---
source: https://docs.restoman.com.ar/en/developers/errores
language: en-US
updated: 2026-11-02
---

# Errors and limits

> What Restoman answers when it can't: errors from its API, OAuth, the MCP and the agents, and their limits.

Every answer carries `X-Request-Id`, and every error is JSON. That id is what to send support if something goes wrong.

## The API

An API error is `{ "type", "code", "requestId" }`: `type` says its kind (`unauthorized`, `forbidden`, `not_found`, `validation`, `rate_limited`, `unavailable`…) and `code`, when there is one, the exact reason. A `429` carries `Retry-After` and `retryAfter` in seconds.

## OAuth

The authorization server answers OAuth errors (RFC 6749): `{ "error", "error_description" }`, such as `invalid_grant` or `invalid_request`. Its per-address limit answers `429` with `{ "code": "RATE_LIMITED", "message", "retryAfter" }` and `Retry-After`.

## The Restoman MCP

| Answer                             | What it means                                                                                                           |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `401` with `WWW-Authenticate`      | No token, or an expired or revoked one: go back to OAuth                                                                |
| `403` with `insufficient_scope`    | The token lacks that tool's scope: the person connects again                                                            |
| A result with `isError` and a code | The person's role or the business's state doesn't allow it (`MISSING_PERMISSION`, `LOCATION_NOT_ASSIGNED`, `CEILING_…`) |
| `429` with `Retry-After`           | Over 120 calls a minute or 2,000 an hour, per person and agent                                                          |
| JSON-RPC `-32602`                  | Arguments that aren't the tool's                                                                                        |

Report a tool's error as it is and send the person to the dashboard: never look for a way around it.

## The public MCPs and agents

- **A `POST` over 16 KB** answers `413`, and an `Origin` from another site, `403`.
- **JSON-RPC:** `-32700` is JSON that can't be read, `-32600` a message that isn't JSON-RPC 2.0, `-32601` a method that doesn't exist, and `-32602` wrong arguments.
- **A slug or a guide that doesn't exist** answers a result with `isError`, not a protocol error.
- **The A2A agents** answer A2A's codes: `-32001` for a task (they keep none), `-32003` for push notifications, `-32004` for streaming, `-32005` for files, `-32007` for the extended card, and `-32009` for a version they don't speak.