What This Extension Adds #
Core DDLS does not expose a REST API and does not use Bearer token authentication. DMSI Advanced API introduces a full authentication layer — API keys, JWT access tokens, OAuth 2.0 tokens, and sandbox keys — each of which has its own error conditions. The error codes below are specific to this extension and will not appear in a plain DDLS installation.
All authentication errors return HTTP 401 or 403 with a JSON body containing a code and message field.
401 Errors #
| Error Code | Meaning | Resolution |
|---|---|---|
api_key_expired | The API key’s expiration date has passed | Create a new API key in the DDLS Developer admin shell |
api_key_revoked | The API key has been explicitly revoked | Create a new API key; revoked keys cannot be reinstated |
invalid_api_key | Key not found or HMAC hash does not match | Verify the key value was copied correctly; regenerate if needed |
invalid_token | JWT signature is invalid or the token has expired | Request a new access token using your refresh token or re-authenticate |
403 Errors #
| Error Code | Meaning | Resolution |
|---|---|---|
ip_not_whitelisted | The request IP address is not in the key’s IP whitelist | Add the request IP to the key’s whitelist in the admin UI, or clear the whitelist to allow all IPs |
https_required | The request was made over HTTP in production mode | Use an HTTPS URL; or set dmsi_aapi_environment to development for local testing |
Diagnosing Auth Failures #
All API responses include a X-Request-ID header. Include this value when reporting authentication issues — it correlates the request to the entry in dmsi_aapi_logs.