I've written a rest service in Salesforce. In some cases I wish to give clients a specific return code and error payload to give them call specific information regarding the error with a JSON response.

Here's the response I'm expecting (which I wrote):

   "message": "intermittent error please retry later"

Here's the response I'm seeing:

[ {
  "errorCode" : "INTERNAL_SERVER_ERROR",
  "message" : "Invalid status code for HTTP response: 550"
} ]

Where 550 is my custom return code. My custom return payload had been replaced with the array above. Should I be using a different error code which is not in the 5xx range? Can I add my payload to this array somehow? Should I return 200 and have clients look for any additional information in the return payload?

Many thanks in advance, Peter

  • You can do a 200 + your own custom response payload or a non-200 (but still legal in Salesforce universe status code) + your own custom response payload
    – identigral
    Mar 16, 2020 at 16:31
  • Most likely the issue is an exception is being thrown before your return, uncaught exceptions return a 500. Though I can't be 100% sure without seeing your source code. Mar 16, 2020 at 16:36
  • 2
    @ZachHutchins As stated in the previous answer (see close votes), Salesforce only allows a certain subset of values. The OP should be using 403 Forbidden to describe the fact that the action is not allowed, and that authenticating will not fix the problem.
    – sfdcfox
    Mar 16, 2020 at 16:52

1 Answer 1


See this SO answer on why 550 should not be used. The RFC for status codes says:

The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. A server that wishes to make public why the request has been forbidden can describe that reason in the response payload (if any).

If authentication credentials were provided in the request, the server considers them insufficient to grant access. The client SHOULD NOT automatically repeat the request with the same credentials. The client MAY repeat the request with new or different credentials. However, a request might be forbidden for reasons unrelated to the credentials.

As such, 403 would the the appropriate status code to use. The available status code you can use are listed in the documentation.

Not the answer you're looking for? Browse other questions tagged .