| 200 | OK | Request succeeded. |
| 201 | Created | Resource was created. Every create endpoint (charges, refunds, customers, payment methods, checkout sessions, payouts, webhooks) answers 201. |
| 400 | Bad Request | Invalid JSON, a missing or invalid parameter, or a declined charge (error.type card_error, code charge_failed). Raw card data answers 400 pci_vault_required. |
| 401 | Unauthorized | Missing, malformed, revoked, expired or inactive API key, or a key of the wrong mode. |
| 402 | Payment Required | The bank account cannot be debited yet: bank_account_unverified (microdeposit code not submitted), bank_account_verification_failed, bank_account_disabled. |
| 403 | Forbidden | The key is valid but not allowed: wrong key type (publishable on a secret route), IP not in the key's allowlist, suspended key, business not onboarded, processing disabled, plan limit reached, or a merchant_id that is not yours. |
| 404 | Not Found | No such resource in this account and mode — a test key never sees live objects. |
| 405 | Method Not Allowed | The route exists but not for this HTTP method. |
| 409 | Conflict | Idempotency key reused for a different operation or account; a saved card stored under a previous processor must be re-entered; no active business for the key. |
| 422 | Unprocessable Entity | Idempotency key reused with a different request body; wrong or expired microdeposit verification code (the body carries attempts_remaining and terminal). |
| 429 | Rate Limited | 100 requests per minute per API key (error.code rate_limit_exceeded), 20 checkout-session creations per minute per key, or the platform's 300 requests per minute per IP (flat body with Retry-After). See Rate Limits. |
| 500 | Internal Server Error | Unexpected error (error.code internal_error). Retry with the same Idempotency-Key where supported. |
| 502 | Bad Gateway | The card vault could not be reached when opening a capture session (error.code vault_error). Retry. |
