Common Parameters

Common Request Parameters (HTTP Headers)

All authentication for API requests is passed via HTTP headers. The request body stays pristine business JSON.

Header	Type	Required	Description
X-Loxily-AppKey	string	Yes	Project App Key
X-Loxily-Timestamp	number (as string)	Yes	Unix seconds (or milliseconds), valid within 5 minutes
X-Loxily-Sign	string	Yes	Request signature — see Signing Algorithm

Common Response Fields

All responses include the following top-level fields regardless of success or failure:

Field	Type	Description
success	boolean	Whether the call succeeded
code	number	Business code; 0 means success, others are error codes
msg	string	Human-readable short message
trace_id	string	Request trace ID — used for log correlation; can be searched in the Open Platform "Call Logs" page to look up the full request and callback history
data	object | null	Business payload; null on failure

Response Format

Success

{
  "success": true,
  "code": 0,
  "msg": "ok",
  "trace_id": "8a3f12ab-4d2a-9f51-7e2c6d8a9101",
  "data": { ... }
}

Responses also include a response header:

X-Loxily-Trace-Id: 8a3f12ab-...

Error

{
  "success": false,
  "code": 401,
  "msg": "Invalid sign",
  "trace_id": "...",
  "data": null
}

Error Codes

Code	Description
400	Invalid request parameters / missing signature headers / non-JSON body
401	Signature verification failed or timestamp expired (outside 5-minute window)
403	App Secret not configured
404	Invalid App Key
413	Body / remote file too large
422	Business validation failed (e.g. language not in project config)
500	Internal server error
502	Downstream (workflow / storage) trigger failed