Error responses

Submission and management errors use RFC 9457 Problem Details with application/problem+json.

{
  "type": "https://docs.formcentral.local/problems/origin_not_allowed",
  "title": "Origin not allowed",
  "status": 403,
  "code": "origin_not_allowed",
  "requestId": "...",
  "instance": "/s/v1/production/..."
}

Clients must branch on the stable code, not the human-readable detail.

StatusBaseline meaning
400Malformed request
401Missing or invalid server credential
403Disallowed origin or operation
404Unknown form or endpoint
409Conflicting idempotency reuse or state transition
413Payload or field limit exceeded
415Unsupported media type or file part
422Schema validation failure
429Traffic limit or exhausted allowance
503Temporary unavailability

Validation errors include no more than 20 JSON Pointer paths and never echo rejected values. Public browser errors do not disclose plan or account usage.