Errors

Every PureWL DPP API response is wrapped in a common envelope with a header and a body.

Response envelope

The response body is a JSON object with a header object and a body object:

{
  "header": {
    "code": 1,
    "message": "Success",
    "response_code": 1
  },
  "body": {
    // endpoint-specific payload
  }
}

Key	Type	Description
`header`	Object	Object containing the response code(s) and message.
`header.code`	Integer	Result code. `1` = success. Returned by Authentication and User Management.
`header.message`	String	Human-readable status message (e.g., `"Success"`).
`header.response_code`	Integer	Result code. `1` = success. Returned by every endpoint.
`body`	Object	Endpoint-specific payload.

HTTP status codes

Status	Meaning
`200`	Request succeeded. Check `header.response_code` for the result.
`400`	The request is invalid — for example, a hashed SSN or card number that is not a 40-character SHA-1 hex digest, or a missing required field.
`401`	Missing or unknown partner identifier.
`403`	Paid lookup refused: the `uuid` belongs to a user that is disabled or expired.
`404`	The requested resource was not found — for example, an unknown breach, profile, broker, or screenshot, or no user with the supplied `uuid`.
`429`	Too many requests. Back off and retry — see Rate Limits.
`500`	Internal server error. Safe to retry with backoff.
`502`	The upstream service could not be reached (Person Lookup, Reverse Phone Lookup). Safe to retry later.

Application error codes

Failures also carry an application code in header.response_code (and in header.code, where the endpoint returns it), with header.message explaining why. Text in braces, such as {uuid}, is filled in with the actual value.

Codes are defined per service, and the same number can mean different things in each — for example 10200 is a missing user in Dark Web Monitoring but a missing profile in Data Broker Opt-Out. Always read a code together with the service you called.User Management and authentication use four-digit codes (998, 1001–1008); Dark Web Monitoring and Data Broker Opt-Out use five-digit codes.

User Management and authentication

Code	Constant	Default message	When returned
`1001`	`CODE_VALIDATION_ERROR`	Validation error	A validation rule fails, the request body is not valid JSON, or the database rejects a value or a linked record. For example, Renew a User outside the renewal window returns “you can renew account when 10 or less days are remaining”.
`1002`	`CODE_INVALID_KEY`	You are not permitted to the resource!	Authentication fails (gateway, pre-shared key, or direct path finds no valid reseller).
`1003`	`CODE_UNKNOWN_SERVICE`	Invalid service slug provided	The `serviceName` is not a known service.
`1004`	`CODE_SERVICE_NOT_SUBSCRIBED`	Account is not subscribed to this service	The account is not subscribed to the requested service.
`1005`	`CODE_INVALID_USER_AND_RESELLER`, `CODE_ACCOUNT_DELETED_NOT_FOUND`	Invalid username or reseller	User not found, including deleted users.
`1006`	`CODE_ACCOUNT_ALREADY_EXIST`	User already exists	Duplicate user, username collision, or a database unique-constraint violation.
`1007`	`CODE_ACCOUNT_IS_EXPIRED`	Account is expired	The account has expired.
`1008`	`CODE_ACCOUNT_IS_DISABLED`	Account is disabled	The account is disabled.
`998`	`CODE_ERROR`	Internal server error	Route not found (HTTP `404`), health probe cannot reach the database (HTTP `503`), database unreachable or query failure (HTTP `200`), or any unhandled error (HTTP `500`).

Dark Web Monitoring

General

Code	Message
`10001`	Internal server error
`10002`	Validation failed
`10003`	Resource not found / Breach record or resource not found
`10004`	Resource conflict
`10005`	Unauthorized
`10006`	Bad request / A `{kind}` value is required / Provide at least one search asset
`10007`	Forbidden

Partner account

Code	Message
`10103`	Invalid or inactive partner id
`10104`	Missing `x-AccountId` header

Users and monitored assets

Code	Message
`10200`	User with uuid `{uuid}` not found
`10201`	A user with this uuid already exists
`10202`	At least one valid monitored asset is required
`10203`	Asset `{assetId}` not found for this user
`10204`	User with uuid `{uuid}` is disabled
`10205`	User with uuid `{uuid}` has expired
`10206`	`user_assets_limit` header is required and must be a non-negative integer
`10207`	Asset limit is `{limit}`; cannot register `{n}` assets / Asset limit is `{limit}`; user has `{x}`, cannot add `{y}` more

Lookups

Code	Message
`11100`	Cluster1 is not configured
`11101`	Expected a 40-character SHA-1 hex hash (hash the SSN/CC client-side)
`11102`	Exposure lookup not permitted (`{status}`)
`11103`	Exposure lookup returned `{status}`
`11104`	Cluster1 is unavailable
`11199`	DWM response post-processing failed

