Integrating with the OwnerRez API can return errors when a request does not meet authentication, access, validation, or processing requirements. This article documents those errors, what triggers them, and the changes needed to resolve them. The sections below are grouped by error type, beginning with authentication and access errors that are evaluated before the requested operation runs.

Error response format
Authentication and access errors
Request and application errors

Error response format

OwnerRez API v2 error responses include a stable code field and a doc_url link to this article. Use code in your integration to branch error handling instead of parsing human-readable messages.

Every error response uses Content-Type: application/json with these fields:

messages — human-readable detail (one or more strings)
code — stable machine-readable identifier (snake_case)
doc_url — link to the section below for that code
status — HTTP status as snake_case text (for example, unauthorized)
status_code — numeric HTTP status (for example, 401)

Authentication and access errors

Returned when a request fails authentication, authorization, or account access checks before the requested API operation runs.

https_required

HTTP 400. The request was not made over HTTPS. Retry using https://.

user_agent_required

HTTP 401. OAuth Bearer requests must include a User-Agent header that identifies your application.

auth_required

HTTP 401. No credentials were provided. Send a valid Personal Access Token (Basic) or OAuth access token (Bearer). See API authentication.

invalid_token

HTTP 401. The token is missing, expired, inactive, or otherwise invalid. Legacy X-OwnerRez-App / X-OwnerRez-User headers are no longer accepted.

invalid_request

HTTP 401. Basic authentication credentials are not valid Base64 or do not contain username:token format.

ip_blocked

HTTP 403. The request came from an IP address that is not allowed for this Personal Access Token.

Open the token under Settings > API and review the IP restriction mode:

Allow All — block only the IPs listed below (default).
Deny All — allow only the IPs listed below.

If the token uses Deny All and your server’s outbound IP is not on the list, every API call returns this error. Add the IP addresses your integration uses (comma, semicolon, or one per line), or switch to Allow All if IP restriction is not needed.

account_locked

HTTP 403. The OwnerRez account is locked. Contact help@ownerrez.com.

account_closed

HTTP 403. The OwnerRez account is closed and can no longer use the API.

wordpress_plugin_required

HTTP 403. The request used the WordPress plugin User-Agent prefix but the account does not have the WordPress plugin feature enabled.

messaging_not_enabled

HTTP 402. The Messages endpoints need an OAuth app; Personal Access Tokens cannot call them. Using your own account? Create an OAuth app and click Grant Access To Me on the Users tab — self-use is included. Third-party apps need a signed messaging agreement: email partnerhelp@ownerrez.com with the subject Messaging API Access.

external_sites_not_enabled

HTTP 402. The Reviews and Listings endpoints need the WordPress Plugin + Integrated Websites premium, or an OAuth app with listing access (a partnership agreement — email partnerhelp@ownerrez.com with the subject Listing Endpoints Access). Using your own account? Create an OAuth app and click Grant Access To Me on the Users tab — self-use is included, no premium needed.

Request and application errors

Returned while processing an authenticated request, when the input or operation cannot be completed.

validation_failed

HTTP 400. Request data failed validation. Read messages for field-level detail.

not_found

HTTP 404. The requested resource does not exist or is not visible to the authenticated account.

permission_denied

HTTP 403. The authenticated user or app is not allowed to perform this action. Common causes: the OAuth token has read-only scope and the request is not a GET; the user's access to this account was revoked; or the record belongs to another account.

conflict

HTTP 409. The update conflicted with another change or could not complete because of a temporary conflict. Refresh and retry.

duplicate

HTTP 409. The record already exists or would create a duplicate.

rate_limited

HTTP 429. Too many requests. The limit is 300 requests every 5 minutes per IP address; back off and retry once your rate falls below it. Separately, a Personal Access Token may only reach two different OwnerRez accounts from one IP address per 24 hours — integrations serving many customer accounts need an OAuth app. See Rate limiting.

temporary_failure

HTTP 503. A temporary upstream or infrastructure failure occurred. Retry later.

internal_error

HTTP 500. An unexpected server error occurred. If it persists, contact support with your request timestamp and endpoint.

availability_calculation_failed

HTTP 400. Availability or pricing could not be calculated for the supplied dates or configuration. Check messages for specifics.