Match on code. The message is written for humans and may be reworded for
clarity without that being a breaking change.
Every response — success or failure — carries a request_id. Quote it if you
need help; it is the fastest way to find what happened.
Types
Notable codes
Not found means not yours
A record belonging to another account returns 404, not 403. Confirming that
something exists but is not yours is itself a disclosure, and would let an
attacker enumerate ids.
Rate limits
Exceeding the request-rate limit returns 429 with a Retry-After header. Those
requests are never charged — being billed for requests we declined to serve
would be indefensible.
Provider-backed work is not rate limited by request count. Credits are the
control there.