Reorder the tenant's identity-provider registrations
Applies orderedIds as the new display order. The list must name the tenant's complete set of registrations, each exactly once; anything else, an identifier that names no registration included, is refused 400 reorder_set_incomplete and the order is unchanged. An absent orderedIds is refused 400 validation_failed.
Behavior and permissions
Answers 200 with the registrations in their new order. Requires a credential issued by a tenant administrator.
Authorization · Example request · Parameters · Request body · Responses
POST/api/integration/v1/settings/identity-providers/reorder
Authorization
- apiKeyAuth — apiKey sent in the Authorization header
Use Authorization: Api-Key <secret>. Get a credential and check the scopes and issuer authority required for this operation.
Example request
Set QMS_BASE_URL to your workspace URL and QMS_API_KEY to your secret. Replace example identifiers with your own.
curl --request POST "$QMS_BASE_URL/api/integration/v1/settings/identity-providers/reorder" \
--header "Authorization: Api-Key $QMS_API_KEY" \
--header "Content-Type: application/json" \
--data '{
"orderedIds": [
"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaab",
"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
]
}'Parameters
None.
Request body
{
"orderedIds": [
"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaab",
"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
]
}Request schema
The reorder body.
orderedIds · array · required
The tenant's complete set of registration identifiers, each exactly once, in the new display order.
Show nested fields
Raw JSON Schema
application/json
{
"type": "object",
"description": "The reorder body.",
"properties": {
"orderedIds": {
"type": "array",
"description": "The tenant's complete set of registration identifiers, each exactly once, in the new display order.",
"items": {
"type": "string"
},
"example": [
"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaab",
"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
]
}
},
"required": [
"orderedIds"
]
}Responses
200 — The tenant's registrations in their new display order.
{
"items": [
{
"id": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaab",
"displayName": "Acme Support Desk SSO",
"kind": "OIDC",
"enabled": true,
"primary": false,
"issuerUrl": "https://support-sso.example.com",
"clientId": "acme-support-qms",
"clientAuthMethod": "client_secret_basic",
"clientSecretConfigured": true,
"clientSecretUpdatedAt": "2026-09-10T09:00:00.000Z",
"verifiedAt": "2026-09-10T09:05:00.000Z",
"activatedWithoutTest": false
}
]
}200 response schema
The identity-provider list read's answer: an object carrying exactly one member, never a bare array.
items · array · required
One entry per identity-provider registration of the tenant, in display order.
Show nested fields
One identity-provider registration and its client authentication state — never the client secret or its ciphertext. Every member is always present; `issuerUrl`, `clientId`, `clientSecretUpdatedAt` and `verifiedAt` are null rather than absent when the registration carries none.
id · string · required
The registration's own opaque identifier.
displayName · string · required
kind · string · required
The adapter kind this registration configures.
Allowed values: "OIDC"
enabled · boolean · required
primary · boolean · required
Whether this is the tenant's primary identity provider.
issuerUrl · string | null · required
clientId · string | null · required
clientAuthMethod · string · required
How this registration authenticates the token request.
Allowed values: "none", "client_secret_basic", "client_secret_post"
clientSecretConfigured · boolean · required
Whether a client secret is stored for this registration.
clientSecretUpdatedAt · string | null · required
When the stored client secret was last set or replaced, or null when none is stored.
verifiedAt · string | null · required
When a test sign-in last verified this registration's connection, or null when it never has been. A change to the connection or the client secret clears it back to null.
activatedWithoutTest · boolean · required
Whether the registration was enabled, or its connection changed, on an explicit request to accept it without a test sign-in. Such a registration has `verifiedAt` null, cannot be designated the primary in the management console, and cannot be the primary under a required customer authentication policy. A test sign-in of the stored connection or disabling the registration clears it.
Raw JSON Schema
application/json
{
"type": "object",
"description": "The identity-provider list read's answer: an object carrying exactly one member, never a bare array.",
"properties": {
"items": {
"type": "array",
"description": "One entry per identity-provider registration of the tenant, in display order.",
"items": {
"type": "object",
"description": "One identity-provider registration and its client authentication state — never the client secret or its ciphertext. Every member is always present; `issuerUrl`, `clientId`, `clientSecretUpdatedAt` and `verifiedAt` are null rather than absent when the registration carries none.",
"properties": {
"id": {
"type": "string",
"description": "The registration's own opaque identifier.",
"example": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaab"
},
"displayName": {
"type": "string",
"example": "Acme Support Desk SSO"
},
"kind": {
"type": "string",
"description": "The adapter kind this registration configures.",
"enum": [
"OIDC"
],
"example": "OIDC"
},
"enabled": {
"type": "boolean",
"example": true
},
"primary": {
"type": "boolean",
"description": "Whether this is the tenant's primary identity provider.",
"example": false
},
"issuerUrl": {
"type": [
"string",
"null"
],
"example": "https://support-sso.example.com"
},
"clientId": {
"type": [
"string",
"null"
],
"example": "acme-support-qms"
},
"clientAuthMethod": {
"type": "string",
"description": "How this registration authenticates the token request.",
"enum": [
"none",
"client_secret_basic",
"client_secret_post"
],
"example": "client_secret_basic"
},
"clientSecretConfigured": {
"type": "boolean",
"description": "Whether a client secret is stored for this registration.",
"example": true
},
"clientSecretUpdatedAt": {
"type": [
"string",
"null"
],
"description": "When the stored client secret was last set or replaced, or null when none is stored.",
"example": "2026-09-10T09:00:00.000Z"
},
"verifiedAt": {
"type": [
"string",
"null"
],
"description": "When a test sign-in last verified this registration's connection, or null when it never has been. A change to the connection or the client secret clears it back to null.",
"example": "2026-09-10T09:05:00.000Z"
},
"activatedWithoutTest": {
"type": "boolean",
"description": "Whether the registration was enabled, or its connection changed, on an explicit request to accept it without a test sign-in. Such a registration has `verifiedAt` null, cannot be designated the primary in the management console, and cannot be the primary under a required customer authentication policy. A test sign-in of the stored connection or disabling the registration clears it.",
"example": false
}
},
"required": [
"id",
"displayName",
"kind",
"enabled",
"primary",
"issuerUrl",
"clientId",
"clientAuthMethod",
"clientSecretConfigured",
"clientSecretUpdatedAt",
"verifiedAt",
"activatedWithoutTest"
]
}
}
},
"required": [
"items"
]
}400 — The reorder was refused before anything was written. Two codes share this status: `reorder_set_incomplete` when `orderedIds` is not the tenant's complete set of registrations, each exactly once, and `validation_failed` when it is absent. Branch on `code`.
