HTTP status codes
| Status | Meaning | Caller action |
|---|---|---|
| 400 | Malformed JSON, invalid input, pagination, or unsupported field. | Correct the request; do not retry unchanged. |
| 401 | Missing, invalid, expired, revoked, or insufficient-scope key. | Check key state and required scope. |
| 403 | Sender address is not owned by this account. | Use an owned personal sender address. |
| 406 | Unsupported requested API version. | Use a documented version. |
| 413 / 415 | Request too large / unsupported content type. | Reduce the payload / send JSON. |
| 429 | Rate limit reached. | Honor `Retry-After` and back off. |
| 503 | Storage, provider, or request-protection dependency unavailable. | Retry reads with bounded backoff; retry sends with the same idempotency key. |
Error response
Errors return a JSON object with a safe `error` message, plus standard no-store and API-version headers on versioned routes. Do not depend on internal provider details or raw database messages being returned.
Retry policy
Do not retry a 400, 401, 403, 406, 413, or 415 without correcting the request or credential. On 429, obey `Retry-After`. For transient 503 or network failures, use bounded exponential backoff with jitter.
For a send with uncertain outcome, preserve the exact body and `Idempotency-Key`. See Idempotent sending.