Errors
Last verified: 2026-06-20 (Task #390 — User APIs documentation).
The Events API returns resource objects on success and a simple error object on failure:
{ "error": "Only the event planner can update this event" }
For request-body validation failures, error is an array of structured
validation issues:
{ "error": [ { "path": ["attach", "trip_ids"], "message": "Required" } ] }
Status codes
| Status | Meaning | Typical error |
|---|---|---|
400 | Malformed event id or invalid body. | "Invalid event id" or a validation-issues array |
401 | No valid session cookie or bearer token. | "Authentication required" |
403 | Not a member of a target trip (create/read), or not the event's planner (update/delete). | "Access denied" |
404 | The event was not found. | "Event not found" |
410 | The event has been soft-deleted. | "Event has been deleted" |
500 | Unexpected server error. | "Internal server error" |
The 410 Gone status
Events are soft-deleted — the row is kept with a deletedAt timestamp.
Reading or updating a soft-deleted event returns 410 Gone (not 404), so
clients can tell the difference between "never existed" and "deleted". A
DELETE on an already-deleted event is idempotent and returns 200 with
already_deleted: true (see events.md).