User Guide
Error Reference
Every error string Airlock's sanitize_error() allowlist permits through to a
client is listed below — anything not on this list gets replaced with a generic message
plus a request ID, and the real cause is only ever visible in server-side logs.
| Message | Status | Cause | Can occur on |
|---|---|---|---|
Authentication failed, please confirm your details. |
401 | Access key invalid, or valid key but caller's IP isn't in its allowlist — deliberately indistinguishable | all four /api/* routes |
Secret name must be 255 characters or less |
404 (get/update/delete), 400 (create) | secret-name header over 255 characters |
all four /api/* routes |
Secret name cannot be empty |
404 (get/update/delete), 400 (create) | secret-name is blank or whitespace-only |
all four /api/* routes |
Secret value must be 1MB or less |
404 (update), 400 (create) | secret-value header over 1,000,000 characters |
create, update |
Access key is invalid |
404 (get/update/delete), 400 (create) | access-key header over 255 characters (a format check, not a validity check — see below) |
all four /api/* routes |
Fernet key must be 32 url-safe base64-encoded bytes. |
404 (update), 400 (create) | Malformed fernet-key header supplied for BYOK |
create, update |
Fernet key does not match the one used to encrypt this secret... |
404 | Decryption failed — wrong BYOK key, or a key supplied for a secret that wasn't BYOK-encrypted | get |
Secret not found: <name> |
404 | No row for that owner + secret name | get, update, delete |
Too many requests! Please try again later. |
429 | Per-IP rate limit exceeded — checked before auth | all routes |
Request payload too large. Maximum size is 10MB. |
413 | Request body over 10MB — checked before auth | all routes |
An error occurred processing your request. Request ID: <id> |
500 | Anything not matching a pattern above — DB errors, unexpected exceptions. Real error is logged server-side against the same request ID | all four /api/* routes |
Note on "Access key is invalid": this message is misleadingly named — it's
purely a length check (>255 characters), not a check that the key exists or is correct.
An actually-wrong key of normal length instead produces the generic
Authentication failed message above.
The 500 path
Every 500 response includes a request ID (also present as the
X-Request-ID response header on every request). Quote that ID when reporting
an issue — it's the only way to correlate a client-visible failure with the corresponding
server-side log line, since the real error text is intentionally never returned.