{
"type": "urn:qms:problem:reorder_set_incomplete",
"title": "Reorder Set Incomplete",
"status": 400,
"code": "reorder_set_incomplete",
"detail": "A reorder names the tenant's complete set of registration ids, each exactly once."
}{
"type": "urn:qms:problem:validation_failed",
"title": "Validation Failed",
"status": 400,
"code": "validation_failed",
"detail": "The request body failed field validation."
}400 response schema
An RFC 9457 problem document: `type`, `title`, `status`, `code` and `detail`, every one of those five always present. `errors`, `blockers`, `checkCode` and `planLimit` are the exceptions — each is scoped to one family of refusal and is ABSENT on every other document, which is why none is required below. `code` is the stable, machine-readable member; branch on it rather than on `title` or `detail`, which are English prose meant for a developer reading a log.
type · string · required
A URN identifying the problem kind, one per `code`.
title · string · required
A fixed English summary of the problem kind.
status · integer · required
The HTTP status code, repeated in the body.
code · string · required
The published slug this surface's error vocabulary uses.
detail · string · required
An English explanation of this occurrence.
errors · array · optional
One entry per offending field of a 400 field-validation refusal. Present on those alone, and ABSENT — not null, not an empty array — on every other problem document, including a field-validation refusal that can name no single field. Sorted by `field`, so two refusals over the same body produce the same document.
Show nested fields
One offending field of a 400 field-validation refusal.
field · string · required
The member as THIS document spells it, which is not always what the same field is called inside the system.
code · string · required
The published reason slug. Typed as a plain string rather than an enumeration, because the set is not closed — an integrity backstop can report a slug outside the published list. The values in use today are `required`, `too_long`, `invalid_format`, `invalid_timezone`, `invalid_locale`, `invalid_country`, `name_taken`, `code_taken`, `display_prefix_taken`, `out_of_range`, `not_in_catalogue`, `archived`, `duplicate`, `not_found`, `not_linked_to_location`, `inactive`, `language_not_in_catalogue`, `not_writable`, `password_too_short` and `password_breached`. Three of them are worth a sentence. `invalid_format` covers a value whose SHAPE is wrong — a window code that is not alphanumeric, a time that is not `HH:MM` — and, on the operating hours, the one fault that is a relation rather than a shape: a `closesAt` that is not after its `opensAt`, where both values are well formed and it is their ORDER that is refused. It also covers a member whose JSON type cannot be read — a string where a boolean belongs — reported under its path, e.g. `operatingHours[0].closed`. `not_found` means the member names something this tenant does not hold; it is the same word as the document-level `code` that answers an unserved path, at a different level and never with that status. `not_writable` is the operator invite, the operator profile edit and the visit-reason replace's own: a body member the request type declares no slot for, refused by NAME whether or not its value would have changed anything. `password_too_short` and `password_breached` are the operator create's own, under `initialPassword`.
blockers · array · optional
One entry per non-zero blocking category of a 409 refusal that names what blocks it. Present on those alone, and ABSENT on every other problem document. A category with nothing to report is absent rather than present with a count of 0.
Show nested fields
One non-zero blocking category of a 409 refusal, and how many things it counted.
kind · string · required
What kind of thing still depends on the entry — or, on a configuration refusal, on what the write would take away.
Allowed values: "LOCATION", "TICKET", "APPOINTMENT", "TEMPLATE", "OPERATOR"
count · integer · required
How many of them there are. Always greater than zero.
checkCode · string · optional
The discovery-failure code of a `connection_check_failed` refusal: `unreachable`, `timeout`, `not_https`, `private_address`, `issuer_mismatch`, `missing_endpoint` or `invalid_document`. Present on that refusal alone, and ABSENT on every other problem document.
planLimit · object · optional
What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.
Show nested fields
What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.
currentPlan · object · required
A plan named by a `plan_location_limit_reached` refusal.
Show nested fields
A plan named by a `plan_location_limit_reached` refusal.
planId · string · required
The plan's stable identifier.
displayName · string · required
The plan's name, not translated.
maxLocations · integer · required
The most ACTIVE locations the plan covers.
activeLocations · integer · required
The number of ACTIVE locations the tenant holds.
nextPlan · object · optional
A plan named by a `plan_location_limit_reached` refusal.
Show nested fields
A plan named by a `plan_location_limit_reached` refusal.
planId · string · required
The plan's stable identifier.
displayName · string · required
The plan's name, not translated.
maxLocations · integer · required
The most ACTIVE locations the plan covers.
enterpriseOffer · object · optional
The published Enterprise offer, named when no active plan covers the tenant's active location count.
Show nested fields
The published Enterprise offer, named when no active plan covers the tenant's active location count.
minLocations · integer · required
The smallest number of locations the offer covers.
fromMonthlyPriceCents · integer · int64 · required
The monthly price from which the offer starts, in euro cents.
extraLocationPriceCents · integer · int64 · required
The monthly price of each location beyond `minLocations`, in euro cents.
contactEmail · string · optional
The address to write to about a larger plan or an individual contract.
Raw JSON Schema
application/problem+json
{
"type": "object",
"description": "An RFC 9457 problem document: `type`, `title`, `status`, `code` and `detail`, every one of those five always present. `errors`, `blockers`, `checkCode` and `planLimit` are the exceptions — each is scoped to one family of refusal and is ABSENT on every other document, which is why none is required below. `code` is the stable, machine-readable member; branch on it rather than on `title` or `detail`, which are English prose meant for a developer reading a log.",
"properties": {
"type": {
"type": "string",
"description": "A URN identifying the problem kind, one per `code`.",
"example": "urn:qms:problem:location_not_found"
},
"title": {
"type": "string",
"description": "A fixed English summary of the problem kind.",
"example": "Location Not Found"
},
"status": {
"type": "integer",
"description": "The HTTP status code, repeated in the body.",
"example": 404
},
"code": {
"type": "string",
"description": "The published slug this surface's error vocabulary uses.",
"example": "location_not_found"
},
"detail": {
"type": "string",
"description": "An English explanation of this occurrence.",
"example": "No location was found for this identifier."
