Return Codes

PCI Booking API responses use standard HTTP status codes combined with application-specific return codes. Error responses include a numeric code and human-readable message and moreInfo fields. The exception is a failed authentication, which returns 401 with an empty body. See Authentication and Permission Failures.

Success Codes

HTTP Status	Meaning
`200 OK`	Request completed successfully
`201 Created`	Resource created successfully

Error Response Format

Error responses are returned as an ErrorBlock. The format depends on the Accept header of the request, not on the format of the request body. With Accept: application/json:

{
  "code": -125,
  "message": "Bad input data",
  "moreInfo": "Invalid card number",
  "errorList": null
}

With any other Accept header, or none, the error is XML:

<ErrorBlock>
  <code>-125</code>
  <message>Bad input data</message>
  <moreInfo>Invalid card number</moreInfo>
</ErrorBlock>

Field	Content
`code`	The application error code (see the table below).
`message`	Short description of the error class.
`moreInfo`	Additional detail about this specific failure.
`errorList`	Array of individual validation errors, when applicable (e.g. code `-179`); otherwise `null`.

Application Error Codes

Return Code	Name	Description
`-112`	Bad Destination	Destination URL is unreachable or invalid
`-113`	Disallowed Operation	Not authorized to perform this action on the resource
`-123`	Bad Document	Request body is not valid XML or is badly formatted
`-125`	Bad Data	Input data is invalid (e.g., invalid card number, missing required field)
`-126`	Data Too Long	Input data exceeds maximum allowed length
`-150`	System Error	Internal server error
`-160`	URI Not Found	Requested resource does not exist. For tokens, only Delete Token returns this code; see Token Not Found or Not Accessible
`-168`	Data Conflict	Action cannot be performed on the resource in its current state
`-175`	Timeout	Operation timed out (e.g., third-party server did not respond)
`-179`	Bad Parameter	Request parameter is invalid or missing
`-1003`	Unauthorized	With HTTP `401`: the token does not exist, was deleted, or is not accessible to you. See Token Not Found or Not Accessible. With HTTP `403`: your user is not allowed to call this endpoint. See Authentication and Permission Failures
`-1010`	Locked for Updates	Resource is locked and cannot be modified

This table lists only the codes the API actually returns. A few others exist in the platform but belong to the portal’s sign-in flow and never reach an API caller.

Common Causes for Frequently Misread Codes

Two codes are consistently misread because their generic text doesn’t match their most common real-world cause:

The message “You are not authorized to access this resource. Please contact customer support.” reads like an auth/permissions bug, but on a token-related call it most often means:

The token was deleted or never existed. By far the most common cause - check whether the token was deleted (deletions are permanent) or whether a prior tokenization actually succeeded.
The token belongs to a different environment. A sandbox-created token cannot be accessed from a production account, or vice versa.
The account is blocked or terminated. Check account status before assuming it’s a credentials issue.
It is almost never an authentication failure. An invalid API key or an expired session token returns 401 with an empty body and no code.

“Internal server error” sounds like a PCI Booking-side bug, but it most often means:

The request body is malformed - commonly an invalid credential structure (wrong field names for the gateway) rather than an actual server fault.
A tokenization attempt failed upstream. If a tokenization silently failed, any later action on the token you expected to exist will surface as -1003 rather than repeating -150.

HTTP Status Code Mapping

PCI Booking maps application errors to standard HTTP status codes:

HTTP Status	When Returned
`400 Bad Request`	Bad data, bad document, bad parameter
`401 Unauthorized`	Authentication failed (empty body), or the token is not accessible (`-1003`)
`403 Forbidden`	Disallowed operation, or your user is not allowed to call the endpoint (`-1003`)
`404 Not Found`	URI not found
`413 Payload Too Large`	Data too long
`423 Locked`	Locked for updates
`504 Gateway Timeout`	Timeout
`409 Conflict`	Data conflict
`500 Internal Server Error`	System error

Error Handling - every condition with its exact moreInfo text, cause and fix
API Conventions - Request and response formats, headers, and common patterns
Authentication - API key, session token, and access token setup

Start Here

Getting Started

Concepts

Guides

Capture Cards

Payments Library

Manage Tokens

Use Tokens

Account Configuration

Additional Functions

Reference

Support

Success Codes

Error Response Format

Application Error Codes

Common Causes for Frequently Misread Codes

HTTP Status Code Mapping

​Success Codes

​Error Response Format

​Application Error Codes

​Common Causes for Frequently Misread Codes

​HTTP Status Code Mapping

​Related

Success Codes

Error Response Format

Application Error Codes

Common Causes for Frequently Misread Codes

HTTP Status Code Mapping

Related