Safe envelopes

Handle stable codes, not prose.

Errors use {"error":{"code":"…","message":"…"}}. Scope failures also include required_scope. Responses do not expose cross-account resource existence.

Request and authentication

`invalid_request`	Malformed or semantically invalid request.
`invalid_recipient`	Recipient validation failed.
`invalid_subject`	Subject validation failed.
`invalid_idempotency_key`	Idempotency key is invalid.
`invalid_api_key`	Missing, malformed, revoked, unknown, or wrong credential type.
`insufficient_scope`	Management key lacks the exact required scope.
`account_suspended`	Account fails closed.
`unsupported_media_type`	Mutation requires JSON.
`method_not_allowed`	Method is outside the route contract.

Email and content

domain_not_ready, sender_not_ready, sender_not_allowed, email_not_found, idempotency_conflict, payload_too_large, invalid_attachment, too_many_attachments, attachment_too_large, attachments_too_large, mime_too_large, rate_limit_exceeded, and queue_limit_exceeded.

Management resources

domain_not_found and sender_not_found cover unknown, deleted, malformed, and foreign-account identifiers. Conflicts include domain_conflict, domain_limit_exceeded, domain_has_senders, sender_conflict, sender_limit_exceeded, sender_domain_limit_exceeded, and sender_not_allowed.

Availability

service_unavailable is safe to retry with bounded backoff when the operation is naturally idempotent. internal_error is not a signal to blindly repeat mutations. Respect Retry-After where present.