API error codes

Every PP-ERR code the BizGate APIs can return, what it means, and what to do about it.

These are the API error codes returned in a response body. For the numeric codes that
describe why a message was not delivered (1001, 1002 and so on), see
Error Codes under Onboarding.

Every BizGate error response carries a code alongside status and message:

{
  "status": "error",
  "code": "PP-ERR-REQ-005",
  "message": "Provide mandatory field - name"
}

The message is written for a person and may change. The code is stable — branch on it,
quote it in a support ticket, and count it on a dashboard. Codes are never reused or renumbered
once published.

This page lists the 216 codes reachable from the public BizGate APIs, grouped by area.
The segment before the number tells you which area a code belongs to:

PrefixAreaCodes
PP-ERR-KEYAPI keys and tokens14
PP-ERR-SECAccount security (OTP, MFA, IP, keys)21
PP-ERR-ANAAnalytics and reporting1
PP-ERR-APPApps, files and WhatsApp details35
PP-ERR-AUTHAuthentication and authorization8
PP-ERR-COMCommission1
PP-ERR-CUSCustomers and brands10
PP-ERR-ONBOnboarding3
PP-ERR-ACCPartner account36
PP-ERR-USRPartner users24
PP-ERR-PAYPayments2
PP-ERR-APIPlatform and upstream5
PP-ERR-RATERate limiting1
PP-ERR-REQRequest validation9
PP-ERR-ROLRoles1
PP-ERR-SOLSolutions17
PP-ERR-TPLTemplates2
PP-ERR-WALWallets26

API keys and tokens

CodeMeaning
PP-ERR-KEY-001A field the route requires was not supplied — the key id, or the tag and public key pair.
PP-ERR-KEY-004No API key matches the one supplied.
PP-ERR-KEY-005The primary API key cannot be revoked — a partner must always retain one.
PP-ERR-KEY-006The partner has no API keys at all (500 — a partner should always have been issued one).
PP-ERR-KEY-007No public key is registered for this partner, so an encrypted export cannot be produced.
PP-ERR-KEY-008The stored public key is not in a format we can parse.
PP-ERR-KEY-009The public key parsed but is not RSA, which export encryption requires.
PP-ERR-KEY-010The client secret's expiry is not usable — absent, in the past, not on or after the start of the next UTC day, or beyond the 91-day maximum. One code: every case is the same field and the same fix, and the message states which rule was broken.
PP-ERR-KEY-011The app token supplied is absent, malformed, or not an app token at all.
PP-ERR-KEY-012No token matches the one supplied (404).
PP-ERR-KEY-013The token has already expired, so there is nothing to revoke (410).
PP-ERR-KEY-014The app has reached its maximum number of active UAT tokens; revoke one first (409).
PP-ERR-KEY-015The token expiry is absent, in the past, or beyond the 24-hour maximum.
PP-ERR-KEY-016A token with this name already exists for the app; revoke or rename it first (409).

Account security (OTP, MFA, IP, keys)

CodeMeaning
PP-ERR-SEC-001An OTP is required for this operation and none was supplied.
PP-ERR-SEC-002The OTP supplied does not match (401).
PP-ERR-SEC-003No OTP has been generated yet; the caller must request one first.
PP-ERR-SEC-004The OTP has expired (410); the caller must request a new one.
PP-ERR-SEC-005The OTP could not be delivered. An upstream or mail failure, not a caller error.
PP-ERR-SEC-006The IP or CIDR is already on this partner's allow-list.
PP-ERR-SEC-007Adding these entries would exceed the partner's allow-list maximum.
PP-ERR-SEC-008The value supplied is not a valid IP address or CIDR block.
PP-ERR-SEC-009The partner has no email address recorded, so an email OTP cannot be sent.
PP-ERR-SEC-010The partner has no phone recorded, or it is not in an active state.
PP-ERR-SEC-011The operation requires a verified phone and this partner's is not verified (403).
PP-ERR-SEC-012Email MFA (L2) is required or has expired; step up and retry (403).
PP-ERR-SEC-013Phone MFA (L3) is required or has expired; step up and retry (403).
PP-ERR-SEC-014The key algorithm named is not one of the supported set.
PP-ERR-SEC-015No account public key is configured (404).
PP-ERR-SEC-016The public key id supplied does not match the one held.
PP-ERR-SEC-017The account public key could not be stored.
PP-ERR-SEC-018The feature token named is not one this platform knows.
PP-ERR-SEC-019The feature is already enabled for this partner; update it rather than adding it (409).
PP-ERR-SEC-020The feature metadata is missing, empty, or keyed to a feature that was not requested.
PP-ERR-SEC-021The partner's features could not be updated or serialised.

