> For the complete documentation index, see [llms.txt](https://docs.interlynk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.interlynk.io/api/reference/errors.md).

# Errors

The API reports failures in three ways. Which one you get depends on where the request failed.

## Authentication errors

A missing, expired, or invalid token returns HTTP `401` with an error body:

```json
{
  "errors": [
    { "message": "Unauthorized", "extensions": { "code": "UNAUTHORIZED" } }
  ]
}
```

Fix: check that the `Authorization` header is present and the token is current. See [Authentication](/api/getting-started/authentication.md).

## GraphQL errors

If the request is authenticated but the query itself is wrong, for example a misspelled field or a missing required argument, the API returns HTTP `200` with a top-level `errors` array and no `data`:

```json
{
  "errors": [
    {
      "message": "Field 'notAField' doesn't exist on type 'Organization'",
      "locations": [{ "line": 1, "column": 20 }],
      "path": ["query", "organization", "notAField"],
      "extensions": {
        "code": "undefinedField",
        "typeName": "Organization",
        "fieldName": "notAField"
      }
    }
  ]
}
```

{% hint style="warning" %}
A `200` status does not mean the request succeeded. Always check for a top-level `errors` key before you read `data`.
{% endhint %}

These errors are usually a bug in the request. Fix the query and resend.

## Mutation errors

Mutations handle expected failures differently. Instead of a top-level error, the failure is returned inside the mutation's own `errors` field, and `data` is present:

```json
{
  "data": {
    "authorCreate": {
      "author": null,
      "errors": ["Sbom not found"]
    }
  }
}
```

Every mutation in these docs has an `errors` field. Always request it and always check it. An empty list means success.

This design also protects against enumeration. A record that does not exist and a record you are not allowed to see both return the same message, for example `Sbom not found`.

## Common messages

| Message                   | Where             | Cause                                                                     |
| ------------------------- | ----------------- | ------------------------------------------------------------------------- |
| `Unauthorized`            | HTTP 401          | Token missing, expired, or invalid.                                       |
| `Sbom not found`          | Mutation `errors` | The `sbomId` is wrong, or the token cannot access it.                     |
| `Component not found`     | Mutation `errors` | The component `id` is wrong, or it does not belong to the given `sbomId`. |
| `Project group not found` | Mutation `errors` | The product name or ID does not exist, or is not visible to the token.    |
| `No arguments provided`   | Mutation `errors` | An update mutation was sent with no fields to change.                     |
| `Project not enabled`     | Mutation `errors` | The product is disabled. Re-enable it in the dashboard.                   |

## Checking errors in a script

With `jq`, check the top-level `errors` key before using `data`:

```bash
RESPONSE=$(curl -s https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { organization { name } }"}')

if echo "$RESPONSE" | jq -e '.errors' > /dev/null; then
  echo "Request failed:"
  echo "$RESPONSE" | jq '.errors'
  exit 1
fi

echo "$RESPONSE" | jq '.data'
```