},
"errors": {
"type": "array",
"description": "One entry per offending field of a 400 field-validation refusal. Present on those alone, and ABSENT — not null, not an empty array — on every other problem document, including a field-validation refusal that can name no single field. Sorted by `field`, so two refusals over the same body produce the same document.",
"items": {
"type": "object",
"description": "One offending field of a 400 field-validation refusal.",
"properties": {
"field": {
"type": "string",
"description": "The member as THIS document spells it, which is not always what the same field is called inside the system.",
"example": "defaultLocale"
},
"code": {
"type": "string",
"description": "The published reason slug. Typed as a plain string rather than an enumeration, because the set is not closed — an integrity backstop can report a slug outside the published list. The values in use today are `required`, `too_long`, `invalid_format`, `invalid_timezone`, `invalid_locale`, `invalid_country`, `name_taken`, `code_taken`, `display_prefix_taken`, `out_of_range`, `not_in_catalogue`, `archived`, `duplicate`, `not_found`, `not_linked_to_location`, `inactive`, `language_not_in_catalogue`, `not_writable`, `password_too_short` and `password_breached`.\n\nThree of them are worth a sentence. `invalid_format` covers a value whose SHAPE is wrong — a window code that is not alphanumeric, a time that is not `HH:MM` — and, on the operating hours, the one fault that is a relation rather than a shape: a `closesAt` that is not after its `opensAt`, where both values are well formed and it is their ORDER that is refused. It also covers a member whose JSON type cannot be read — a string where a boolean belongs — reported under its path, e.g. `operatingHours[0].closed`. `not_found` means the member names something this tenant does not hold; it is the same word as the document-level `code` that answers an unserved path, at a different level and never with that status. `not_writable` is the operator invite, the operator profile edit and the visit-reason replace's own: a body member the request type declares no slot for, refused by NAME whether or not its value would have changed anything. `password_too_short` and `password_breached` are the operator create's own, under `initialPassword`.",
"example": "invalid_locale"
}
},
"required": [
"field",
"code"
]
}
},
"blockers": {
"type": "array",
"description": "One entry per non-zero blocking category of a 409 refusal that names what blocks it. Present on those alone, and ABSENT on every other problem document. A category with nothing to report is absent rather than present with a count of 0.",
"items": {
"type": "object",
"description": "One non-zero blocking category of a 409 refusal, and how many things it counted.",
"properties": {
"kind": {
"type": "string",
"description": "What kind of thing still depends on the entry — or, on a configuration refusal, on what the write would take away.",
"enum": [
"LOCATION",
"TICKET",
"APPOINTMENT",
"TEMPLATE",
"OPERATOR"
],
"example": "TICKET"
},
"count": {
"type": "integer",
"description": "How many of them there are. Always greater than zero.",
"example": 3
}
},
"required": [
"kind",
"count"
]
}
},
"checkCode": {
"type": "string",
"description": "The discovery-failure code of a `connection_check_failed` refusal: `unreachable`, `timeout`, `not_https`, `private_address`, `issuer_mismatch`, `missing_endpoint` or `invalid_document`. Present on that refusal alone, and ABSENT on every other problem document.",
"example": "unreachable"
},
"planLimit": {
"type": "object",
"description": "What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.",
"properties": {
"currentPlan": {
"type": "object",
"description": "A plan named by a `plan_location_limit_reached` refusal.",
"properties": {
"planId": {
"type": "string",
"description": "The plan's stable identifier.",
"example": "business"
},
"displayName": {
"type": "string",
"description": "The plan's name, not translated.",
"example": "Business"
},
"maxLocations": {
"type": "integer",
"description": "The most ACTIVE locations the plan covers.",
"example": 5
}
},
"required": [
"planId",
"displayName",
"maxLocations"
]
},
"activeLocations": {
"type": "integer",
"description": "The number of ACTIVE locations the tenant holds.",
"example": 3
},
"nextPlan": {
"type": "object",
"description": "A plan named by a `plan_location_limit_reached` refusal.",
"properties": {
"planId": {
"type": "string",
"description": "The plan's stable identifier.",
"example": "business"
},
"displayName": {
"type": "string",
"description": "The plan's name, not translated.",
"example": "Business"
},
"maxLocations": {
"type": "integer",
"description": "The most ACTIVE locations the plan covers.",
"example": 5
}
},
"required": [
"planId",
"displayName",
"maxLocations"
]
},
"enterpriseOffer": {
"type": "object",
"description": "The published Enterprise offer, named when no active plan covers the tenant's active location count.",
"properties": {
"minLocations": {
"type": "integer",
"description": "The smallest number of locations the offer covers.",
"example": 8
},
"fromMonthlyPriceCents": {
"type": "integer",
"format": "int64",
"description": "The monthly price from which the offer starts, in euro cents.",
"example": 27900
},
"extraLocationPriceCents": {
"type": "integer",
"format": "int64",
"description": "The monthly price of each location beyond `minLocations`, in euro cents.",
"example": 2900
}
},
"required": [
"minLocations",
"fromMonthlyPriceCents",
"extraLocationPriceCents"
]
},
"contactEmail": {
"type": "string",
"description": "The address to write to about a larger plan or an individual contract.",
"example": "sales@example.com"
}
},
"required": [
"currentPlan",
"activeLocations"
]
}
},
"required": [
"type",
"title",
"status",
"code",
"detail"
],
"additionalProperties": false
}401 — No valid API credential was presented. Every refusal cause — absent, malformed, unknown, expired, revoked, or belonging to another tenant — answers with this one document, and no `WWW-Authenticate` header is returned.
{
"type": "urn:qms:problem:unauthenticated",
"title": "Unauthenticated",
"status": 401,
"code": "unauthenticated",
"detail": "The request presented no valid API credential."
}401 response schema
An RFC 9457 problem document: `type`, `title`, `status`, `code` and `detail`, every one of those five always present. `errors`, `blockers`, `checkCode` and `planLimit` are the exceptions — each is scoped to one family of refusal and is ABSENT on every other document, which is why none is required below. `code` is the stable, machine-readable member; branch on it rather than on `title` or `detail`, which are English prose meant for a developer reading a log.
type · string · required
A URN identifying the problem kind, one per `code`.
title · string · required
A fixed English summary of the problem kind.
status · integer · required
The HTTP status code, repeated in the body.
code · string · required
The published slug this surface's error vocabulary uses.
detail · string · required
An English explanation of this occurrence.
errors · array · optional
One entry per offending field of a 400 field-validation refusal. Present on those alone, and ABSENT — not null, not an empty array — on every other problem document, including a field-validation refusal that can name no single field. Sorted by `field`, so two refusals over the same body produce the same document.