Analytics and reporting

CodeMeaning
PP-ERR-ANA-005The report was valid but could not be rendered for download. Unlike the codes above this is not caller-fixable — the query was accepted and the export itself failed.

Apps, files and WhatsApp details

CodeMeaning
PP-ERR-APP-001The app could not be created from the details supplied.
PP-ERR-APP-002An uploaded file is not a type the endpoint can read — bulk user upload takes CSV or Excel.
PP-ERR-APP-003No app exists for the given id (404).
PP-ERR-APP-004A field the route requires was not supplied.
PP-ERR-APP-005The app was created upstream but the response carried no API key, so nothing can authenticate against it. An upstream contract failure, not a caller error.
PP-ERR-APP-006The app cannot be de-linked. The message says why: wallet linked, created by partner, solution associated.
PP-ERR-APP-007The app cannot be linked. The message says why: domain mismatch, live app, solution associated, same partner.
PP-ERR-APP-008The app is already linked to a partner — this one or another.
PP-ERR-APP-009The app exists but is not linked to the calling partner.
PP-ERR-APP-010An app-level key was used where the account-level API key is required.
PP-ERR-APP-011The app id is not a usable identifier. Distinct from APP_NOT_FOUND: nothing was looked up.
PP-ERR-APP-012No rating data is available for this app.
PP-ERR-APP-013WABA health could not be retrieved for this app.
PP-ERR-APP-014The message id does not belong to any app this caller owns.
PP-ERR-APP-015The app's API key could not be read, from the secret manager or from the database.
PP-ERR-APP-016The solution provider cannot be changed on a live app.
PP-ERR-APP-017The usage state cannot be updated — the app is live, or already in the state requested.
PP-ERR-APP-018The app is not live, and the operation requires it.
PP-ERR-APP-019WhatsApp or WABA details could not be fetched or parsed for this app.
PP-ERR-APP-020The solution id cannot be removed from this app.
PP-ERR-APP-021Linking failed for a reason the message carries verbatim from the underlying failure.
PP-ERR-APP-022The app name is not permitted — wrong characters, or outside the allowed length.
PP-ERR-APP-023App, business, docker or created-app details could not be fetched. The upstream call completed and reported failure without a message worth passing through, which is why this is not PlatformErrorCodes.UPSTREAM_REJECTED.
PP-ERR-APP-024The app's details could not be updated.
PP-ERR-APP-025The WhatsApp service answered with a body that was empty or could not be understood.
PP-ERR-APP-026No contact details are recorded for this app; the caller must add them first.
PP-ERR-APP-027A named operation failed for this app; the message says which.
PP-ERR-APP-028The filename is missing or not usable.
PP-ERR-APP-029The file exceeds the maximum permitted size.
PP-ERR-APP-030The file could not be read, converted or copied on our side — not a caller error.
PP-ERR-APP-031No docker details are recorded for this app.
PP-ERR-APP-032A business document could not be uploaded to the WABA proxy.
PP-ERR-APP-033The WABA named is not linked to this app.
PP-ERR-APP-034The WABA named is already claimed by a different app.
PP-ERR-APP-035Profile fields cannot be mutated on a sandbox app.

