Response Codes

Payflow uses conventional HTTP status codes with a JSON envelope for business APIs.

Success envelope

{
  "success": true,
  "data": {},
  "message": null
}

{
  "success": false,
  "data": null,
  "message": "Readable error message"
}

Code	Class	Meaning
`200`	Success	The request succeeded.
`201`	Success	A resource, preparation, key, or request was created.
`204`	Success	Empty preflight or no-content response.
`400`	Client error	Invalid body, query, payload, or signature.
`401`	Client error	Credential missing, invalid, or inactive.
`403`	Client error	Authenticated caller cannot perform the action.
`404`	Client error	Resource was not found in caller scope.
`409`	Client error	Business state conflict.
`422`	Client error	Domain or provider validation failed.
`428`	Client error	Password step-up is required.
`429`	Client error	Rate limit exceeded.
`500`	Server error	Unexpected server error.
`502`	Server error	Upstream provider failure.
`503`	Server error	Required service, auth, Redis, or provider config unavailable.

Provider callback acknowledgements may not use the Payflow envelope because providers expect their own acknowledgement shape.