Show nested fields
One offending field of a 400 field-validation refusal.
field · string · required
The member as THIS document spells it, which is not always what the same field is called inside the system.
code · string · required
The published reason slug. Typed as a plain string rather than an enumeration, because the set is not closed — an integrity backstop can report a slug outside the published list. The values in use today are `required`, `too_long`, `invalid_format`, `invalid_timezone`, `invalid_locale`, `invalid_country`, `name_taken`, `code_taken`, `display_prefix_taken`, `out_of_range`, `not_in_catalogue`, `archived`, `duplicate`, `not_found`, `not_linked_to_location`, `inactive`, `language_not_in_catalogue`, `not_writable`, `password_too_short` and `password_breached`. Three of them are worth a sentence. `invalid_format` covers a value whose SHAPE is wrong — a window code that is not alphanumeric, a time that is not `HH:MM` — and, on the operating hours, the one fault that is a relation rather than a shape: a `closesAt` that is not after its `opensAt`, where both values are well formed and it is their ORDER that is refused. It also covers a member whose JSON type cannot be read — a string where a boolean belongs — reported under its path, e.g. `operatingHours[0].closed`. `not_found` means the member names something this tenant does not hold; it is the same word as the document-level `code` that answers an unserved path, at a different level and never with that status. `not_writable` is the operator invite, the operator profile edit and the visit-reason replace's own: a body member the request type declares no slot for, refused by NAME whether or not its value would have changed anything. `password_too_short` and `password_breached` are the operator create's own, under `initialPassword`.
blockers · array · optional
One entry per non-zero blocking category of a 409 refusal that names what blocks it. Present on those alone, and ABSENT on every other problem document. A category with nothing to report is absent rather than present with a count of 0.
Show nested fields
One non-zero blocking category of a 409 refusal, and how many things it counted.
kind · string · required
What kind of thing still depends on the entry — or, on a configuration refusal, on what the write would take away.
Allowed values: "LOCATION", "TICKET", "APPOINTMENT", "TEMPLATE", "OPERATOR"
count · integer · required
How many of them there are. Always greater than zero.
checkCode · string · optional
The discovery-failure code of a `connection_check_failed` refusal: `unreachable`, `timeout`, `not_https`, `private_address`, `issuer_mismatch`, `missing_endpoint` or `invalid_document`. Present on that refusal alone, and ABSENT on every other problem document.
planLimit · object · optional
What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.
Show nested fields
What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.
currentPlan · object · required
A plan named by a `plan_location_limit_reached` refusal.
Show nested fields
A plan named by a `plan_location_limit_reached` refusal.
planId · string · required
The plan's stable identifier.
displayName · string · required
The plan's name, not translated.
maxLocations · integer · required
The most ACTIVE locations the plan covers.
activeLocations · integer · required
The number of ACTIVE locations the tenant holds.
nextPlan · object · optional
A plan named by a `plan_location_limit_reached` refusal.
Show nested fields
A plan named by a `plan_location_limit_reached` refusal.
planId · string · required
The plan's stable identifier.
displayName · string · required
The plan's name, not translated.
maxLocations · integer · required
The most ACTIVE locations the plan covers.
enterpriseOffer · object · optional
The published Enterprise offer, named when no active plan covers the tenant's active location count.
Show nested fields
The published Enterprise offer, named when no active plan covers the tenant's active location count.
minLocations · integer · required
The smallest number of locations the offer covers.
fromMonthlyPriceCents · integer · int64 · required
The monthly price from which the offer starts, in euro cents.
extraLocationPriceCents · integer · int64 · required
The monthly price of each location beyond `minLocations`, in euro cents.
contactEmail · string · optional
The address to write to about a larger plan or an individual contract.
Raw JSON Schema
application/problem+json
{
"type": "object",
"description": "An RFC 9457 problem document: `type`, `title`, `status`, `code` and `detail`, every one of those five always present. `errors`, `blockers`, `checkCode` and `planLimit` are the exceptions — each is scoped to one family of refusal and is ABSENT on every other document, which is why none is required below. `code` is the stable, machine-readable member; branch on it rather than on `title` or `detail`, which are English prose meant for a developer reading a log.",
"properties": {
"type": {
"type": "string",
"description": "A URN identifying the problem kind, one per `code`.",
"example": "urn:qms:problem:location_not_found"
},
"title": {
"type": "string",
"description": "A fixed English summary of the problem kind.",
"example": "Location Not Found"
},
"status": {
"type": "integer",
"description": "The HTTP status code, repeated in the body.",
"example": 404
},
"code": {
"type": "string",
"description": "The published slug this surface's error vocabulary uses.",
"example": "location_not_found"
},
"detail": {
"type": "string",
"description": "An English explanation of this occurrence.",
"example": "No location was found for this identifier."
},
"errors": {
"type": "array",
"description": "One entry per offending field of a 400 field-validation refusal. Present on those alone, and ABSENT — not null, not an empty array — on every other problem document, including a field-validation refusal that can name no single field. Sorted by `field`, so two refusals over the same body produce the same document.",
"items": {
"type": "object",
"description": "One offending field of a 400 field-validation refusal.",
"properties": {
"field": {
"type": "string",
"description": "The member as THIS document spells it, which is not always what the same field is called inside the system.",
"example": "defaultLocale"
},
"code": {
"type": "string",
"description": "The published reason slug. Typed as a plain string rather than an enumeration, because the set is not closed — an integrity backstop can report a slug outside the published list. The values in use today are `required`, `too_long`, `invalid_format`, `invalid_timezone`, `invalid_locale`, `invalid_country`, `name_taken`, `code_taken`, `display_prefix_taken`, `out_of_range`, `not_in_catalogue`, `archived`, `duplicate`, `not_found`, `not_linked_to_location`, `inactive`, `language_not_in_catalogue`, `not_writable`, `password_too_short` and `password_breached`.\n\nThree of them are worth a sentence. `invalid_format` covers a value whose SHAPE is wrong — a window code that is not alphanumeric, a time that is not `HH:MM` — and, on the operating hours, the one fault that is a relation rather than a shape: a `closesAt` that is not after its `opensAt`, where both values are well formed and it is their ORDER that is refused. It also covers a member whose JSON type cannot be read — a string where a boolean belongs — reported under its path, e.g. `operatingHours[0].closed`. `not_found` means the member names something this tenant does not hold; it is the same word as the document-level `code` that answers an unserved path, at a different level and never with that status. `not_writable` is the operator invite, the operator profile edit and the visit-reason replace's own: a body member the request type declares no slot for, refused by NAME whether or not its value would have changed anything. `password_too_short` and `password_breached` are the operator create's own, under `initialPassword`.",
"example": "invalid_locale"
