Errors and result handling

Network uses status: error and error: {name, message}. Legacy SSO uses error_name, error_msg and sometimes error_code. AntiCheat SecureChannel responses need decryption first; plain middleware errors can precede them. HTTP status does not replace application-status checks.

Name/group	What to check
incorrect_data	Required fields, body/query location, identifier format and bounds
method_not_found	Service, Network method case, registration and SSO route coverage
token_invalid, token_no_passed	Credential type and normal login renewal
access_denied	Account, role, owner/server access and method conditions
license_upgrade_required, checker_addon_required	Server feature matrix and subscription state
dedicated_project_mismatch	Project scope of this environment
ozprotect_network_host_mismatch	Assigned Network host for the selected server
another_project, server_not_belong_project	Server/project association, not just both IDs existing
no_data	Object missing or invisible in this access scope
checker_session_not_found/taken/closed/refused	Session code/state, device binding, closure/refusal
checker_too_many_sessions, checker_rate_limited	Active sessions and rate limits; avoid endless retries
AC missing_headers, request_expired, session_expired, replay_detected	SecureChannel headers, clock, session and fresh nonce in the supported client
database_error, api_exception	Backend diagnostics without exposing stack traces/SQL/credentials to users

This is not an exhaustive error set: categories have additional dictionaries and modules return dynamic errors. OpenAPI x-observed-errors records observed names without claiming all runtime branches.

User-facing errors

Prefer translated errors.<name>, then a safe backend message and a generic translated fallback. Normalize SSO error_name/error_msg first; sockets use error.name/error.message. Do not display raw credential-bearing or SQL-bearing objects.

Retrying

A read request can be retried after reconnection if it has no side effects. Lost ACKs for punishment, payment, messages and uploads leave an uncertain result. Read the object/history first and use implemented idempotency. A timeout does not automatically roll back a write.

Sources: Network common/ApiController.js, common/ApiErrors.json, common/SocketController.js; SSO src/legacy/response.js; AC common/SecureChannel.js.