RR-1001Invalid or unknown API key.
RR-1002JWS signature invalid, the canonical input or key does not verify.
RR-1003Timestamp skew, |now − X-RR-Timestamp| > 300s (unix ms expected).
RR-1004Nonce replay, X-RR-Nonce already used within its 10-minute TTL.
RR-1005Scope missing, the API key does not carry the required scope.
RR-1101Unknown request-signing kid, X-RR-Key-Id matches no active key on the calling key's vault. Returned on any endpoint the kid is presented to, including reads, so retired keys are refused everywhere.
RR-2001Vault not active (paused or archived).
RR-2002Record type unknown, or metadata violates its schema.
RR-2003Metadata contains a disallowed PII key (name, email, phone, national_id, iban, address).
RR-2101Idempotency conflict, key reused with a different content digest.
RR-2102Duplicate resource: the vault slug or request-signing kid already exists.
RR-3001Gas insufficient. Seals are still accepted (202); anchoring resumes once the gas wallet is topped up.
RR-3002Anchor backlog elevated. Seals are still accepted; records reach their terminal outcome once the backlog clears.
RR-3101Service not enabled for this account (403). The endpoint is a billable service (e.g. sign_ses for envelope creation) that has not been enabled for your account; ask your Rox contact to enable it.
RR-3102Insufficient Rox coin balance for a billable service (402). The gas wallet cannot cover the service price beyond funds already held by in-flight activities; the detail names the price, the available balance and the shortfall in ROX. Top up the gas wallet and retry; nothing was created.
RR-4001Approval required, the action needs an approved quorum entry.
RR-4002Approval expired, re-request; approvals live 72h.
RR-5xxxInternal (opaque). Retry with backoff; contact support with the instance id.