Errors
One consistent error shape across the whole API.
Every error the API returns shares a single envelope, so a client can always surface one human-readable message — even for validation failures:
detail— a human-readable message; always present.code— a stable machine code you can branch on.errors— present for validation failures: the offending fields and why.
Standard HTTP status codes apply — e.g. 401 unauthenticated, 403 forbidden,
404 not found, 422 validation, 5xx server. Error responses never leak
internal detail.