# Common mistakes This page is built from 30 days of production status distribution. Where we do not measure something, it says so. ## Path mistakes The most frequent 4xx in the log is `404`, and almost none of it is yours: it is scanners walking `.env`, `.git/config`, `wordpress/`, `wp-content/…`. The real integrator path mistakes are different and already documented with examples here: [The mistaken calls we see most often](/en/api-conventions/). In short: `/api/…` instead of `/v1/…`, a doubled `/v1/v1/…`, and `/swagger.json` instead of `/v1/openapi.json`. ## `402`: the plan does not include the endpoint 385 responses in 30 days. The distribution shows where the free plan runs into the wall: | Endpoint | `402` in 30 days | |---|---| | `chart` | 114 | | `transit-calendar` | 101 | | `vedic/dashas/vimshottari/maha` | 48 | | `ingresses` | 25 | | `planetary-hours` | 24 | | `vedic/panchang/full` | 24 | | `eclipses` | 13 | The body carries `current_plan` and `upgrade_to`. This is not a malformed request: the body is fine and the key is valid, the plan simply does not include that endpoint. ## `429`: two different limits 6,791 responses in 30 days, 3,769 of them without a key and 3,022 with one. These are two different mechanisms and worth keeping apart: - **without a key** the limit is per IP, 30 requests an hour. The largest single block in our log is not integrators at all but synthetic Chrome-Lighthouse auditing from 15 addresses; - **with a key** the limit is your plan's RPM. The response carries `Retry-After` in seconds, and that is what to wait for rather than retrying at once. ## `400`: nearly always a chart-shaped body 700 responses in 30 days, concentrated on the endpoints that take a date, a time and coordinates: `chart` (111), `horoscope/daily` (19), `transits` (18), `synastry` (15), `rectification` (15). The most expensive mistake of this family is not the one that returns `400` but the one that used to return `200`: short field spellings. The rules and a sample response: [Field formats](/en/agent-setup/field-formats/). ## `401` and `403` `401` is a missing or invalid key; the message names both classes, `aw_` and `pk_`. `403` is about origin: a browser `pk_` key is refused when the request carries no origin or comes from a domain it does not list, and a key with an endpoint scope answers `ENDPOINT_NOT_IN_SCOPE` with its list in `details`. The full code table: [Errors](/en/errors/).