Return Codes

PCI Booking API responses use standard HTTP status codes combined with application-specific return codes. Error responses include a numeric code and human-readable message and moreInfo fields.

Success Codes

HTTP Status	Meaning
`200 OK`	Request completed successfully
`201 Created`	Resource created successfully

Error Response Format

Error responses are returned as an ErrorBlock, in the same format as the request. For JSON requests:

{
  "code": -125,
  "message": "Bad input data",
  "moreInfo": "Invalid card number",
  "errorList": null
}

For XML requests:

<ErrorBlock>
  <code>-125</code>
  <message>Bad input data</message>
  <moreInfo>Invalid card number</moreInfo>
</ErrorBlock>

Field	Content
`code`	The application error code (see the table below).
`message`	Short description of the error class.
`moreInfo`	Additional detail about this specific failure.
`errorList`	Array of individual validation errors, when applicable (e.g. code `-179`); otherwise `null`.

Application Error Codes

Return Code	Name	Description
`-112`	Bad Destination	Destination URL is unreachable or invalid
`-113`	Disallowed Operation	Not authorized to perform this action on the resource
`-123`	Bad Document	Request body is not valid XML or is badly formatted
`-125`	Bad Data	Input data is invalid (e.g., invalid card number, missing required field)
`-126`	Data Too Long	Input data exceeds maximum allowed length
`-150`	System Error	Internal server error
`-160`	URI Not Found	Requested resource (e.g., card token) does not exist
`-168`	Data Conflict	Action cannot be performed on the resource in its current state
`-174`	Too Many Items	Request exceeds the maximum number of allowed items
`-175`	Timeout	Operation timed out (e.g., third-party server did not respond)
`-176`	Too Many Retries	Maximum retry attempts exceeded
`-179`	Bad Parameter	Request parameter is invalid or missing
`-180`	User Blocked	User account is blocked
`-1002`	Missing Auth Header	The `Authorization` header is missing from the request
`-1003`	Unauthorized	Authentication failed (invalid API key or credentials)
`-1004`	Password Expired	User password must be changed before API access is allowed
`-1005`	User Suspended	User account has been suspended
`-1006`	User Closed	User account has been closed
`-1010`	Locked for Updates	Resource is locked and cannot be modified

Common Causes for Frequently Misread Codes

Two codes are consistently misread because their generic text doesn’t match their most common real-world cause:

The message “Unauthorized” or “Not authorized to access this resource” reads like an auth/permissions bug, but on a token-related call it most often means:

The token was deleted or never existed. By far the most common cause - check whether the token was deleted (deletions are permanent) or whether a prior tokenization actually succeeded.
The token belongs to a different environment. A sandbox-created token cannot be accessed from a production account, or vice versa.
The account is blocked or terminated. Check account status before assuming it’s a credentials issue.
Actual authentication failure (invalid API key, expired session token) is possible but less common than the above for this code.

“Internal server error” sounds like a PCI Booking-side bug, but it most often means:

The request body is malformed - commonly an invalid credential structure (wrong field names for the gateway) rather than an actual server fault.
A tokenization attempt failed upstream. If a tokenization silently failed, any later action on the token you expected to exist will surface as -1003 rather than repeating -150.

HTTP Status Code Mapping

PCI Booking maps application errors to standard HTTP status codes:

HTTP Status	When Returned
`400 Bad Request`	Bad data, bad document, bad parameter, data too long, too many items
`401 Unauthorized`	Missing auth header, unauthorized, password expired
`403 Forbidden`	Disallowed operation, user closed
`417 Expectation Failed`	User suspended
`426 Upgrade Required`	User blocked
`404 Not Found`	URI not found
`408 Request Timeout`	Timeout
`409 Conflict`	Data conflict, locked for updates
`500 Internal Server Error`	System error

API Conventions - Request and response formats, headers, and common patterns
Authentication - API key, session token, and access token setup

Start Here

Getting Started

Concepts

Guides

Capture Cards

Payments Library

Manage Tokens

Use Tokens

Account Configuration

Additional Functions

Reference

Support

Success Codes

Error Response Format

Application Error Codes

Common Causes for Frequently Misread Codes

HTTP Status Code Mapping

​Success Codes

​Error Response Format

​Application Error Codes

​Common Causes for Frequently Misread Codes

​HTTP Status Code Mapping

​Related

Success Codes

Error Response Format

Application Error Codes

Common Causes for Frequently Misread Codes

HTTP Status Code Mapping

Related