The governed request
The checks that affect public API calls and the errors your integration must handle.
Every public route declares the credential type, scopes, rate class and idempotency behavior it requires. Tanitar evaluates those rules before the requested operation runs.
Checks visible to your client
| Check | What to send | Failure |
|---|---|---|
| Authentication | The credential for the route's plane | 401 ACCESS_CREDENTIAL_INVALID |
| Account status | No extra input | 403 ACCESS_ACCOUNT_DISABLED |
| Scope | An API key with every required scope | 403 ACCESS_SCOPE_DENIED |
| Entitlement | A plan that includes the capability | 403 ACCESS_ENTITLEMENT_DENIED |
| Rate limit | Requests within the plan window | 429 ACCESS_RATE_LIMITED |
| Ownership | A resource belonging to the resolved tenant | 403 ACCESS_RESOURCE_FORBIDDEN |
| Idempotency | A valid Idempotency-Key when required | 400 or 409 with an idempotency error code |
| Input validation | A body, path and query matching the route contract | 400 with a stable domain code where available |
Scopes and plan entitlements are separate. A key cannot grant a capability that the tenant's plan does not include. See API keys and scopes.
Idempotent mutations
A completed request repeated with the same key and body returns its original status and body. The
same key with a different request returns 409 ACCESS_REPLAYED. A repeat while the first request is
still running returns 409 ACCESS_IDEMPOTENCY_IN_PROGRESS.
See Idempotency for key selection and retry examples.
Fail-closed behavior
If Tanitar cannot resolve the principal, tenant, entitlement, rate window or ownership decision, it
does not continue with a default identity. Depending on the failed decision, the response is 401,
403 or 503 ACCESS_STATE_UNAVAILABLE.
A bad player credential returns 401. An unavailable identity verifier returns 503, which tells
you the request may succeed later.
Responses and support
Every response includes a request id. Error bodies use the common envelope and a stable errorCode
where the client is expected to react. Log the requestId, status and errorCode, but never log the
credential or secret. Include the request id when contacting Tanitar support.
See Errors and Rate limits for client handling guidance.