}
},
"required": [
"field",
"code"
]
}
},
"blockers": {
"type": "array",
"description": "One entry per non-zero blocking category of a 409 refusal that names what blocks it. Present on those alone, and ABSENT on every other problem document. A category with nothing to report is absent rather than present with a count of 0.",
"items": {
"type": "object",
"description": "One non-zero blocking category of a 409 refusal, and how many things it counted.",
"properties": {
"kind": {
"type": "string",
"description": "What kind of thing still depends on the entry — or, on a configuration refusal, on what the write would take away.",
"enum": [
"LOCATION",
"TICKET",
"APPOINTMENT",
"TEMPLATE",
"OPERATOR"
],
"example": "TICKET"
},
"count": {
"type": "integer",
"description": "How many of them there are. Always greater than zero.",
"example": 3
}
},
"required": [
"kind",
"count"
]
}
},
"checkCode": {
"type": "string",
"description": "The discovery-failure code of a `connection_check_failed` refusal: `unreachable`, `timeout`, `not_https`, `private_address`, `issuer_mismatch`, `missing_endpoint` or `invalid_document`. Present on that refusal alone, and ABSENT on every other problem document.",
"example": "unreachable"
},
"planLimit": {
"type": "object",
"description": "What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.",
"properties": {
"currentPlan": {
"type": "object",
"description": "A plan named by a `plan_location_limit_reached` refusal.",
"properties": {
"planId": {
"type": "string",
"description": "The plan's stable identifier.",
"example": "business"
},
"displayName": {
"type": "string",
"description": "The plan's name, not translated.",
"example": "Business"
},
"maxLocations": {
"type": "integer",
"description": "The most ACTIVE locations the plan covers.",
"example": 5
}
},
"required": [
"planId",
"displayName",
"maxLocations"
]
},
"activeLocations": {
"type": "integer",
"description": "The number of ACTIVE locations the tenant holds.",
"example": 3
},
"nextPlan": {
"type": "object",
"description": "A plan named by a `plan_location_limit_reached` refusal.",
"properties": {
"planId": {
"type": "string",
"description": "The plan's stable identifier.",
"example": "business"
},
"displayName": {
"type": "string",
"description": "The plan's name, not translated.",
"example": "Business"
},
"maxLocations": {
"type": "integer",
"description": "The most ACTIVE locations the plan covers.",
"example": 5
}
},
"required": [
"planId",
"displayName",
"maxLocations"
]
},
"enterpriseOffer": {
"type": "object",
"description": "The published Enterprise offer, named when no active plan covers the tenant's active location count.",
"properties": {
"minLocations": {
"type": "integer",
"description": "The smallest number of locations the offer covers.",
"example": 8
},
"fromMonthlyPriceCents": {
"type": "integer",
"format": "int64",
"description": "The monthly price from which the offer starts, in euro cents.",
"example": 27900
},
"extraLocationPriceCents": {
"type": "integer",
"format": "int64",
"description": "The monthly price of each location beyond `minLocations`, in euro cents.",
"example": 2900
}
},
"required": [
"minLocations",
"fromMonthlyPriceCents",
"extraLocationPriceCents"
]
},
"contactEmail": {
"type": "string",
"description": "The address to write to about a larger plan or an individual contract.",
"example": "sales@example.com"
}
},
"required": [
"currentPlan",
"activeLocations"
]
}
},
"required": [
"type",
"title",
"status",
"code",
"detail"
],
"additionalProperties": false
}403 — The operation was refused before anything was read or written. Two codes share this status: `insufficient_scope` when the credential's scope set does not admit the operation at all, and `insufficient_authority` when the scope set admits it but the user who issued the credential is a location manager and the operation requires a tenant administrator. The scope check runs first, so it displaces the authority refusal whenever both apply, and widening the scopes never lifts the authority refusal. Branch on `code`, never on the status alone.
{
"type": "urn:qms:problem:insufficient_scope",
"title": "Insufficient Scope",
"status": 403,
"code": "insufficient_scope",
"detail": "The API credential does not reach this operation."
}{
"type": "urn:qms:problem:insufficient_authority",
"title": "Insufficient Authority",
"status": 403,
"code": "insufficient_authority",
"detail": "The API credential's role does not reach this operation."
}403 response schema
An RFC 9457 problem document: `type`, `title`, `status`, `code` and `detail`, every one of those five always present. `errors`, `blockers`, `checkCode` and `planLimit` are the exceptions — each is scoped to one family of refusal and is ABSENT on every other document, which is why none is required below. `code` is the stable, machine-readable member; branch on it rather than on `title` or `detail`, which are English prose meant for a developer reading a log.
type · string · required
A URN identifying the problem kind, one per `code`.
title · string · required
A fixed English summary of the problem kind.
status · integer · required
The HTTP status code, repeated in the body.
code · string · required
The published slug this surface's error vocabulary uses.
detail · string · required
An English explanation of this occurrence.
errors · array · optional
One entry per offending field of a 400 field-validation refusal. Present on those alone, and ABSENT — not null, not an empty array — on every other problem document, including a field-validation refusal that can name no single field. Sorted by `field`, so two refusals over the same body produce the same document.
Show nested fields
One offending field of a 400 field-validation refusal.
field · string · required
The member as THIS document spells it, which is not always what the same field is called inside the system.
code · string · required
The published reason slug. Typed as a plain string rather than an enumeration, because the set is not closed — an integrity backstop can report a slug outside the published list. The values in use today are `required`, `too_long`, `invalid_format`, `invalid_timezone`, `invalid_locale`, `invalid_country`, `name_taken`, `code_taken`, `display_prefix_taken`, `out_of_range`, `not_in_catalogue`, `archived`, `duplicate`, `not_found`, `not_linked_to_location`, `inactive`, `language_not_in_catalogue`, `not_writable`, `password_too_short` and `password_breached`. Three of them are worth a sentence. `invalid_format` covers a value whose SHAPE is wrong — a window code that is not alphanumeric, a time that is not `HH:MM` — and, on the operating hours, the one fault that is a relation rather than a shape: a `closesAt` that is not after its `opensAt`, where both values are well formed and it is their ORDER that is refused. It also covers a member whose JSON type cannot be read — a string where a boolean belongs — reported under its path, e.g. `operatingHours[0].closed`. `not_found` means the member names something this tenant does not hold; it is the same word as the document-level `code` that answers an unserved path, at a different level and never with that status. `not_writable` is the operator invite, the operator profile edit and the visit-reason replace's own: a body member the request type declares no slot for, refused by NAME whether or not its value would have changed anything. `password_too_short` and `password_breached` are the operator create's own, under `initialPassword`.
blockers · array · optional
One entry per non-zero blocking category of a 409 refusal that names what blocks it. Present on those alone, and ABSENT on every other problem document. A category with nothing to report is absent rather than present with a count of 0.
Show nested fields
One non-zero blocking category of a 409 refusal, and how many things it counted.
kind · string · required
What kind of thing still depends on the entry — or, on a configuration refusal, on what the write would take away.
