Use the HTTP status and response body together to decide what to check next. Listing STIGs and downloading content both require a bearer token.
400 — Check request parameters against the endpoint documentation. Format names are case-sensitive.
401 — Check Authorization: Bearer YOUR_API_TOKEN and token validity. Never include the token in a support message.
403 — A valid token may lack product access or the required integration-token scope. Check the product and endpoint you intend to use.
402 — When machine-access enforcement is enabled, the request needs a paid or eligible trial entitlement. Review the response access information.
404 — For STIG detail/download requests, check the exact STIG slug. Other endpoints may refer to other missing resources.
429 — Wait for the interval in Retry-After or retry_after_seconds before retrying.
503 — The authentication service is temporarily unavailable. Retry shortly; this does not mean your token is invalid.
500 — If it persists, provide support with the endpoint, time, status and error body, omitting credentials.
Authentication and STIG errors normally contain an error object with code and message. Paywall responses instead use an error string such as payment_required or rate_limit_exceeded. Subscription and rate-limit blocking depend on service configuration. Request JSON for API use; payment denials for requests accepting HTML can redirect to an upgrade page.
API reference: https://docs.stigviewer.com/errors