Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.bloobank.com/llms.txt

Use this file to discover all available pages before exploring further.

When a request is rejected, the API returns an appropriate HTTP status code and a structured JSON body. Use the status field to branch in your client code — it is stable and machine-readable.

​
Error payload shape

{
  "error": {
    "code": 401,
    "status": "SIGNATURE_INVALID",
    "message": "Request signature could not be verified.",
    "details": [
      {
        "reason": "SIGNATURE_INVALID",
        "description": "The provided signature does not match the canonical request.",
        "metadata": {
          "decisionId": "acd_9RmKvTpYzH2wN8qJ5b"
        }
      }
    ]
  }
}
​
error.code
integer
HTTP status code mirrored in the body.
​
error.status
string
Stable machine-readable error code. Use this to branch in your client code.
​
error.message
string
Human-readable summary of the error.
​
error.details
array
Additional detail objects. Each entry may include reason, description, and a metadata object containing a decisionId for support escalation.

​
Error codes

HTTPStatusWhen it firesWhat to do
400MISSING_HEADERA required authentication header was not sent.Check that all four headers are present: X-Access-Key, X-Access-Timestamp, X-Access-Request-Id, X-Access-Signature.
400TIMESTAMP_INVALIDX-Access-Timestamp is not a valid Unix millisecond timestamp.Ensure the value is a 13-digit integer in milliseconds, not seconds.
401TIMESTAMP_SKEW_EXCEEDEDTimestamp is outside the server’s acceptance window.Sync your server clock via NTP.
401SIGNATURE_INVALIDECDSA signature fails verification.Check canonical string construction, body hashing, and low-S normalization.
401REPLAY_DETECTEDX-Access-Request-Id has already been used.Generate a new UUID v4 for every request, including retries.
403RBAC_DENYCredential is authenticated but lacks permission for the operation.Review the Access Key permissions in the Dashboard.
When contacting support, include: decisionId (from error.details[].metadata), X-Access-Request-Id, approximate UTC time of the request, endpoint called, and HTTP status returned.