Allowed values: "LOCATION", "TICKET", "APPOINTMENT", "TEMPLATE", "OPERATOR"
count · integer · required
How many of them there are. Always greater than zero.
checkCode · string · optional
The discovery-failure code of a `connection_check_failed` refusal: `unreachable`, `timeout`, `not_https`, `private_address`, `issuer_mismatch`, `missing_endpoint` or `invalid_document`. Present on that refusal alone, and ABSENT on every other problem document.
planLimit · object · optional
What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.
Show nested fields
What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.
currentPlan · object · required
A plan named by a `plan_location_limit_reached` refusal.
Show nested fields
A plan named by a `plan_location_limit_reached` refusal.
planId · string · required
The plan's stable identifier.
displayName · string · required
The plan's name, not translated.
maxLocations · integer · required
The most ACTIVE locations the plan covers.
activeLocations · integer · required
The number of ACTIVE locations the tenant holds.
nextPlan · object · optional
A plan named by a `plan_location_limit_reached` refusal.
Show nested fields
A plan named by a `plan_location_limit_reached` refusal.
planId · string · required
The plan's stable identifier.
displayName · string · required
The plan's name, not translated.
maxLocations · integer · required
The most ACTIVE locations the plan covers.
enterpriseOffer · object · optional
The published Enterprise offer, named when no active plan covers the tenant's active location count.
Show nested fields
The published Enterprise offer, named when no active plan covers the tenant's active location count.
minLocations · integer · required
The smallest number of locations the offer covers.
fromMonthlyPriceCents · integer · int64 · required
The monthly price from which the offer starts, in euro cents.
extraLocationPriceCents · integer · int64 · required
The monthly price of each location beyond `minLocations`, in euro cents.
contactEmail · string · optional
The address to write to about a larger plan or an individual contract.
Raw JSON Schema
application/problem+json
{
"type": "object",
"description": "An RFC 9457 problem document: `type`, `title`, `status`, `code` and `detail`, every one of those five always present. `errors`, `blockers`, `checkCode` and `planLimit` are the exceptions — each is scoped to one family of refusal and is ABSENT on every other document, which is why none is required below. `code` is the stable, machine-readable member; branch on it rather than on `title` or `detail`, which are English prose meant for a developer reading a log.",
"properties": {
"type": {
"type": "string",
"description": "A URN identifying the problem kind, one per `code`.",
"example": "urn:qms:problem:location_not_found"
},
"title": {
"type": "string",
"description": "A fixed English summary of the problem kind.",
"example": "Location Not Found"
},
"status": {
"type": "integer",
"description": "The HTTP status code, repeated in the body.",
"example": 404
},
"code": {
"type": "string",
"description": "The published slug this surface's error vocabulary uses.",
"example": "location_not_found"
},
"detail": {
"type": "string",
"description": "An English explanation of this occurrence.",
"example": "No location was found for this identifier."
},
"errors": {
"type": "array",
"description": "One entry per offending field of a 400 field-validation refusal. Present on those alone, and ABSENT — not null, not an empty array — on every other problem document, including a field-validation refusal that can name no single field. Sorted by `field`, so two refusals over the same body produce the same document.",
"items": {
"type": "object",
"description": "One offending field of a 400 field-validation refusal.",
"properties": {
"field": {
"type": "string",
"description": "The member as THIS document spells it, which is not always what the same field is called inside the system.",
"example": "defaultLocale"
},
"code": {
"type": "string",
"description": "The published reason slug. Typed as a plain string rather than an enumeration, because the set is not closed — an integrity backstop can report a slug outside the published list. The values in use today are `required`, `too_long`, `invalid_format`, `invalid_timezone`, `invalid_locale`, `invalid_country`, `name_taken`, `code_taken`, `display_prefix_taken`, `out_of_range`, `not_in_catalogue`, `archived`, `duplicate`, `not_found`, `not_linked_to_location`, `inactive`, `language_not_in_catalogue`, `not_writable`, `password_too_short` and `password_breached`.\n\nThree of them are worth a sentence. `invalid_format` covers a value whose SHAPE is wrong — a window code that is not alphanumeric, a time that is not `HH:MM` — and, on the operating hours, the one fault that is a relation rather than a shape: a `closesAt` that is not after its `opensAt`, where both values are well formed and it is their ORDER that is refused. It also covers a member whose JSON type cannot be read — a string where a boolean belongs — reported under its path, e.g. `operatingHours[0].closed`. `not_found` means the member names something this tenant does not hold; it is the same word as the document-level `code` that answers an unserved path, at a different level and never with that status. `not_writable` is the operator invite, the operator profile edit and the visit-reason replace's own: a body member the request type declares no slot for, refused by NAME whether or not its value would have changed anything. `password_too_short` and `password_breached` are the operator create's own, under `initialPassword`.",
"example": "invalid_locale"
}
},
"required": [
"field",
"code"
]
}
},
"blockers": {
"type": "array",
"description": "One entry per non-zero blocking category of a 409 refusal that names what blocks it. Present on those alone, and ABSENT on every other problem document. A category with nothing to report is absent rather than present with a count of 0.",
"items": {
"type": "object",
"description": "One non-zero blocking category of a 409 refusal, and how many things it counted.",
"properties": {
"kind": {
"type": "string",
"description": "What kind of thing still depends on the entry — or, on a configuration refusal, on what the write would take away.",
"enum": [
"LOCATION",
"TICKET",
"APPOINTMENT",
"TEMPLATE",
"OPERATOR"
],
"example": "TICKET"
},
"count": {
"type": "integer",
"description": "How many of them there are. Always greater than zero.",
"example": 3
}
},
"required": [
"kind",
"count"
]
}
},
"checkCode": {
"type": "string",
"description": "The discovery-failure code of a `connection_check_failed` refusal: `unreachable`, `timeout`, `not_https`, `private_address`, `issuer_mismatch`, `missing_endpoint` or `invalid_document`. Present on that refusal alone, and ABSENT on every other problem document.",
"example": "unreachable"
},
"planLimit": {
"type": "object",
"description": "What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.",
"properties": {
"currentPlan": {
"type": "object",
"description": "A plan named by a `plan_location_limit_reached` refusal.",
"properties": {
"planId": {
"type": "string",
"description": "The plan's stable identifier.",
"example": "business"
},
"displayName": {
"type": "string",
"description": "The plan's name, not translated.",
"example": "Business"
},
"maxLocations": {
"type": "integer",
"description": "The most ACTIVE locations the plan covers.",
"example": 5
}
},
"required": [
"planId",
"displayName",
"maxLocations"
]
},
"activeLocations": {
"type": "integer",
"description": "The number of ACTIVE locations the tenant holds.",
"example": 3
},
"nextPlan": {
"type": "object",
"description": "A plan named by a `plan_location_limit_reached` refusal.",
"properties": {
"planId": {
"type": "string",
"description": "The plan's stable identifier.",
"example": "business"
},
"displayName": {
"type": "string",
"description": "The plan's name, not translated.",
"example": "Business"
},
"maxLocations": {
"type": "integer",
"description": "The most ACTIVE locations the plan covers.",
"example": 5
}
},
"required": [
"planId",
"displayName",
"maxLocations"
]
},
"enterpriseOffer": {
"type": "object",
"description": "The published Enterprise offer, named when no active plan covers the tenant's active location count.",
"properties": {
"minLocations": {
"type": "integer",
"description": "The smallest number of locations the offer covers.",
"example": 8
},
"fromMonthlyPriceCents": {
"type": "integer",
"format": "int64",
"description": "The monthly price from which the offer starts, in euro cents.",
"example": 27900
},
"extraLocationPriceCents": {
"type": "integer",
"format": "int64",
"description": "The monthly price of each location beyond `minLocations`, in euro cents.",
"example": 2900
}
},
"required": [
"minLocations",
"fromMonthlyPriceCents",
"extraLocationPriceCents"
]
},
"contactEmail": {
"type": "string",
"description": "The address to write to about a larger plan or an individual contract.",
"example": "sales@example.com"
}
},
"required": [
"currentPlan",
"activeLocations"
]
}
},
"required": [
"type",
"title",
"status",
"code",
"detail"
],
"additionalProperties": false
}500 — The request could not be processed. The body names no internal detail. A retry is safe on every read described here; on a create, an edit or a lifecycle transition a retry may or may not repeat a change that already committed, so read the resource back before retrying one of those.
