Successful Responses
200 OK
Standard response for successful HTTP requests. The response returned will depend on the request being made.
GET requests will return the requested record or resource.
POST requests will return information about the action performed or the record that was created.
What to check
Confirm the expected data has been returned.
Verify the information returned is correct.
Check the response body for any warnings or validation messages.
204 No Content
The server successfully processed the request but has not returned any content.
This response is commonly returned for successful update or delete actions where no response body is required.
What to check
Confirm the request completed successfully.
Check the record in OnRent Events to verify the changes were applied.
Review any application logs for confirmation of processing.
400 Errors
400 Bad Request
The server would not process the request due to something the server considered to be a client error.
Causes
The JSON body may contain formatting errors or invalid information. Error examples can include:
Missing brackets.
Spelling errors.
Missing mandatory fields.
Invalid request parameters.
Incorrect characters in the URL.
Headers that are too large or incorrectly structured.
What to check
Check the URL for typing mistakes.
Check the JSON syntax for missing brackets, quotation marks or spelling errors.
Confirm all required fields are included.
Compare the request body against the API documentation example.
Validate the JSON using a JSON validator.
401 Unauthorized
401 Client error response status code. The request is not successful because it lacks valid authentication credentials or the credentials supplied are invalid.
Causes
The credentials can either be missing, invalid or expired. This can occur when:
The API key is incorrect.
The API key has been refreshed but the integration is still using the old value.
The OAuth2 access token has expired.
The OAuth2 application has been deleted.
The access token is missing from the request.
The incorrect authentication type is being used.
The subdomain supplied is incorrect.
What to check
Check the login credentials are correct.
Confirm the OAuth2 access token has not expired.
Access tokens remain valid for 2 hours after being issued.
Generate a new access token using the refresh token if necessary.
Confirm the OAuth2 application still exists in OnRent Events.
Check the Authorization header is being sent correctly.
Verify the API key matches the API key in System Setup > Integrations > API.
Confirm the correct authentication type is being used (OAuth2 or API Key).
Confirm the correct subdomain is being supplied using the
subdomainparameter orX-SUBDOMAINheader.
OAuth2 Authentication Issues
OAuth2 applications use a Client ID, Client Secret, Access Token and Refresh Token to authenticate with the API.
Causes
The Client ID is incorrect.
The Client Secret is incorrect.
The access token has expired.
The OAuth2 application has been deleted.
The redirect URL does not match the application configuration.
The access token is missing from the Authorization header.
The OAuth2 flow was not completed successfully.
What to check
Verify the Client ID is correct.
Verify the Client Secret is correct.
Confirm the OAuth2 application exists in System Setup > Integrations > API.
Confirm the redirect URL matches the integration configuration.
Check the Authorization header contains a valid access token.
Generate a new access token using the refresh token if required.
Review integration logs for token refresh failures.
Confirm the integration is using a properly supported OAuth2 client library.
OAuth2 Application Setup
Create an OAuth2 application from:
System Setup > Integrations > API > Custom OAuth2 Applications > Add Application
This will generate:
Client ID
Client Secret
If the OAuth2 application is deleted, any issued access tokens and refresh tokens are immediately revoked and all access will be blocked. For API requests you must:
Include the access token in the Authorization header.
Include the Current RMS subdomain.
Example:
Authorization: Bearer ACCESS_TOKEN
X-SUBDOMAIN: yoursubdomain
For further information see the API documentation.
API Key Authentication Issues
Current RMS API keys can be provided either as a request parameter or in the request header.
Causes
An incorrect API key is being used.
The API key has been copied incorrectly.
The API key has been refreshed and the integration is using an old version.
The X-AUTH-TOKEN header is missing.
The subdomain supplied is incorrect.
What to check
Compare the API key used by the integration against the API key shown in System Setup > Integrations > API.
Check for missing characters, additional spaces or typing mistakes.
Confirm the API key has not been refreshed.
If the key has been refreshed, update the integration with the new value.
Confirm the X-AUTH-TOKEN header is being sent.
Confirm the correct subdomain is being supplied.
