Diagnose API failures

Record the HTTP status, endpoint, timestamp, and a sanitized response body for every failed call. Do not log API keys, access tokens, full customer payloads, or webhook secrets.

Response strategy

422 is the only error response declared for the 21 reviewed operations. Its HTTPValidationError body contains a detail array; each item has loc, msg, and type fields.
Every operation page lists its complete artifact response map. If sandbox returns another status, treat it as undocumented: preserve sanitized evidence, do not assign a guessed Moneybag error code, and do not infer retry safety.

Escalation bundle

Provide the environment, endpoint, UTC timestamp, sanitized merchant order ID, HTTP status, and sanitized response body. Include a request or correlation identifier only when the actual response supplies one. Never send credentials or unredacted PII.