Skip to main content

​
Transport errors

Returned as JSON-RPC errors on the HTTP response: Every error body carries error.data.correlationId. Quote it when reporting a problem — it is the handle to the server-side log line, and the body deliberately never contains the underlying exception message. A 403 Forbidden is returned when the request carries an Origin header naming an origin this server does not accept.

​
Auth challenges

A 401 Unauthorized (with a WWW-Authenticate challenge) is returned when the bearer token is missing, malformed, or inactive. Re-authenticate via the OAuth flow.

​
Tool-level failures

Validation rejections, missing state, precondition gates, and backend errors are not JSON-RPC errors. Per the MCP spec they surface inside the successful response’s result.content. Inspect result.isError and the embedded error / code / message. For advance_company_onboarding, error responses carry the same steering fields as success — follow nextAction and nextActionInput rather than retrying the same call:

​
”No active session”

The most common runtime failure is a missing or expired identity — typically an expired token. Recover by re-authenticating (the bearer is the source of identity), then call get_company_onboarding_status to confirm where to resume. Don’t redo steps the customer already completed.