> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nexrex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Errors

> The consistent error envelope and every machine-readable code.

All errors share one envelope. Branch on the `code` field, not on the
human-readable `error` message (which may change), and log the `request_id` for
support.

```json theme={null}
{
  "success": false,
  "error": "API key lacks required scope: activities:read",
  "code": "missing_scope",
  "request_id": "req_9f2c…"
}
```

## Codes

| Code                  | HTTP | Meaning                                                             |
| --------------------- | ---- | ------------------------------------------------------------------- |
| `invalid_key`         | 401  | Key does not exist or cannot be parsed                              |
| `key_expired`         | 401  | Key has passed its expiry date                                      |
| `key_revoked`         | 401  | Key has been revoked by the organization                            |
| `feature_not_enabled` | 403  | Developer API is not enabled for this organization's plan           |
| `missing_scope`       | 403  | Key lacks the [scope](/api-reference/scopes) this endpoint requires |
| `not_found`           | 404  | Resource does not exist **or** is not visible to this key           |
| `rate_limited`        | 429  | Per-key [rate limit](/api-reference/rate-limits) exceeded           |
| `validation_error`    | 400  | A request parameter or body field failed validation                 |

## Notes on specific codes

* **`not_found` hides existence.** When a key requests an athlete, activity, or
  export that belongs to another organization — or a key-created export that a
  different key made — the API returns `404`, not `403`. This is deliberate: a
  key can never learn whether a resource it can't access exists.
* **`key_expired` vs `key_revoked` vs `invalid_key`.** These are distinct so your
  integration can react correctly — prompt for a new key on expiry, alert an admin
  on revocation, and treat `invalid_key` as a configuration error.
* **`feature_not_enabled`** means the organization's plan does not include
  Developer API access. Contact the organization's admin about upgrading to Club.