Skip to main content

Errors, Rate Limits, And Idempotency

Use structured errors and idempotency keys to make your integration safe under retries, network failures, and duplicate requests.

Error shape

PayChain errors use a structured response:
Always log the requestId without logging secrets.

Common error categories

Error code catalog

Use the machine-readable code field for integration logic and the message for human-readable context. Codes can expand over time, so integrations should handle unknown codes gracefully.
Support note: When contacting support, include the request ID, resource ID, environment, and timestamp. Do not send API keys, webhook secrets, or raw credential headers.

Idempotency keys

Send Idempotency-Key on mutating requests:
Use stable keys based on your own business object:
  • order_123_invoice
  • payout_456
  • customer_789_invoice_001
Recommended formats:
Retry note: Do not automatically retry non-idempotent POST requests unless you sent an idempotency key.

Rate limits

Rate limits protect PayChain and merchants from accidental request bursts. Recommended behavior:
  • Back off on 429.
  • Respect retry headers if present.
  • Avoid tight polling loops.
  • Prefer webhooks for lifecycle changes.
  • Use list pagination for reconciliation jobs.

Safe retry policy

Retry:
  • Network timeouts.
  • 408.
  • 429.
  • 5xx.
Do not blindly retry:
  • Invalid request data.
  • Wrong API key type.
  • Rejected payout policy.
  • Insufficient balance.
  • Recovery-required balance that is not withdrawable.
  • Expired or cancelled invoices.
  • Webhook events already delivered.
If a valid withdrawal returns or emits pending_funds, do not create a replacement withdrawal. Keep the same idempotency key and wait for the existing withdrawal to continue after sweepable funds become available.

Operational logging

Log:
  • requestId.
  • PayChain resource ID.
  • Your order/customer reference.
  • HTTP status.
  • Error code.
Do not log:
  • API keys.
  • Webhook secrets.
  • Request headers containing credentials.
  • Raw payout destination secrets.
  • Full raw webhook payloads in shared logs.