Requests and errors

Input

Each operation takes one object of input, from the request:

• GET and DELETE read it from the query string. Numbers and booleans are read as the operation’s schema says (?limit=50, ?archived=true), and a list is the parameter repeated: ?tag=wholesale&tag=newsletter.
• POST, PUT and PATCH read a JSON object from the body, up to 1 MB. An empty body is an empty object.
• Path parameters, such as {id} in /contacts/{id}, are part of the input too, and win over the same name in the query or body.

Money is an integer in the currency’s minor unit (1900 is $19.00), and times are ISO 8601 strings in UTC (2026-10-26T15:04:05.000Z). Ids carry their kind: ctc_… for a contact, ord_… for an order, site_… for a site, each followed by a ULID.

Answers

A success answers 200, or the status the operation says (201 for some creates), with the operation’s output as JSON: the record itself, not wrapped in an envelope. A list answers an array, or an object that holds one, as each operation’s reference shows; the paged ones answer { "rows": [...], "nextCursor": "…", "total": 1234 }. Nothing is cached: every answer has cache-control: no-store.

Errors

Anything that fails answers with its HTTP status and the same shape:

{
  "error": {
    "code": "invalid",
    "message": "Some of what was sent isn't valid.",
    "details": {
      "fields": {
        "email": "Invalid email address",
        "lines.0.quantity": "Too small: expected number to be >=1"
      }
    }
  }
}

Status	code
400	invalid	The input doesn’t fit the operation’s schema, or a value isn’t acceptable. details.fields names each field, by its path in the input. A body that isn’t a JSON object is invalid too.
401	unauthorized	No key, or one that doesn’t work (Authentication).
403	forbidden	The key doesn’t have the permission, or the workspace is read-only for billing (details.reason: "billing_read_only").
404	not_found	Nothing has that id, or no operation answers that path: No such endpoint.
405	invalid	The path exists, but not for this method. The allow header lists the methods it takes.
409	conflict	The change clashes with the workspace’s state, such as a deployment already running, or an Idempotency-Key still in use.
413	too_large	The body is over 1 MB.
422	invalid	The Idempotency-Key was used with a different request (Idempotency).
429	rate_limited	Over a rate limit; retry-after says how many seconds to wait (Rate limits).
500	internal	Something went wrong on Digize’s side: Something went wrong.
503	unavailable	A service Digize depends on couldn’t answer just now. Try again.

message is written for people, to show as it is, and may change; branch on code, and on details where an operation documents it.

Operations that can’t be undone

Operations marked x-confirm in the OpenAPI document (sending, refunding, deleting, publishing) take effect at once. The app and its agent ask a person first; the API doesn’t, so check before you call them.