> ## Documentation Index
> Fetch the complete documentation index at: https://docs.payfi.global/llms.txt
> Use this file to discover all available pages before exploring further.

# Errors

> Common PayFi API errors.

All API errors use this shape:

```json theme={null}
{
  "error": {
    "code": "INVALID_SIGNATURE",
    "message": "The request signature is invalid."
  }
}
```

Common authentication and request codes include `INVALID_CREDENTIALS`, `CREDENTIAL_EXPIRED`, `INVALID_SIGNATURE`, `NONCE_REPLAYED`, `IDEMPOTENCY_CONFLICT`, and `IDEMPOTENCY_IN_PROGRESS`.

Operation and workflow codes include `OPERATION_NOT_FOUND`, `INVALID_STATUS_TRANSITION`, `MANUAL_REVIEW_ALREADY_DECIDED`, `PROCESSING_TRACE_SCOPE_MISMATCH`, `WORKFLOW_RUNTIME_ATTESTATION_FAILED`, `POLICY_NOT_CONFIGURED`, `PARTNER_POLICY_NOT_CONFIGURED` (legacy alias `DOCUMENT_REQUIREMENT_POLICY_NOT_CONFIGURED`), `SCHEMA_VALIDATION_FAILED`, and `DOCUMENT_ANALYSIS_FAILED`. A workflow or source failure never becomes a successful result.

Upload security codes include `UNSUPPORTED_FILE_TYPE`, `INVALID_FILE_SIZE`, `FILE_EXTENSION_MISMATCH`, `UNPARSEABLE_FILE`, `FILE_SIGNATURE_MISMATCH`, `STORED_CONTENT_TYPE_MISMATCH`, `FILE_HASH_MISMATCH`, `DUPLICATE_DOCUMENT_HASH`, `MALWARE_DETECTED`, `MALWARE_SCAN_INDETERMINATE`, and `MALWARE_SCANNER_UNAVAILABLE`. Scanner unavailability is fail-closed.

Webhook URL validation can return `INVALID_WEBHOOK_URL`; HTTPS targets resolving to localhost, private, link-local, or other blocked addresses are rejected.