Errors

Every route returns errors in the same shape:

{
  "type": "not_allowed",
  "message": "A company must keep at least one active owner.",
  "code": "last_owner"
}

Field	Meaning
`type`	Error type, for example `invalid_data` or `unauthorized`.
`message`	What went wrong, for a person to read. It can change, so don't match on it.
`code`	A stable, machine-readable reason, when the route defines one. Match on this. Schema validation failures have no `code`.

Status codes

Status	Meaning
`400`	The request broke a validation or business rule.
`401`	Missing or invalid credentials.
`403`	Signed in, but not allowed.
`404`	Not found, or something the caller may not see, such as another company's data.

Company routes return one of these in code on 400 and 403 responses. New codes may be added, so handle unknown codes as a generic failure.

Code	Status	When
`company_not_active`	400	The company is `pending` or `suspended`.
`permission_denied`	403	The caller's role lacks the permission the route needs.
`owner_required`	403	Only an owner can give or take the owner role, or remove an owner.
`last_owner`	400	The change would leave the company with no active owner.
`self_modification`	400	Callers can't change their own role or remove themselves.
`already_in_company`	400	The customer is already an active employee of a company.
`customer_required`	400	Signup with a registration token needs `customer`.
`customer_not_allowed`	400	A signed-in customer can't send `customer` on signup.
`invalid_status_transition`	400	The requested company status change is not allowed.