Authentication and authorization

CodeMeaning
PP-ERR-AUTH-001The partner id in the URL is not the authenticated caller's partner — an authorization failure, answered with 403. Previously a 400 carrying "Please review the request parameters and retry", which sent callers hunting for a malformed parameter when the parameters were fine.
PP-ERR-AUTH-002No authenticated partner could be resolved for a partner-scoped path (401).
PP-ERR-AUTH-003partner_details.active = false — the partner is suspended system-wide (403). Raised by PartnerActiveGateInterceptor, which is registered on /**, so this is the one authorization code a V1 or V2 caller can see.
PP-ERR-AUTH-004The calling brand (customer) account is not in an active state (403).
PP-ERR-AUTH-005A brand user called a @PartnerOnly partner-tier endpoint (403).
PP-ERR-AUTH-006A brand user called an app that belongs to a different brand (403).
PP-ERR-AUTH-007The partner id in the URL is not a plain sequence of digits, yet Spring's lenient number binding would still have turned it into an Integer (400). 10%2011, 0x3F3 and +1011 all bind to partner 1011 — see PartnerIdVerificationFilter.extractMalformedPartnerIdFromPath. A 400, not a 403: the request never named a partner we can meaningfully compare against the caller's.
PP-ERR-AUTH-010The API key supplied is not one issued to this partner.

Commission

CodeMeaning
PP-ERR-COM-012The daily discount could not be calculated for the day requested.

Customers and brands

CodeMeaning
PP-ERR-CUS-002The email already belongs to a partner or a partner user, so it cannot be used for a customer.
PP-ERR-CUS-005The customer exists but belongs to a different partner (403). Kept in this family rather than AUTH even though it reads as an access decision: the caller is properly authenticated and authorized FOR THEIR OWN PARTNER, and what they have hit is a customer-ownership rule. AUTH-001 says "not your partner"; this says "not your customer".
PP-ERR-CUS-008The user is already active — there is nothing to invite them to.
PP-ERR-CUS-009The user is already assigned to this customer.
PP-ERR-CUS-010The invite was created but CAS returned no set-password link, so the user has no way to complete it. An upstream failure, not a caller error — answered 500, as before.
PP-ERR-CUS-017name is present but not a usable brand name — digits or whitespace only.
PP-ERR-CUS-029The brand has no usable wallet at the moment an app needs one (500). Distinct from BRAND_WALLET_PROVISION_FAILED: that one failed while creating the wallet, this one found none where there should be one.
PP-ERR-CUS-030The brand was saved but no id came back — an internal failure, not a caller error.
PP-ERR-CUS-031Another brand of this partner already carries this name.
PP-ERR-CUS-032This partner's customer migration has already been performed.

Onboarding

CodeMeaning
PP-ERR-ONB-001The onboarding record could not be read from the provider (502). Not caller-fixable — the request was well formed and the upstream did not answer usefully.
PP-ERR-ONB-002The step does not apply at the app's current stage — e.g. an embed link for an app that is already live.
PP-ERR-ONB-003The onboarding stage named is not one of the known stages.

