Errors

Public API errors are returned as JSON. Common fields:

code: a stable error code such as UNAUTHORIZED, FORBIDDEN, NOT_FOUND, or INTERNAL_SERVER_ERROR
message: a human-readable description
data.appCode: an optional, stable application-specific reason
issues: validation details for malformed input

Branch on the stable code (and data.appCode when present), not on message text, which may change.