Errors and CORS

Handling errors

Every response from the API has a header called X-Cbx-Request-Id with a unique ID for your request. If a request responds with a status code in the 5xx range, we can debug the problem given that ID – so save it to make support easier.

HTTP/1.1 500 Internal Server Error
Content-Type: application/json
X-Cbx-Request-Id: 532c00918bfba

{"message":"Server error"}

Send support enquiries, including the request ID, to api@colourbox.com. See HTTP status codes for the codes the API returns.

CORS requests

The Skyfish API accepts CORS requests. It sends back an Access-Control-Allow-Origin header that matches the Origin header of the request. The exception is POST /signup, which only allows Skyfish and Colourbox’s own sites; other origins get https://www.colourbox.com back, so the browser blocks the response.

Every response exposes the X-Cbx-Request-Id header to the browser through Access-Control-Expose-Headers.

A preflight (OPTIONS) request gets 204 and these headers back, whatever the request asked for:

• Access-Control-Allow-Origin – matches the Origin header
• Access-Control-Allow-Methods – GET, POST, PUT, DELETE, OPTIONS, PATCH
• Access-Control-Allow-Headers – includes Content-Type and Authorization
• Access-Control-Allow-Credentials – true
• Access-Control-Max-Age

The API ignores the Access-Control-Request-Method and Access-Control-Request-Headers headers of the preflight request.