust a limit.
These headers are not exposed for example generation, Research, feedback, language discovery, SBOM generation, or lockfile job submission, events, and results. Consult each operation’s reference.
Keep the request ID
SaveX-Request-ID from the response headers. A normal problem response’s instance matches this ID. Include it with the endpoint, approximate time, status and problem code when reporting a failure. Remove authorization headers and sensitive request content from reports.
If the service cannot create a request identity, it returns an empty HTTP 500 without a request ID. Clients must handle that case without assuming every failure body is JSON.
Browser request errors
A browser can block a cross-origin response before the playground can display its status or body. Check the destination URL and whether your browser reports a CORS failure. A browser network error alone does not prove your token is invalid or that no work occurred. The playground sends live requests fromhttps://docs.githits.com. If you are reading a preview or another copy of these docs, use the cURL quickstart in your own terminal. The API does not allow those other sites to send playground requests.