One page of matching refunds.

The request was understood but refused by a business rule. Read code to decide what to do; the possible codes are listed
in the endpoint description. message is for humans and may change.
One or more fields in the request are missing or invalid. details maps each failing field (a dotted path for nested
fields) to the list of rules it broke. Fix every listed field before retrying.

Example: {"code": "VALIDATION_ERROR", "message": "There have been validation errors", "details": {"email": [{"code": "MISSING_REQUIRED_FIELD", "message": "email is required"}]}}

The request has no valid access token. Get a new token from POST /login and send it as Authorization: Bearer <token>.

Codes: UNAUTHORIZED_NO_TOKEN (no Authorization header), UNAUTHORIZED_INVALID_TOKEN (expired or malformed token),
UNAUTHORIZED_NO_CONTEXT (the token does not belong to a payor or merchant), UNAUTHORIZED_NO_PAYOR (the token gives access
to more than one payor and the request did not send x-payor-id). A few endpoints answer from the API gateway instead and
return only {"message": "Unauthorized"}.

The token is valid but is not allowed to perform this operation.

Codes: FORBIDDEN_INSUFFICIENT_TAGS (your credential's role does not allow this operation), FORBIDDEN_CONDITION_NOT_MET
(the payment amount is above your approval limit). Some endpoints add their own codes; they are listed in the endpoint
description.

The request body is not valid JSON, or is not a JSON object. Send Content-Type: application/json with a JSON object body.