ShopItUp Developers v1

Get started

Errors and rate limits

Success is a 2xx status. Anything else carries one error object, with a stable code to act on and a message written for people. A validation error also says which fields to fix.

The error object

  • error object Required
    3 child attributes
    • code string Required

      Stable — act on this. unauthorized, insufficient_scope, not_found, validation_failed, rate_limited, method_not_allowed, quote_expired, item_unavailable, nothing_to_buy, idempotency_key_reused, idempotency_conflict, server_error, unavailable, retired

    • message string Required

      For a person to read; may change

    • fields map

      On validation_failed, each invalid field and what is wrong with it

Examples

401 · Missing, invalid or expired access token

{
  "error": {
    "code": "unauthorized",
    "message": "The access token is missing, invalid or expired."
  }
}

Status codes

StatusCodeWhat it means
401 unauthorized Missing, invalid or expired access token
402 The person must pay themselves (their bank wants them to confirm, or the card was declined); nothing was charged
403 insufficient_scope The token does not carry the scope this endpoint needs
404 not_found Not found, or not listed on this marketplace
409 quote_expired The quote has expired (quote_expired), an item in it is no longer available (item_unavailable), or nothing in it can be bought (nothing_to_buy) — create a new quote.
422 validation_failed The request is invalid; fields says which field and why
429 rate_limited Too many requests; retry after the number of seconds in Retry-After
503 unavailable A service the API depends on is briefly unavailable; retry after the number of seconds in Retry-After

Rate limits

Each partner may make 120 requests a minute and 3,000 an hour across all endpoints, whichever servers they come from. Every response carries X-RateLimit-Limit and X-RateLimit-Remaining. Over the limit, the API answers 429 with a Retry-After header giving the seconds to wait; requests before then are refused too.

Tokens last an hour, so the token endpoint needs calling rarely; it has its own, lower limit.

Retrying safely

A 503 (unavailable) means a service the API depends on stumbled for a moment: wait the seconds in its Retry-After header and send the same request again. A 500 is a fault on our side that retrying is unlikely to cure; we are alerted to every one.

Reading is always safe to retry. Creating a checkout takes an Idempotency-Key header: send the same key when you retry, and you get the first response back instead of a second order.