PCI Booking API responses use standard HTTP status codes combined with application-specific return codes. Error responses include a numeric code and human-readable message and moreInfo fields. The exception is a failed authentication, which returns 401 with an empty body. See Authentication and Permission Failures.
Success Codes
Error responses are returned as an ErrorBlock. The format depends on the Accept header of the request, not on the format of the request body. With Accept: application/json:
With any other Accept header, or none, the error is XML:
Application Error Codes
This table lists only the codes the API actually returns. A few others exist in the platform but belong to the portal’s sign-in flow and never reach an API caller.
Common Causes for Frequently Misread Codes
Two codes are consistently misread because their generic text doesn’t match their most common real-world cause:
The message “You are not authorized to access this resource. Please contact customer support.” reads like an auth/permissions bug, but on a token-related call it most often means:
- The token was deleted or never existed. By far the most common cause - check whether the token was deleted (deletions are permanent) or whether a prior tokenization actually succeeded.
- The token belongs to a different environment. A sandbox-created token cannot be accessed from a production account, or vice versa.
- The account is blocked or terminated. Check account status before assuming it’s a credentials issue.
- It is almost never an authentication failure. An invalid API key or an expired session token returns
401 with an empty body and no code.
“Internal server error” sounds like a PCI Booking-side bug, but it most often means:
- The request body is malformed - commonly an invalid credential structure (wrong field names for the gateway) rather than an actual server fault.
- A tokenization attempt failed upstream. If a tokenization silently failed, any later action on the token you expected to exist will surface as
-1003 rather than repeating -150.
HTTP Status Code Mapping
PCI Booking maps application errors to standard HTTP status codes:
- Error Handling - every condition with its exact
moreInfo text, cause and fix
- API Conventions - Request and response formats, headers, and common patterns
- Authentication - API key, session token, and access token setup