{
"type": "urn:qms:problem:internal_error",
"title": "Internal Server Error",
"status": 500,
"code": "internal_error",
"detail": "The request could not be processed."
}500 response schema
An RFC 9457 problem document: `type`, `title`, `status`, `code` and `detail`, every one of those five always present. `errors`, `blockers`, `checkCode` and `planLimit` are the exceptions — each is scoped to one family of refusal and is ABSENT on every other document, which is why none is required below. `code` is the stable, machine-readable member; branch on it rather than on `title` or `detail`, which are English prose meant for a developer reading a log.
type · string · required
A URN identifying the problem kind, one per `code`.
title · string · required
A fixed English summary of the problem kind.
status · integer · required
The HTTP status code, repeated in the body.
code · string · required
The published slug this surface's error vocabulary uses.
detail · string · required
An English explanation of this occurrence.
errors · array · optional
One entry per offending field of a 400 field-validation refusal. Present on those alone, and ABSENT — not null, not an empty array — on every other problem document, including a field-validation refusal that can name no single field. Sorted by `field`, so two refusals over the same body produce the same document.
Show nested fields
One offending field of a 400 field-validation refusal.
field · string · required
The member as THIS document spells it, which is not always what the same field is called inside the system.
code · string · required
The published reason slug. Typed as a plain string rather than an enumeration, because the set is not closed — an integrity backstop can report a slug outside the published list. The values in use today are `required`, `too_long`, `invalid_format`, `invalid_timezone`, `invalid_locale`, `invalid_country`, `name_taken`, `code_taken`, `display_prefix_taken`, `out_of_range`, `not_in_catalogue`, `archived`, `duplicate`, `not_found`, `not_linked_to_location`, `inactive`, `language_not_in_catalogue`, `not_writable`, `password_too_short` and `password_breached`. Three of them are worth a sentence. `invalid_format` covers a value whose SHAPE is wrong — a window code that is not alphanumeric, a time that is not `HH:MM` — and, on the operating hours, the one fault that is a relation rather than a shape: a `closesAt` that is not after its `opensAt`, where both values are well formed and it is their ORDER that is refused. It also covers a member whose JSON type cannot be read — a string where a boolean belongs — reported under its path, e.g. `operatingHours[0].closed`. `not_found` means the member names something this tenant does not hold; it is the same word as the document-level `code` that answers an unserved path, at a different level and never with that status. `not_writable` is the operator invite, the operator profile edit and the visit-reason replace's own: a body member the request type declares no slot for, refused by NAME whether or not its value would have changed anything. `password_too_short` and `password_breached` are the operator create's own, under `initialPassword`.
blockers · array · optional
One entry per non-zero blocking category of a 409 refusal that names what blocks it. Present on those alone, and ABSENT on every other problem document. A category with nothing to report is absent rather than present with a count of 0.
Show nested fields
One non-zero blocking category of a 409 refusal, and how many things it counted.
kind · string · required
What kind of thing still depends on the entry — or, on a configuration refusal, on what the write would take away.
Allowed values: "LOCATION", "TICKET", "APPOINTMENT", "TEMPLATE", "OPERATOR"
count · integer · required
How many of them there are. Always greater than zero.
checkCode · string · optional
The discovery-failure code of a `connection_check_failed` refusal: `unreachable`, `timeout`, `not_https`, `private_address`, `issuer_mismatch`, `missing_endpoint` or `invalid_document`. Present on that refusal alone, and ABSENT on every other problem document.
planLimit · object · optional
What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.
Show nested fields
What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.
currentPlan · object · required
A plan named by a `plan_location_limit_reached` refusal.
Show nested fields
A plan named by a `plan_location_limit_reached` refusal.
planId · string · required
The plan's stable identifier.
displayName · string · required
The plan's name, not translated.
maxLocations · integer · required
The most ACTIVE locations the plan covers.
activeLocations · integer · required
The number of ACTIVE locations the tenant holds.
nextPlan · object · optional
A plan named by a `plan_location_limit_reached` refusal.
Show nested fields
A plan named by a `plan_location_limit_reached` refusal.
planId · string · required
The plan's stable identifier.
displayName · string · required
The plan's name, not translated.
maxLocations · integer · required
The most ACTIVE locations the plan covers.
enterpriseOffer · object · optional
The published Enterprise offer, named when no active plan covers the tenant's active location count.
Show nested fields
The published Enterprise offer, named when no active plan covers the tenant's active location count.
minLocations · integer · required
The smallest number of locations the offer covers.
fromMonthlyPriceCents · integer · int64 · required
The monthly price from which the offer starts, in euro cents.
extraLocationPriceCents · integer · int64 · required
The monthly price of each location beyond `minLocations`, in euro cents.
contactEmail · string · optional
The address to write to about a larger plan or an individual contract.
