Browse the API reference
Reference
Errors
Errors always return JSON with a stable machine-readable code and the request id, which is also echoed in the X-Request-Id response header.
Always log the request id
X-Request-Id. Keep it with your logs — it is the fastest way to trace a failed call.invalid_bodyA POST body was missing or was not valid JSON.
Send Content-Type: application/json with a body such as { "domain": "example.com" }.
invalid_domainThe supplied domain is not a valid root domain.
Use the bare root domain, lowercase, with no scheme or path.
invalid_queryA required query parameter was missing or too short.
Check the parameter table for the endpoint — search needs at least 2 characters.
invalid_idA path id was not a UUID.
Pass the id exactly as returned by the list endpoint.
missing_tokenNo Authorization or X-API-Key header was sent.
Add Authorization: Bearer chs_live_… to the request.
invalid_tokenThe token is malformed or unknown.
Create a fresh token on the account page; tokens are shown once at creation.
revoked_tokenThe token was revoked by its owner.
Create a new token and update your integration.
insufficient_scopeA write endpoint was called with a read-only key.
Create a key with the write scope for queueing scans.
not_foundThe domain, platform, scan or endpoint does not exist.
Check the path; list endpoints show every valid value.
unknown_platformThe platform slug is not one of the tracked programs.
Call GET /platforms for the current slugs.
method_not_allowedThe HTTP verb is not supported on that path.
Use the verb shown on the endpoint page.
query_failedA database query failed while serving the request.
Retry once; if it persists, include the X-Request-Id when reporting it.
server_errorAn unexpected error occurred.
Retry with exponential back-off and report the X-Request-Id.
{
"error": {
"code": "invalid_token",
"message": "Unknown API token."
},
"request_id": "b2f0c8d1-1f6e-4d0b-9d55-2a9c3b1f77aa"
}