Errors

Authentication and rate-limit errors return a string error code in error. Errors raised by an individual endpoint return error: true with a message. Both forms occur, so branch on the HTTP status rather than on the shape of the body.

401 API_KEY_REQUIRED — the Authorization: Bearer kcs_… header is missing or malformed.
401 API_KEY_INVALID — the key is unknown, revoked, or expired.
403 INSUFFICIENT_SCOPE — the key's scope does not permit the HTTP method used.
403 FEATURE_NOT_AVAILABLE — the account's plan does not include API access.
404 error: true with a message, e.g. { "error": true, "message": "Incident not found" }.
429 RATE_LIMIT_EXCEEDED — the hourly limit was reached. See Rate limiting.
500 AUTH_ERROR or error: true — unexpected server error.

Two behaviours worth designing for. If your account moves to a plan without API access, existing keys stop working and requests return 403 FEATURE_NOT_AVAILABLE even though the keys still exist. And a 404 on an incident is returned both when no such incident exists and when it belongs to another account, so a caller cannot use the status to probe for records outside its own account.