Skip to main content
CryptoProcessing uses conventional HTTP response codes to indicate the success or failure of an API request: 2xx for success and 4xx for errors. The sections below cover the 4xx codes this API returns.

General errors

These errors aren’t tied to a particular endpoint. Errors that only some endpoints return are listed under Errors by endpoint.

Bad content format - 400 Bad Request

This error can occur for the following reasons:
  • Malformed or invalid JSON. The request body could not be parsed. Ensure it is valid JSON.
  • Missing Content-Type header. The Content-Type header must be set to application/json.

Bad signature header - 403 Forbidden

The value in X-Processing-Signature did not match the request body, or the value in X-Processing-Key did not match any active API key. See Authentication for how to generate the signature correctly. This can happen for several reasons:
  • Signature not converted to string. The signature is generated from a data array without first converting it to a string. Ensure the signature value is sent as a string.
  • Wrong hashing algorithm. The signature must be generated using HMAC-SHA-512 — a signature generated with SHA-256, SHA-1, or another digest will not match, even if everything else about the request is correct.
  • Body modified after signing. The signed body must be identical to the body that is sent — no reformatting, whitespace changes, or field reordering.
  • Extra characters or spaces. A code error introduces unexpected characters or spaces. Review your implementation and verify no extra characters are present.
  • Signature built from the full data array. The signature is created from the entire data array — including the public key and headers — instead of the secret key only. Generate the signature exclusively from the secret key.
  • Public key in wrong parameter (PHP). In some languages such as PHP, the public key may be mistakenly included in paramsArray instead of the request body. Pass the public key in the correct location.
  • Wrong secret key or environment. Sandbox and production use separate key pairs. Make sure you are using the correct set for the environment you are targeting, and that the base URL matches it.
  • Non-whitelisted IP. If you have configured an IP whitelist in the portal, requests from any unlisted IP will be rejected. Add the IP to the whitelist, use an already-whitelisted IP, or remove the whitelist entirely.
  • Deactivated or archived key. The key exists but can’t authenticate requests. Reactivate a deactivated key. An archived key can’t be reactivated, so generate and activate a new one.
  • Incorrect or malformed public key. Verify you are using the correct key. It contains both upper and lower case characters and must be sent exactly as provided — avoid any case transformation in your code.
  • Secret key used instead of public key. The X-Processing-Key header must contain your public key only. The secret key is used exclusively to generate and verify signatures. Refer to Get your API key for details.
  • Completely empty request body in Postman. Your Postman collection’s pre-request script may be handling empty bodies incorrectly. Download our Postman collection, or send an empty JSON object ({}) instead.

No signature header - 403 Forbidden

The request does not include the required X-Processing-Signature header, or the header is present but empty — an empty value is treated the same as a missing header. Add it with an HMAC-SHA512 signature of the request body.

No key header - 403 Forbidden

This error can occur for the following reasons:
  • Missing X-Processing-Key header. Add the X-Processing-Key header with your public API key. A header that’s present but empty is treated the same as a missing header.
  • Invalid request URL. Verify the endpoint URL is correct.

API key does not have the required ability - 403 Forbidden

The Custom API key is valid, but the requested endpoint isn’t one of its abilities. A Custom key can only call these endpoints, each one only if the key has its ability (see Generate a Custom key): If you need one of these endpoints, add its ability to the key. Every other endpoint, such as those for deposit addresses, withdrawals and exchanges, requires the Master key.

Internal error - 422 Unprocessable Entity

The request was understood but couldn’t be completed because of an internal error. The message can also be Something went wrong. Please try later. or Something went wrong., always with the error_code internal_error. Try the request again later.

Too many requests - 429 Too Many Requests

You sent too many requests in a short time. The limit is counted per API key, not per IP address, so requests from all your servers that use the same key count together. Wait before you send the request again, and if you get 429 again, retry with an increasing delay between attempts.

404 Not Found

This generic 404 is returned for a request:
  • To a real endpoint path, using an HTTP method the endpoint doesn’t support, for example GET on an endpoint that only accepts POST.
  • To a path that doesn’t correspond to any endpoint.

405 Method Not Allowed

Unlike the other codes on this page, 405 isn’t returned by CryptoProcessing’s API at all — a request only gets this when it never reaches the API in the first place, and the response is a plain HTML page instead of JSON. This happens when the URL is missing /api (e.g. https://app.ca.cryptoprocessing.com/v2/... instead of https://app.ca.cryptoprocessing.com/api/v2/...) or otherwise doesn’t match the base URL in Introduction — the request lands on a different service at the same host instead of this API. A GET request to such a URL gets a 200 response with an HTML web page instead, so a status check should look at the body too (see Check API status).

Errors by endpoint

Each section below lists the errors one endpoint returns for its own request, by status code, in addition to the general errors.

Generate a user deposit address

POST /v2/addresses/take · Endpoint reference 400 Bad Request 422 Unprocessable Entity

Withdraw crypto

POST /v2/withdrawal/crypto · Endpoint reference 400 Bad Request 403 Forbidden 422 Unprocessable Entity

Withdraw crypto instantly

POST /v2/crypto/withdrawal_instant · Endpoint reference 400 Bad Request 403 Forbidden

Withdraw crypto instantly with conversion

POST /v2/crypto/withdrawal_instant_exchange · Endpoint reference 400 Bad Request 403 Forbidden 422 Unprocessable Entity

Create a payment request

POST /payments/v1/requests · Endpoint reference 400 Bad Request 403 Forbidden 404 Not Found 422 Unprocessable Entity

Exchange at market rate

POST /v2/exchange/now · Endpoint reference 400 Bad Request

Get a fixed exchange quote

POST /v2/exchange/calculate · Endpoint reference 400 Bad Request

Exchange at a fixed rate

POST /v2/exchange/fixed · Endpoint reference 400 Bad Request

List supported currencies

POST /v2/currencies/list · Endpoint reference 400 Bad Request

Get available currency pairs and exchange rates

POST /v2/currencies/rates · Endpoint reference 400 Bad Request

Get transaction details

GET /v2/transactions/info · Endpoint reference 400 Bad Request 404 Not Found

List balances

POST /v2/accounts/list · Endpoint reference This endpoint has no errors of its own; see General errors.

Check API status

GET /v2/ping · Endpoint reference This endpoint has no errors of its own; see General errors.
Last modified on November 4, 2026