Generate a new API key and test again if required.
API Key Setup
To get an API key:
System Setup > Integrations > API > Enable API = Yes
This will generate an API key. To create a new key select:
Issue a new API key
Required request headers:
X-SUBDOMAIN: yoursubdomain
X-AUTH-TOKEN: yourapikey
API keys provide full read and write access to your system. It is recommended that:
Unused API keys are revoked.
API keys are refreshed periodically.
Requests are always made over HTTPS.
403 Forbidden
You do not have permission to access the requested resource.
The server has understood the request but refuses to allow access.
Causes
Insufficient user permissions.
Invalid API credentials.
Incorrect authentication settings.
Restrictions on the authenticated user.
What to check
Check the login credentials are correct.
Try logging out and back in.
Clear browser cache and cookies.
Confirm the URL is valid.
Verify the credentials were created by an administrator.
Confirm the user associated with the credentials has access to the resource being requested.
404 Not Found
The web page or resource you are trying to access does not exist. A common cause is the URL being incorrect.
Causes
Incorrect endpoint URL.
Incorrect record ID.
Missing URL parameters.
The requested record no longer exists.
What to check
Check the URL being used.
Confirm the endpoint exists within the API documentation.
Verify the record ID exists within OnRent Events.
Check for spelling mistakes or missing path parameters.
API Endpoint:
https://api.current-rms.com/api/v1/
413 Request Entity Too Large
If you are getting a 413 error, the request size has exceeded the allowed limit.
Causes
Request body exceeds size limits.
File attachments are too large.
Too much data is being submitted in a single request.
What to check
Break large requests into smaller requests.
Reduce file sizes.
Remove unnecessary information from the request.
Review system limits before resubmitting.
422 Unprocessable Entity
The request was correctly formatted but the server could not process the supplied data due to validation or business rule errors.
Causes
A field contains an invalid value.
Data has been supplied in the wrong format.
A referenced record does not exist.
Mandatory business rules have not been met.
Invalid dates, times or numeric values have been supplied.
What to check
Review the response body for validation messages.
Confirm all field values are valid.
Check referenced record IDs exist.
Verify date and time formats are correct.
Confirm numeric values are within acceptable ranges.
Check mandatory fields contain valid data.
Compare the request against the endpoint documentation example.
Test with a smaller data set to identify the problematic value.
429 Too Many Requests
The server has received too many requests from the same client within a short period of time and has temporarily limited additional requests.
Causes
A large number of API requests are being sent in rapid succession.
An integration is repeatedly retrying failed requests.
Multiple processes are making requests using the same credentials.
Batch operations are generating a high volume of requests.
The integration is not allowing sufficient time between requests.
What to check
Review the integration logs to identify unusually high request volumes.
Reduce the frequency of API requests where possible.
Avoid repeatedly retrying failed requests without a delay.
Break large operations into smaller batches.
Implement retry logic with increasing wait times between attempts.
Allow some time before retrying the request.
Check whether multiple integrations are using the same credentials and making requests at the same time.
Review the API design to ensure unnecessary requests are not being made.
Best Practice
When receiving a 429 response, avoid immediately resubmitting the same request multiple times as this may extend the rate limiting period. Where possible, implement retry logic that gradually increases the time between requests before attempting the action again.
500 Server Errors
503 Service Unavailable
The server is currently unable to handle the incoming request. This usually means the service is temporarily unavailable because the server is busy or undergoing maintenance.
Causes
Planned maintenance.
Temporary outage.
High server load.
What to check
Check if there is a known outage.
Wait a few minutes and retry the request.
Check your internet connection.
Review any status communications relating to the service.
504 Gateway Timeout
The server acting as a gateway or proxy did not receive a response in time to complete the request.
Causes
Backend services are unavailable.
Backend services are overloaded.
Requests are taking too long to process.
What to check
Check if the system is experiencing slowness or an outage.
Check your internet connection.
Clear cache and cookies.
Try again later.
Avoid repeating large or resource-intensive actions immediately.
Review any recent system maintenance or service disruption notices.