Partner account

CodeMeaning
PP-ERR-ACC-001The partner account could not be created from the details supplied.
PP-ERR-ACC-002No partner record exists for the caller or the id requested (404).
PP-ERR-ACC-003The partner exists but has no legal details recorded yet (404). Separate from PARTNER_NOT_FOUND: the account is real, a required sub-record is not there, and the fix is to complete onboarding rather than to correct the id.
PP-ERR-ACC-005The contact email supplied is already registered to another partner. Both wordings the service used ("Contact email X is already registered" and "This contact email is already registered.") are the same condition and share this code.
PP-ERR-ACC-006Legal details could not be persisted — a save or update that failed after validation.
PP-ERR-ACC-007The legal details supplied did not pass validation.
PP-ERR-ACC-008The contract is already signed. Covers all three wordings the service used, which differ only in which stage noticed it, not in what the caller must do.
PP-ERR-ACC-009The partner has not signed the contract yet, and the operation requires it.
PP-ERR-ACC-010No contract email could be found for this partner — the caller is asked to check spam.
PP-ERR-ACC-011A contract filename contains characters outside the permitted set.
PP-ERR-ACC-012A contract file's content type is not one of the permitted types.
PP-ERR-ACC-013WhatsApp approval status cannot be changed because support approval was never given.
PP-ERR-ACC-014The app contract cannot start because WhatsApp approval was never given.
PP-ERR-ACC-015The BSP provider named is not the default and not on the whitelist.
PP-ERR-ACC-016The partner's website is already registered to another partner (409).
PP-ERR-ACC-017No solution record exists for this partner.
PP-ERR-ACC-018Legal details already exist for this partner and cannot be created a second time.
PP-ERR-ACC-019The partner named is not approved by Gupshup, so an app cannot be linked to them.
PP-ERR-ACC-020The partner is not in a state that permits this operation. Covers the composed preconditions the service builds with a ternary — missing, or present but unverified — where a single message is assembled and the caller's fix is the same either way: complete onboarding.
PP-ERR-ACC-021The partner must add a joint solution before linking or creating an app.
PP-ERR-ACC-022The operation is not allowed for this partner.
PP-ERR-ACC-023A company or contact name contains characters that are not permitted.
PP-ERR-ACC-024No client secret is recorded for this partner.
PP-ERR-ACC-025The partner record could not be read. Distinct from PARTNER_NOT_FOUND: the lookup itself failed.
PP-ERR-ACC-026The partner cannot be deleted while live apps exist.
PP-ERR-ACC-027The partner's auth configuration could not be saved.
PP-ERR-ACC-028The partner must configure a domain before adding a customer or an app.
PP-ERR-ACC-029No admin user could be found for this partner.
PP-ERR-ACC-030No organization is recorded for the user supplied.
PP-ERR-ACC-031The partner's details cannot be updated in their current state.
PP-ERR-ACC-032The feature requested is not enabled for this partner.
PP-ERR-ACC-033No phone number is registered against this partner.
PP-ERR-ACC-034The phone number supplied does not match the one on record.
PP-ERR-ACC-035No business details are recorded for this partner.
PP-ERR-ACC-036The previous contract cannot be deleted because it is already signed.
PP-ERR-ACC-037Terms have already been accepted or declined; the same decision cannot be recorded twice.

Partner users

CodeMeaning
PP-ERR-USR-001User Management Error Codes Format: PP-ERR-USR-XXX where XXX is a sequential number
PP-ERR-USR-003The email is absent, or not a valid email address.
PP-ERR-USR-005An account already exists with this email address.
PP-ERR-USR-006No user matches the uuid supplied.
PP-ERR-USR-012No user matches this lookup within the calling partner.
PP-ERR-USR-016The status supplied is not one of the permitted values, or not permitted from the user's current state.
PP-ERR-USR-017The admin flag cannot be changed for this user in their current state — a suspended user cannot be made an admin.
PP-ERR-USR-018The user is already assigned to this partner (409).
PP-ERR-USR-019No user-partner assignment exists (404).
PP-ERR-USR-020The user is already assigned to this wallet (409).
PP-ERR-USR-021No user-wallet assignment exists (404).
PP-ERR-USR-022The user is already assigned to this app (409).
PP-ERR-USR-023No user-app assignment exists (404).
PP-ERR-USR-024A person name failed validation — the message names which field and why.
PP-ERR-USR-025The language code is not one of the supported set.
PP-ERR-USR-026The email is syntactically valid but from a public provider where a business one is required.
PP-ERR-USR-027PARTNER_ADMIN / PARTNER_OWNER cannot be handed out on an invite; PARTNER_USER can.
PP-ERR-USR-028The userType named does not exist in the roles table.
PP-ERR-USR-029The user was saved but no uuid came back — an internal failure, not a caller error.
PP-ERR-USR-030The partner user could not be created; the message carries the underlying reason.
PP-ERR-USR-031An admin user cannot be deleted — demote or replace them first.
PP-ERR-USR-032The partner user could not be deleted; the message carries the underlying reason.
PP-ERR-USR-033App or wallet access cannot be revoked or granted on an admin — admins hold it implicitly.
PP-ERR-USR-034One or more requested communication preferences are not valid values.

Payments

CodeMeaning
PP-ERR-PAY-001No payment configuration with the requested name exists on the app (404). The app itself is valid — an unknown appId fails earlier, and as a 400, in PartnerAppRoutesImpl#getSpecificPaymentConfigurations.
PP-ERR-PAY-002The provider rejected a payment-status lookup for the given reference id (400). Deliberately NOT worded as "invalid reference id": the commonest provider response here is (#-1) Fatal, which is the provider's catch-all for an unknown failure, so a provider outage, a permissions problem and a genuinely unknown reference all arrive identically. The code says which operation failed; the message carries the reference id and the provider's own text.

