Errors
JSON body is always { "error": "<CODE>" } for auth failures, or buy/cancel success: false with message + error. Never provider brand names.
| HTTP | Code | When |
|---|---|---|
| 401 | INVALID_KEY | Missing / unknown API key |
| 403 | BANNED | Account banned (key may still resolve) |
| 429 | RATE_LIMITED | Per-user or public IP throttle |
| 400 | INSUFFICIENT_BALANCE | Buy / rent debit refused |
| 400 | NO_NUMBERS | No stock for that line |
| 400 | TOO_EARLY_CANCEL / TOO_EARLY | Cancel before min window (rent: TOO_EARLY) |
| 400 | HAS_SMS | Cancel blocked — SMS already delivered |
| 400 | INVALID_STATE | Wrong status for poll / next / cancel |
| 400 | PROVIDER_ERROR | Upstream failure (generic copy) |
| 400 | BUY_UNCERTAIN | Debit held — do not retry until settle |