CLI errors
The CLI prints safe error text to stderr and exits non-zero. API failures retain the stable API code and server request ID; never paste bearer tokens into support logs.
Common classes:
| Status | Meaning | Action |
|---|---|---|
| 400 | invalid input | correct IDs/options/body |
| 401 | invalid/expired credential | replace the token |
| 403/404 | not permitted/not visible | verify current scope and membership |
| 409 | lifecycle/idempotency conflict | re-read state; do not blindly retry with changed inputs |
| 413 | request/artifact too large | reduce size |
| 415 | wrong JSON content type | client bug; use current CLI |
| 426 | incompatible client/API contract | update the CLI |
| 429 | quota/rate/cap reached | honor retry/capacity guidance |
| 5xx | server/provider failure | retry safely with the same operation identity where supported |
Stable process exit categories: 1 local/unknown, 2 input/protocol, 3 authentication, 4 authorization/not-visible, 5 conflict, 6 quota/rate, 7 server/provider.
Include the request ID in support requests, not secrets, request bodies, signing material or signed URLs.