Platform and upstream

CodeMeaning
PP-ERR-API-001The v3/bizgate API surface is not enabled for this partner — answered 404 (not 403) so the surface is indistinguishable from "does not exist" for partners who do not have it.
PP-ERR-API-002An unhandled failure reached the top-level handler — the request did not fail a check, the server broke (500). Deliberately vague, because at the catch-all no domain is known: the point of the code is that a caller can quote something in a support ticket and a dashboard can count it, not that it identifies the fault. A 500 that stays PP-ERR-API-002 for long is a signal the failure needs catching closer to where it happens and given a real code.
PP-ERR-API-003A dependency this route needs did not answer (503). Distinct from INTERNAL_ERROR: the server did not break, something it relies on is down, and the caller can retry later.
PP-ERR-API-004A 4xx that reached the top-level handler without a domain code of its own. The counterpart to INTERNAL_ERROR, and deliberately a separate code: API-002 says the server broke, so putting it on a request the caller got wrong points at the wrong party. This one says only "the caller broke a rule and no domain has claimed the rule yet". It exists so the guarantee can be stated without qualification — every error body on the public surface carries a code — while the per-domain codes are still being filled in. Seeing it in the wild is a request for a real code in the owning domain's catalog, not a resting place.
PP-ERR-API-005An upstream service rejected the request and we are passing its status and message straight through. Distinct from DEPENDENCY_UNAVAILABLE, which says the dependency could not be reached at all: here it answered, and it said no. The HTTP status is upstream's, so this code appears on 4xx and 5xx alike — what it tells a caller is that the decision was not ours, which is exactly what they need to know before retrying.

Rate limiting

CodeMeaning
PP-ERR-RATE-001Rate limit exceeded for this caller and route (429). Retryable — see the Retry-After header.

Request validation

CodeMeaning
PP-ERR-REQ-001A path variable or request parameter could not be converted to its declared type — e.g. a non-numeric partnerId on /bizgate/partner/{partnerId/commission}. Raised from V2ExceptionHandler#handleTypeMismatchException (400).
PP-ERR-REQ-002A parameter parsed to its declared type but carries a value the endpoint does not accept — e.g. migrationStatus=IN_PROGRESS where only META_EMBED_MIGRATION and MIGRATED_IN exist. Distinct from PARAMETER_TYPE_INVALID: the request bound fine, so the caller needs the list of permitted values rather than a different type.
PP-ERR-REQ-003The request body could not be parsed — malformed JSON, a wrong type for a declared field, a truncated payload. Raised from GlobalExceptionHandler#handleHttpMessageNotReadable (400). Distinct from both codes above: those describe a parameter that arrived and was wrong, this one means the body never became a request at all, so no field can be named.
PP-ERR-REQ-004A body was required and none was sent. Distinct from BODY_UNREADABLE: nothing arrived to parse, so the fix is to send a body rather than to correct one.
PP-ERR-REQ-005A required parameter, path variable or multipart part was not sent at all — e.g. PUT /bizgate/app/{appId}/profile/about without ?about=. Raised from the V2ExceptionHandler missing-value handlers (400). Distinct from PARAMETER_TYPE_INVALID and PARAMETER_VALUE_INVALID: nothing arrived to convert or reject, so the fix is to send the parameter rather than to correct it.
PP-ERR-REQ-006The caller asked for a representation this endpoint cannot produce, via Accept (406). Distinct from the parameter codes: nothing about the request was wrong except what it wanted back.
PP-ERR-REQ-007The request body arrived in a Content-Type this endpoint does not read (415). The fix is a different content type, not different content — see BODY_UNREADABLE for a body that was the right type and still would not parse.
PP-ERR-REQ-008The path exists but not for this HTTP method (405).
PP-ERR-REQ-009The upload exceeded the configured maximum size (413).

Roles

CodeMeaning
PP-ERR-ROL-001No role exists with the id supplied (404).

