FinDesk returns conventional HTTP status codes. 2xx means the call succeeded, 4xx means the request was wrong in some way, and 5xx means FinDesk failed to handle a well-formed request.
Bodies are always JSON. Error responses include a top-level message. Validation failures additionally include an errors map keyed by field name (the standard Laravel validator shape).
Codes you should expect
| Status | Used for |
|---|---|
200 OK |
Successful GET, PUT, or DELETE. |
201 Created |
A POST that created a new resource. |
204 No Content |
A DELETE that succeeded with no body to return. |
401 Unauthorized |
Missing or invalid bearer token, or a POST /login call with wrong credentials. |
403 Forbidden |
Token is valid but the user is not a member of the team referenced by X-Enterprise-Id, the target resource belongs to a different team, or the endpoint is gated (POST/PUT/DELETE on read-only resources currently respond 403). |
404 Not Found |
The URL did not resolve to a known route, or the requested record does not exist within the authenticated team. |
422 Unprocessable Entity |
Request body failed validation. Returned by every endpoint backed by a Form Request — see the per-resource pages for the rules each enforces. |
429 Too Many Requests |
You exceeded the throttle. See Rate limits. |
500 Internal Server Error |
Unhandled server error. Try again later; if it persists, capture the response body and contact support. |
Response shape
401 and 403
{
"message": "Forbidden"
}
The message text reflects the cause — "Invalid Credentials" on a failed login, "Forbidden" on team-scope mismatches, "Unauthenticated." on a missing bearer token.
422
{
"message": "The given data was invalid.",
"errors": {
"email": ["The email field is required."],
"password": ["The password field is required."]
}
}
Each key under errors is the field that failed; each value is an array of human-readable messages.
404
{
"message": "No query results for model [App\\Application] ..."
}
For listings, an empty result set returns 200 OK with an empty data array — not 404. A 404 means the route or record itself does not exist.