Common Error Codes

Quick reference for all error codes returned by the SilentShield API.

Status	Error	Description	Solution
`400`	`validation_error`	Invalid request body or missing required fields.	Check the request format matches the API documentation.
`401`	`missing_api_key`	API key is missing from the request.	Add the X-Api-Key header to your request.
`403`	`ip_not_whitelisted`	Client IP is not in the security policy whitelist.	Add the IP to the whitelist in Dashboard → Security Policy.
`403`	`ip_blacklisted`	Client IP is in the security policy blacklist.	Remove the IP from the blacklist in Dashboard → Security Policy.
`403`	`domain_mismatch`	The request's Origin/Referer domain doesn't match the API key's domain.	Update the domain in Dashboard → API Keys → Edit.
`403`	`referer_not_allowed`	The referer domain is not in the allowed referers list.	Add the domain to Allowed Referers in Security Policy.
`429`	`quota_exceeded`	Monthly request quota has been exceeded.	Upgrade your plan or wait until the quota resets.
`429`	`ip_rate_limited`	Per-IP rate limit has been reached.	Wait 60 seconds. The Retry-After header indicates when to retry.
`200`	`X-Domain-Test-Limit-Exceeded`	Unverified domain: more than 10 requests a day in test mode. The request is NOT rejected — only the header X-Domain-Test-Limit-Exceeded signals it.	Verify your domain to unlock your full quota.
`403`	`suspicious`	A real visitor is rejected by /v1/verify with the verdict suspicious and reasons such as NO_TYPING_PAUSES. The widget did not receive the submission, for example because the form is sent by a button click and AJAX without a submit event.	Include the behavior_nonce field in the request body (serialise the whole form, hidden fields too). Requests made with XMLHttpRequest, including jQuery.ajax, are then reported by the widget since SilentShield 2.6. Requests made with fetch() are not reported yet: use a regular form submit or contact support.