Errors can originate from validation, authentication, authorization, resource existence, business conflicts, rate limits, dependency failures, timeouts, or unexpected server faults.

Do not expose internal stack traces, SQL statements, secrets, filesystem paths, or dependency details to clients in production.

A useful API distinguishes between errors that clients can fix and errors that require server-side intervention.