Common HTTP status codes

These HTTP status codes are returned in API calls to indicate the overall success or failure of a request.

Code	Description	Why could you be seeing this code?
`200`	OK	Returned for successful requests. This includes current verification-creation endpoints, which return success payloads with HTTP `200`.
`201`	Created	May be used for resource-creation endpoints, but do not assume every successful create call returns `201`. Check each endpoint’s documented response.
`400`	Bad Request	Returned when the request payload, parameters, or business rules are invalid. Examples: a malformed URL, an invalid verification ID, or trying to update a verification in an unsupported state.
`401`	Unauthorized	Returned when authentication fails, such as a missing or invalid API key, or an invalid hosted-flow token.
`404`	Not Found	Returned when the requested resource cannot be found.
`500`	Internal Server Error	A generic error response returned when something went wrong on Helium ID’s side.

Success response shape

Most successful responses use a consistent JSON envelope:

{
  "status": true,
  "message": "Created verification",
  "data": {},
  "code": 200
}

That means:

Client and server errors typically use this shape:

{
  "status": false,
  "message": "Verification not found",
  "code": 404
}

Some validation errors also include an error object or extra metadata depending on the endpoint and middleware that produced the response.

Treat any non-2xx response as a failed API call, even if the JSON body contains additional details.
Do not rely on 201 for create operations. The current verification and company-verification create endpoints return 200.
Always inspect the JSON message field for a human-readable explanation when a request fails.