Errors & Rate Limits

The Malovex API always responds with JSON — including for errors. This page covers the status codes you’ll see, the error body shape, and the rate limit.

Error response format

Errors return a standard JSON body with a message:

{
  "message": "Product not found in your catalog."
}

Validation errors (on write endpoints) also include an errors object keyed by field:

{
  "message": "The given data was invalid.",
  "errors": {
    "currency": ["The currency field must be 3 characters."]
  }
}

Status codes

Status	Meaning	What to do
`200 OK`	The request succeeded.	—
`201 Created`	A write request created a resource.	—
`204 No Content`	A write request succeeded with no body (e.g. a delete).	—
`401 Unauthorized`	The token is missing or invalid.	Check the `Authorization: Bearer` header and that the token hasn’t been revoked.
`403 Forbidden`	The token isn’t associated with an account, or lacks the ability for this endpoint (e.g. a Connector token on a write endpoint).	Use a token with the right access level.
`404 Not Found`	The store, product, or resource isn’t in your catalog.	Verify the ID and the `store` slug.
`422 Unprocessable Content`	The request data failed validation, or a write would exceed your plan’s limit.	Read the `message` and `errors` fields and correct the request.
`429 Too Many Requests`	You’ve exceeded the rate limit.	Back off and retry (see below).

Rate limit

The API is rate limited to 120 requests per minute per account. The limit is counted across all of your tokens together, so it applies to your whole account rather than to each token.

When you exceed it, requests return 429 Too Many Requests. The response carries standard rate-limit headers so you can pace your calls:

Header	Description
`X-RateLimit-Limit`	Your ceiling — `120`.
`X-RateLimit-Remaining`	Requests left in the current window.
`Retry-After`	Seconds to wait before retrying, on a `429`.