Raw JSON Schema
application/problem+json
{
"type": "object",
"description": "An RFC 9457 problem document: `type`, `title`, `status`, `code` and `detail`, every one of those five always present. `errors`, `blockers`, `checkCode` and `planLimit` are the exceptions — each is scoped to one family of refusal and is ABSENT on every other document, which is why none is required below. `code` is the stable, machine-readable member; branch on it rather than on `title` or `detail`, which are English prose meant for a developer reading a log.",
"properties": {
"type": {
"type": "string",
"description": "A URN identifying the problem kind, one per `code`.",
"example": "urn:qms:problem:location_not_found"
},
"title": {
"type": "string",
"description": "A fixed English summary of the problem kind.",
"example": "Location Not Found"
},
"status": {
"type": "integer",
"description": "The HTTP status code, repeated in the body.",
"example": 404
},
"code": {
"type": "string",
"description": "The published slug this surface's error vocabulary uses.",
"example": "location_not_found"
},
"detail": {
"type": "string",
"description": "An English explanation of this occurrence.",
"example": "No location was found for this identifier."
},
"errors": {
"type": "array",
"description": "One entry per offending field of a 400 field-validation refusal. Present on those alone, and ABSENT — not null, not an empty array — on every other problem document, including a field-validation refusal that can name no single field. Sorted by `field`, so two refusals over the same body produce the same document.",
"items": {
"type": "object",
"description": "One offending field of a 400 field-validation refusal.",
"properties": {
"field": {
"type": "string",
"description": "The member as THIS document spells it, which is not always what the same field is called inside the system.",
"example": "defaultLocale"
},
"code": {
"type": "string",
"description": "The published reason slug. Typed as a plain string rather than an enumeration, because the set is not closed — an integrity backstop can report a slug outside the published list. The values in use today are `required`, `too_long`, `invalid_format`, `invalid_timezone`, `invalid_locale`, `invalid_country`, `name_taken`, `code_taken`, `display_prefix_taken`, `out_of_range`, `not_in_catalogue`, `archived`, `duplicate`, `not_found`, `not_linked_to_location`, `inactive`, `language_not_in_catalogue`, `not_writable`, `password_too_short` and `password_breached`.\n\nThree of them are worth a sentence. `invalid_format` covers a value whose SHAPE is wrong — a window code that is not alphanumeric, a time that is not `HH:MM` — and, on the operating hours, the one fault that is a relation rather than a shape: a `closesAt` that is not after its `opensAt`, where both values are well formed and it is their ORDER that is refused. It also covers a member whose JSON type cannot be read — a string where a boolean belongs — reported under its path, e.g. `operatingHours[0].closed`. `not_found` means the member names something this tenant does not hold; it is the same word as the document-level `code` that answers an unserved path, at a different level and never with that status. `not_writable` is the operator invite, the operator profile edit and the visit-reason replace's own: a body member the request type declares no slot for, refused by NAME whether or not its value would have changed anything. `password_too_short` and `password_breached` are the operator create's own, under `initialPassword`.",
"example": "invalid_locale"
}
},
"required": [
"field",
"code"
]
}
},
"blockers": {
"type": "array",
"description": "One entry per non-zero blocking category of a 409 refusal that names what blocks it. Present on those alone, and ABSENT on every other problem document. A category with nothing to report is absent rather than present with a count of 0.",
"items": {
"type": "object",
"description": "One non-zero blocking category of a 409 refusal, and how many things it counted.",
"properties": {
"kind": {
"type": "string",
"description": "What kind of thing still depends on the entry — or, on a configuration refusal, on what the write would take away.",
"enum": [
"LOCATION",
"TICKET",
"APPOINTMENT",
"TEMPLATE",
"OPERATOR"
],
"example": "TICKET"
},
"count": {
"type": "integer",
"description": "How many of them there are. Always greater than zero.",
"example": 3
}
},
"required": [
"kind",
"count"
]
}
},
"checkCode": {
"type": "string",
"description": "The discovery-failure code of a `connection_check_failed` refusal: `unreachable`, `timeout`, `not_https`, `private_address`, `issuer_mismatch`, `missing_endpoint` or `invalid_document`. Present on that refusal alone, and ABSENT on every other problem document.",
"example": "unreachable"
},
"planLimit": {
"type": "object",
"description": "What a `plan_location_limit_reached` refusal reports. Present on that refusal alone, and ABSENT on every other problem document. Exactly one of `nextPlan` and `enterpriseOffer` is present: `nextPlan` when an active plan above the active location count exists, `enterpriseOffer` when none does. `contactEmail` is absent when no contact address is configured.",
"properties": {
"currentPlan": {
"type": "object",
"description": "A plan named by a `plan_location_limit_reached` refusal.",
"properties": {
"planId": {
"type": "string",
"description": "The plan's stable identifier.",
"example": "business"
},
"displayName": {
"type": "string",
"description": "The plan's name, not translated.",
"example": "Business"
},
"maxLocations": {
"type": "integer",
"description": "The most ACTIVE locations the plan covers.",
"example": 5
}
},
"required": [
"planId",
"displayName",
"maxLocations"
]
},
"activeLocations": {
"type": "integer",
"description": "The number of ACTIVE locations the tenant holds.",
"example": 3
},
"nextPlan": {
"type": "object",
"description": "A plan named by a `plan_location_limit_reached` refusal.",
"properties": {
"planId": {
"type": "string",
"description": "The plan's stable identifier.",
"example": "business"
},
"displayName": {
"type": "string",
"description": "The plan's name, not translated.",
"example": "Business"
},
"maxLocations": {
"type": "integer",
"description": "The most ACTIVE locations the plan covers.",
"example": 5
}
},
"required": [
"planId",
"displayName",
"maxLocations"
]
},
"enterpriseOffer": {
"type": "object",
"description": "The published Enterprise offer, named when no active plan covers the tenant's active location count.",
"properties": {
"minLocations": {
"type": "integer",
"description": "The smallest number of locations the offer covers.",
"example": 8
},
"fromMonthlyPriceCents": {
"type": "integer",
"format": "int64",
"description": "The monthly price from which the offer starts, in euro cents.",
"example": 27900
},
"extraLocationPriceCents": {
"type": "integer",
"format": "int64",
"description": "The monthly price of each location beyond `minLocations`, in euro cents.",
"example": 2900
}
},
"required": [
"minLocations",
"fromMonthlyPriceCents",
"extraLocationPriceCents"
]
},
"contactEmail": {
"type": "string",
"description": "The address to write to about a larger plan or an individual contract.",
"example": "sales@example.com"
}
},
"required": [
"currentPlan",
"activeLocations"
]
}
},
"required": [
"type",
"title",
"status",
"code",
"detail"
],
"additionalProperties": false
}