Errors and best practices

All three endpoints return errors in the format { "message": "Error description" }. Check the HTTP status before treating a response as a transaction.

HTTP	Meaning
`400`	Invalid JSON or fields; missing currency permission; reserved `fee` type; cancellation of a transaction that is not `pending`.
`401`	Missing `x-api-key` header.
`403`	Invalid, suspended, or disabled key; transaction created by another key.
`404`	Transaction ID not found.

Keep your key out of browsers, URLs, repositories, and public logs.
Store the transaction ID with your order and verify the data on your server before fulfillment.
Do not repeat POST requests without tracking them: each request can create another transaction. external_id does not prevent duplicates.
If creation times out, reconcile your order before retrying. These endpoints do not provide listing or lookup by external_id.
Retrieve the transaction to track its status. The public Wallet API supports creation, individual retrieval, and cancellation. Payment confirmation happens on York’s payment page.