Solutions

CodeMeaning
PP-ERR-SOL-001The solution id is missing or not a usable identifier.
PP-ERR-SOL-002The solution id is longer than the maximum permitted.
PP-ERR-SOL-003A solution with this id already exists.
PP-ERR-SOL-004This partner already has a solution with this name; names must be unique per partner.
PP-ERR-SOL-005No solution could be found — for this partner, this id, or this Meta app id.
PP-ERR-SOL-006A solution with this Meta app id already exists.
PP-ERR-SOL-007Solution IDs mapped to this provider are not currently being accepted.
PP-ERR-SOL-008The per-provider or per-partner solution limit has been reached.
PP-ERR-SOL-009The solution is not associated with this partner.
PP-ERR-SOL-010The solution is not approved, so it cannot be marked default.
PP-ERR-SOL-011The solution is already this partner's default.
PP-ERR-SOL-012The solution could not be updated.
PP-ERR-SOL-013Meta does not recognise this solution id.
PP-ERR-SOL-014The solution lacks the messaging permission it needs on Meta's side.
PP-ERR-SOL-015The provider recorded on Meta's side differs from the one supplied.
PP-ERR-SOL-016This partner already has a solution from this provider.
PP-ERR-SOL-017A bulk sandbox-app update failed; the message carries the underlying reason.

Templates

CodeMeaning
PP-ERR-TPL-001A field the route requires was not supplied — e.g. neither a file nor a file URL.
PP-ERR-TPL-002The template id and element name supplied refer to different templates.

Wallets

CodeMeaning
PP-ERR-WAL-001Wallet Error Codes Format: PP-ERR-WAL-XXX where XXX is a sequential number
PP-ERR-WAL-002Another wallet of this partner already carries this name.
PP-ERR-WAL-003walletId is not 1–30 digits.
PP-ERR-WAL-004The wallet exists but is not this partner's, or does not exist at all.
PP-ERR-WAL-005The wallet is already linked to a partner and cannot be linked again.
PP-ERR-WAL-006The partner has reached the maximum number of wallets allowed on their plan.
PP-ERR-WAL-007The requested currency is not supported for this account or wallet type.
PP-ERR-WAL-008Multi-wallet is not enabled for this partner.
PP-ERR-WAL-009A field the route requires was not supplied — amount, appId, customerId, name, walletName or authTicket. One code rather than six: the reason is the same in every case and the message names the field, so a caller branching on the code would branch identically on all six.
PP-ERR-WAL-011No wallet exists for the given id. Distinct from WALLET_ID_INVALID, which is a malformed id: this one is well-formed and simply does not resolve.
PP-ERR-WAL-012A delegated wallet operation failed — create, read, invoice, link, capping or transfer. One code for all six on purpose. The reason is identical (the downstream call did not succeed) and what differs is WHICH operation, which the caller already knows from the endpoint they invoked and the message. Six codes here would encode the URL, not the failure.
PP-ERR-WAL-014No capping details exist for the wallet and partner supplied.
PP-ERR-WAL-015No partner user could be resolved as the wallet owner, by admin role or by walletOwner email.
PP-ERR-WAL-016Source and destination are the same account; a transfer between them is meaningless.
PP-ERR-WAL-017The debit succeeded and the credit did not, so money has left one account without arriving in the other (500). Its own code on purpose: this is the one wallet failure that leaves state inconsistent and needs a human, and burying it under a generic operation-failed code would make it indistinguishable from a transfer that never started.
PP-ERR-WAL-019The wallet service answered but the body could not be understood. Distinct from UPSTREAM_REJECTED, which is upstream deliberately saying no.
PP-ERR-WAL-020The partner wallet already carries a walletId, so it cannot be migrated to another.
PP-ERR-WAL-021The wallet has no customer id recorded against it.
PP-ERR-WAL-022This wallet's plan cannot be changed to the plan requested.
PP-ERR-WAL-023The default wallet cannot also be the loader wallet.
PP-ERR-WAL-024The wallet was created upstream but no wallet id came back.
PP-ERR-WAL-026A subscription wallet cannot be used for customer or project creation.
PP-ERR-WAL-027The cap value is outside the range the wallet configuration permits.
PP-ERR-WAL-028The app capping entry could not be created.
PP-ERR-WAL-029A wallet configuration already exists for this currency.
PP-ERR-WAL-030No wallet configuration exists for this currency.

Did this page help you?