Skip to main content
SpaPortal API uses a single error object: 
{
  "error": {
    "code": "invalid_request",
    "message": "Invalid request body.",
    "requestId": "req_6b4c6b6f-0d34-47f1-bf3b-8a3f9d8d2e1f",
    "details": [
      {
        "field": "hotelId",
        "code": "invalid_string",
        "message": "Must be a 24-character hex id."
      }
    ]
  }
}
Common API error codes are invalid_request, missing_authentication, invalid_authentication, insufficient_scope, not_found, conflict, rate_limited, and internal_error. API error responses also include X-Request-Id. If you send X-Request-Id with the request, SpaPortal echoes that value. Otherwise, SpaPortal generates a new one. API v1 keeps the legacy success and message shape: 
{
  "success": false,
  "message": "Missing API key"
}

​
Handling errors

Read both the HTTP status and the JSON error code or message. Treat 400, 401, 404, and 422 as client-correctable errors. Retry only after you change the request. Treat 500 as a temporary server error. Retry with backoff if the operation is safe to repeat.