Errors

Nora uses conventional HTTP status codes and returns JSON error bodies on every non-2xx response. A minimal example:

HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json

{
  "error": {
    "code": "destination_wallet_not_authorized",
    "message": "Destination wallet So1... is not whitelisted for this org."
  }
}

Two fields are stable across every endpoint:

• error.code — machine-readable. Branch on this.
• error.message — human-readable. Safe to surface to a developer audience; prefer your own copy for end-user UX.

Status codes follow convention: 400 for malformed requests, 401 for missing, invalid, or wrong-instance API keys, 403 for authorized-but-not-allowed, 404 for missing resources, 422 for business-rule failures, 429 for rate limits, 5xx for transient server issues.

For the full breakdown — which codes are retry-safe, common error.code values, and the envelope's edge cases — see Error handling.