Documentation ·Docs
Consumer guides

Errors, status codes and retries

The responses the gateway itself returns, what each means and what to do, and when a retry is worth it.

Read this page in العربية

On this page

At a glance#

The gateway answers its own errors with a JSON body holding a message field, and every response carries an X-Kong-Request-Id header. Errors raised by the provider's own service are passed through unchanged.

{
  "message": "No active subscription for this product"
}

Responses from the gateway#

CodeMessageMeaning, and what to do
403No active subscription for this productThe app has no active subscription to this product, or the subscription is not active, or the key is wrong. Check the key and the subscription.
403Subscription quota exceededThe subscription's quota for the billing period is used up. Do not retry.
429Endpoint quota exceededThe endpoint's quota is used up. Do not retry.
404no Route matched with those valuesNo route matches the request. Check the gateway address, the version prefix and the endpoint path.
503Subscription service unavailableA gateway dependency is temporarily unavailable. Retry with backoff.
500Route configuration errorThe route is misconfigured on the platform side. Contact support and quote the request ID.

Retries with backoff and jitter#

Retry only temporary failures (network errors and 502, 503 or 504 responses), at most three times, with a random interval. Otherwise all your clients retry at the same instant and create a second wave.

async function call(fn, tries = 3) {
  for (let i = 0; i < tries; i++) {
    const res = await fn();
    // retry temporary failures only: not an exhausted quota, not a missing subscription
    if (![502, 503, 504].includes(res.status) || i === tries - 1) return res;
    await new Promise((r) => setTimeout(r, 2 ** i * 1000 + Math.random() * 400));
  }
}

When you need support#

Send the X-Kong-Request-Id value from the response when you contact support, so the call can be found (get help).

Planned

One error envelope with an error code, a message and the request ID in the body; Retry-After on throttling responses; messages in Arabic or English by Accept-Language; and an Idempotency-Key header for safe retries of POST requests.

See also#

Was this page helpful?
Updated 2026-10-17