400 Bad Request | Malformed input the handler validated itself (invalid enum value, no active organization on the token, unknown filter) |
401 Unauthorized | Missing/expired/invalid bearer token — see Authentication |
403 Forbidden | Valid token, insufficient scope |
404 Not Found | The resource doesn’t exist, or exists in a different organization than the token’s (row-level security makes the two indistinguishable by design — a cross-org read looks exactly like a missing row, never a 403 that would confirm the row exists) |
409 Conflict | A uniqueness/state constraint (duplicate tag name, non-empty folder without cascade=true) |
422 Unprocessable Entity | Request body/query failed Pydantic validation |
502 Bad Gateway | The backend’s own call to the database (PostgREST) or another upstream failed |
503 Service Unavailable | A dependent feature isn’t available in this deployment (e.g. report rendering, which needs the render-worker image) |