200, 201, or 204 status code with a JSON body (or no body, for 204). When something goes wrong, Nova.Pay returns a 4xx or 5xx status code and, where applicable, a JSON body describing the problem. Designing your integration around these codes will make your error handling predictable and resilient.
HTTP Status Code Reference
Validation Error Format
When Nova.Pay returns422 Unprocessable Entity, the response body always contains an errors array. Each item in the array is a human-readable string describing a specific validation failure or business rule violation.
An array of one or more human-readable error messages describing why the request was rejected. Present on all
422 responses. Each string corresponds to a distinct validation failure or business rule violation.The
errors array may contain multiple messages in a single response. Display all of them to help your users (or your debugging process) understand everything that needs to be corrected before retrying.Handling Errors
Follow these steps whenever your integration receives a non-2xx response:1
Check the HTTP status code first
Branch your error-handling logic on the status code before inspecting the body. A
503 needs a retry strategy; a 422 needs user-facing feedback; a 403 needs a configuration fix.2
Parse the errors array on 422
Deserialize the JSON body and surface every message in the
errors array to the end user or your application logs. Do not retry a 422 without first correcting the input — the same request will fail again.3
Retry with exponential back-off on 503
Transient failures from downstream services should be retried. Use an exponential back-off strategy (e.g., 1 s → 2 s → 4 s) with a maximum of three to five attempts before surfacing an error to the user. Nova.Pay automatically retries failed webhook deliveries on
5xx responses.4
Verify your host and API key on 403
A
403 almost always indicates a configuration problem rather than a transient failure. Check that your request origin appears in your allowed_hosts list, or that your Authorization header contains a valid, active API key. See the Authentication page for details.