Every response — success or failure — uses the same envelope, so your client parses one shape.
{
"status": false,
"code": "DUPLICATE_MERCHANT",
"message": "A merchant with this email already exists.",
"data": null,
"timestamp": "2026-07-02T14:20:00Z"
}| HTTP | code | data carries |
|---|---|---|
| 400 | INVALID_INPUT | fieldErrors |
| 400 | INVALID_REQUEST | — |
| 400 | INVALID_TOKEN | — |
| 401 | UNAUTHORIZED | — |
| 401 | INVALID_TOKEN | — |
| 403 | ACCOUNT_NOT_VERIFIED | — |
| 403 | UNAUTHORIZED | — |
| 404 | RESOURCE_NOT_FOUND | — |
| 409 | DUPLICATE_MERCHANT | — |
| 409 | INVALID_REQUEST | — |
| 422 | INVALID_REQUEST | — |
| 502 | NOMBA_INTEGRATION_ERROR | traceId |
| 502 | EMAIL_DELIVERY_ERROR | traceId |
| 500 | INTERNAL_ERROR | traceId |
Validation errors return per-field detail; server and upstream errors return a traceId you can quote to support. Stack traces and raw provider payloads are never leaked.