Errors

Errors come back as JSON with a code and a message that says what to fix.

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "Send start and end (ISO 8601, e.g. 2026-10-05T09:00:00-04:00)."
  }
}

Status	Code	When
`400`	`INVALID_REQUEST`	The body or a parameter is missing or wrong. The message says what to fix.
`401`	`UNAUTHORIZED`	No key, a malformed key, or a revoked key.
`403`	`API_OFF`	API keys aren't switched on for the business.
`403`	`FORBIDDEN`	The key may not do this: someone else's time or a master-key-only endpoint with a personal key, approved time, time in a pay run, a holder who left the business, or a master key whose holder is no longer the owner.
`409`	`NOTHING_TO_BILL`	No next service period or no billable invoice lines remain.
`409`	`CONFLICT`	Only draft invoices can be changed.
`404`	`NOT_FOUND`	No such entry, project or task that the key's holder can see.

Messages are written for people, so it's fine to show them to whoever made the request. Someone else's entry reads as not found to a personal key.