Data Broker Opt-Out

General

Code	Message
`10001`	Internal server error / Unsupported Media Type
`10002`	`{field validation errors, separated by "; "}` / Missing required field(s): `{list}`. Required: `{list}`
`10003`	Cannot `{METHOD}` `{path}`
`10006`	`{invalid JSON body error}` / Validation failed (numeric string is expected)

Partner

Code	Message
`10100`	Partner `{id}` not found / Partner with partnerId `{id}` not found
`10101`	Partner with name ‘`{name}`’ already exists / Partner with partnerId ‘`{id}`’ already exists
`10103`	Invalid or inactive partner id
`10104`	Missing `x-AccountId` header
`10199`	Partner internal error

Profile

Code	Message
`10200`	Profile with uuid `{uuid}` not found / Profile not found
`10201`	User already signed
`10202`	Profile must be signed and uploaded before resending
`10204`	brokerId must be a positive integer / `key` query parameter missing / A field name that is not accepted was sent: `{fields}`
`10205`	A user with this profileId already exists
`10206`	countryCode is not a supported country
`10207`	A scan has already been started for profile `{uuid}`
`10208`	Profile `{uuid}` expired on `{date}`; a scan cannot be started
`10210`	This broker is not waiting on an action from the user
`10211`	countryCode missing
`10212`	US user without stateCode
`10213`	stateCode sent for a country other than US
`10214`	stateCode is not a supported US state
`10215`	state and stateCode name different states
`10216`	cycle is not a whole number of 1 or more
`10217`	The user has no such cycle yet
`10299`	Profile internal error

Broker

Code	Message
`10300`	Broker `{id}` not found / Broker(s) not found: `{ids}` / No removal for this broker on this profile
`10301`	Broker(s) globally disabled and cannot be assigned: `{ids}`
`10399`	Broker internal error

Partner broker

Code	Message
`10400`	PartnerBroker `{id}` not found
`10499`	Partner broker internal error

Country and region

Code	Message
`10500`	Country `{id}` not found
`10501`	Region `{id}` not found
`10599`	Country/Region internal error

Email templates

Code	Message
`10600`	Invalid templateType: `{type}`
`10699`	Email template internal error

PoA branding

Code	Message
`10700`	Invalid file type: `{mime}`. Allowed: `{list}`
`10701`	File too large: `{n}` bytes. Max: `{max}` bytes (2MB)
`10702`	Could not read image dimensions / Logo too small / Logo too large / Logo aspect ratio outside the allowed range / Header image too small / Header image too large
`10703`	No file uploaded
`10799`	PoA branding internal error

Email tracking

Code	Message
`10899`	Email track internal error

Broker scan

Code	Message
`11000`	Provide “phone”, both “firstName” and “lastName”, or all of them together
`11001`	Broker scan service unavailable / Broker scan service error

Retry and backoff guidance

Follow these practices when handling failed requests:

Treat any HTTP 5xx response as potentially transient — retry with exponential backoff.
Treat HTTP 429 (rate limited) as transient — see Rate Limits for backoff guidance.
Do not blindly retry 4xx client errors (e.g., invalid parameters, auth failures) without first correcting the request — retrying an invalid request will fail the same way every time.
If your Access Token has expired, get a new one with the refresh grant type described on the Authentication page before retrying.

Next steps

Rate Limits

Learn how 429 responses fit into this error model.

Authentication

Get and refresh the Access Token every call needs.

API Reference overview

Return to the full endpoint reference map.

Overview

User Management

Dark Web Monitoring

Data Broker Opt-Out Service

Response envelope

HTTP status codes

Application error codes

User Management and authentication

Dark Web Monitoring

General

Partner account

Users and monitored assets

Lookups

Data Broker Opt-Out

General

Partner

Profile

Broker

Partner broker

Country and region

Email templates

PoA branding

Email tracking

Broker scan

Retry and backoff guidance

Next steps

Rate Limits

Authentication

API Reference overview

​Response envelope

​HTTP status codes

​Application error codes

​User Management and authentication

​Dark Web Monitoring

​General

​Partner account

​Users and monitored assets

​Lookups

​Data Broker Opt-Out

​General

​Partner

​Profile

​Broker

​Partner broker

​Country and region

​Email templates

​PoA branding

​Email tracking

​Broker scan

​Retry and backoff guidance

​Next steps

Rate Limits

Authentication

API Reference overview

Response envelope

HTTP status codes

Application error codes

User Management and authentication

Dark Web Monitoring

General

Partner account

Users and monitored assets

Lookups

Data Broker Opt-Out

General

Partner

Profile

Broker

Partner broker

Country and region

Email templates

PoA branding

Email tracking

Broker scan

Retry and backoff guidance

Next steps