Errors & rate limits

Error format

{"error": "<code>", "message": "Human readable text."}

422 validation_failed adds "fields": {"field": ["message", ...]}.
Errors from POST /proxies/{id}/rotate and rotation links also carry "ok": false.
Branch on error (stable), not on message (may change).

Status	`error`	When
401	`unauthenticated`	no token, wrong token, revoked or expired token
403	`insufficient_ability`	the token's level is too low for this endpoint
403	`forbidden`	your login may not do this (team viewer, or a sub-user on an owner-only action)
403	`account_suspended`	the login or its account is suspended
403	`dongle_disabled`	rotating a disabled proxy (see `disabled_reason` on the proxy)
404	`not_found`	unknown id, or a proxy/node your login cannot see
405	`method_not_allowed`	wrong HTTP method for this path
409	`rotation_in_progress`	another rotation of the same proxy is running
409	`dongle_busy`	sending an SMS while the dongle is busy (rotation or another SMS)
409	`unsupported`	the device cannot do this (e.g. a plain network interface cannot rotate); `capability` names what is missing — see device capabilities
422	`validation_failed`	bad input; see `fields`
429	`rate_limited`	over the rate limit; wait `Retry-After` seconds
429	`sms_limit_reached`	the proxy's SMS limit is used up; also `limit`, `max`, `used`, `resets_at`
501	`not_implemented`	this dongle model cannot rotate this way
502	`rotation_failed`	the dongle did not get a new IP (the answer includes `old_ip`)
502	`sms_failed`	the dongle refused the SMS or could not be reached

What	Limit
REST API	120 requests / minute per login (all its tokens together)
Rotation link `/r/{token}`	6 / minute per link, 30 / minute per client IP

Over the limit: 429 with a Retry-After header. Back off and retry after that many seconds.

GET requests are safe to retry.
POST /proxies/{id}/rotate on 409: wait a few seconds and retry; on 502: the dongle could not get a new address — retry once after ~30 s, then check the proxy in the panel.
POST /proxies/{id}/password is not idempotent — every call creates a new password.