← SkillSafe
Error Surface

For anyone who owns a public API

Error SurfaceAudit what your API returns when a request fails - then fix it.

Paste the error responses your API actually returns, endpoint by endpoint. Your browser checks each one for what an integrator needs to fix the problem alone: one RFC 9457 envelope everywhere, a machine-readable code, the field, value and constraint, a retry signal (Retry-After, retryable), a request ID echoed in the body, the right status, and nothing leaked from the inside. It picks the taxonomy, classes every status as retryable or not, lists the endpoints that need an idempotency key, and works out the backoff. Then the catalog, and the retry contract.

Try a sample:

The API free

The error responses free

Five to ten real responses across different endpoints and statuses work best - validation, auth, not found, conflict, rate limit, server failure. Ids in paths are grouped as {id}. Nothing leaves your browser unless you run or save.

Retries free

The audit free

Across every response

Response by response

The backoff, worked out

A file that needs no judgement free

OpenAPI ProblemDetails component


    

The error catalog

Pricing as soon as the session is ready...

NOT RUN YET

The page's check of this reply

    Saved APIs

    How it works - and what is sourced

    The audit is the skill's failure-mode checklist, run on what you pasted: a 200 carrying an error; an HTML page or plain text instead of an envelope; problem details not served as application/problem+json; no machine-readable code; a generic message, or an identifier as the message; validation with no field-level detail; 401 and 403 swapped; a 429 or 503 with no Retry-After; a 5xx with no retry signal; retryable set against the status; no request ID, or one that is not echoed in the body; a stack trace, SQL error or internal path in the body; more than one envelope shape; and one code returned with two statuses.

    The taxonomy follows the skill's ranking: a code/subcode catalog by default, a flat catalog for a small surface or a near ship date, domain/reason for REST plus gRPC, gRPC only, or a taxonomy several services share. Retryable statuses are 408, 429, 502, 503 and 504; 500 is ambiguous and must say so. POST and PATCH need an idempotency key; PUT and DELETE are checked rather than trusted. The backoff is full jitter - sleep = random(0, min(cap, base x 2^n)) - bounded by one overall deadline.