> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shieldlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Errors & Troubleshooting
> A reference for every HTTP status code ShieldLabs returns and how to fix it.
Error bodies are not uniform, so branch on the HTTP status code, not on a body field. The two surfaces behave differently:
* **REST ingest and network-check gateways** return an object like `{ "error": "description of the problem" }` for `429` and `503`.
* **Server API** returns an empty body for `401` and `402`, and a bare JSON string (for example `"request_id is not supported"`) for `400` and `404`.
## HTTP status codes
| Status | Meaning | What to do |
| ------ | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `200` | Success | Parse the response. |
| `400` | Bad parameters | Server API only. A malformed value, for example a non-UUID where a UUID is required. The body is a bare JSON string. Fix the request. |
| `401` | Bad credentials or disabled domain | The body is empty. Check your Server API credentials (`Authorization: Bearer` — see [Keys](/setup/keys)) or `?publicKey=` (snippet), and that the domain is enabled. |
| `402` | Out of requests | The body is empty. Your balance is exhausted. The Management API History path bills 1 request per returned row (a 0-row lookup still bills 1); account History reads on `account.shieldlabs.ai` are free. Top up your [billing](/billing) balance. |
| `404` | Unsupported history `type` | Server API only. The history `type` is not supported. The body is a bare JSON string. `type` must be one of `ip`, `user_hid`, `visitor_id`, `request_id`, `device_id`. A supported `type` that matches no records returns `200` with `[]` (and still bills 1 request), not `404`. |
| `429` | Rate-limited | REST ingest and network-check gateways only, not the Server API. The body is `{ "error": "..." }`. You hit an infrastructure [rate limit](/rate-limits). Back off and retry. |
| `500` | Internal error | Transient. Retry with backoff. |
| `503` | Server busy | REST ingest and network-check gateways only, not the Server API. The body is `{ "error": "..." }`. A concurrency cap was hit. Retry with backoff. |
`429` and `503` come from the REST ingest and network-check gateways, not the Server API. `429` is an **infrastructure [rate limit](/rate-limits)**, not a Risk Score. It protects the gateway and never feeds the score. The Risk Score is always 0 to 100. The same [rate-limits](/rate-limits) page documents the 512KB request body-size limit, and explains why a `999` in your logs is a ban marker rather than a customer score.
## Related
Symptom-to-fix for snippet, webhook, signature, and scoring issues.
Short answers on keys, requests, identifiers, and a score of 0.
The infra limits behind `429` and `503`, and why they never affect the score.
Register, receive, and verify webhooks, with the no-retry delivery model.