Summer Every refusal from the Summer API or MCP server has a stable code, and every setup result uses the same small set of states. Events describe changes in your company without carrying secret values or message text.
Error codes
| Code | Meaning |
|---|---|
invalid_request (HTTP 400) | A path, query or body field is invalid. details.field names it. |
invalid_token (HTTP 401) | The access token is missing, expired, revoked or for a different Summer resource. Sign in again. |
insufficient_scope (HTTP 403) | The connection was not granted this permission. details.required_scope names it; authorize again and select it. |
approval_pending (HTTP 403) | The Summer team has not approved this account yet. |
access_blocked (HTTP 403) | Summer access is not available for this account. |
company_not_granted (HTTP 403) | The connection does not include this company. |
environment_not_granted (HTTP 403) | The connection does not include this environment. |
not_a_member (HTTP 403) | You are no longer a member of this company. |
admin_required (HTTP 403) | The operation needs a company owner or administrator. |
human_required (HTTP 403) | Only a signed-in person can do this in Summer. |
not_found (HTTP 404) | The resource does not exist in this company and environment. |
method_not_allowed (HTTP 405) | The path exists but not for this method. See the Allow header. |
version_conflict (HTTP 409) | The resource changed since you read it. Read it again and retry with the current version. |
idempotency_conflict (HTTP 422) | This Idempotency-Key was used for a different request. |
idempotency_in_progress (HTTP 409) | The first request with this key is still running. Retry shortly. |
outcome_uncertain (HTTP 409) | An earlier request with this key may or may not have taken effect. Read the current state before retrying with a new key. |
payload_too_large (HTTP 413) | The request body is too large. |
rate_limited (HTTP 429) | Too many requests. Wait for Retry-After seconds. |
unsupported (HTTP 422) | This capability is not available through the API yet. |
unavailable (HTTP 503) | Summer or a connected backend could not complete the request. details.reason or details.code explains why; details.definite: true means nothing changed. |
developer_platform_disabled (HTTP 404) | The developer platform is not enabled on this deployment. |
Unavailable reasons
| Reason | Meaning |
|---|---|
missing_scope | The connection lacks the permission. |
admin_required | Needs an owner or administrator. |
approval_pending | Account approval is pending. |
company_not_granted | The connection does not include the company. |
environment_not_granted | The connection does not include the environment. |
environment_not_served | This Summer deployment serves a different environment for this feature. |
operational_connection_pending | Summer has not finished this company's operations connection. |
case_data_not_admitted | Case data is not yet enabled for the API on this deployment. |
operations_source_external | This company's knowledge is managed in its connected operations workspace. |
messenger_backend_unavailable | Messenger is not configured for this deployment. |
credential_storage_unavailable | Credential storage is not configured. |
unsupported | Not available through the API yet. |
human_required | A signed-in person must do this in Summer. |
States
| State | Meaning |
|---|---|
saved | Stored in Summer. Not a provider check. |
verified | A supported live check passed for the current configuration. |
pending | Waiting for a person, a missing field or a permission. |
unavailable | Not possible here; see the reason. |
enabled | Live. |
disabled | Turned off. |
not_configured | Nothing is set up yet. |
failed | A check ran and failed; see the code. |
unsupported | Summer cannot check this yet. It has not passed. |
Error format
json
{
"error": {
"code": "version_conflict",
"message": "The resource changed. Read the current version and try again.",
"retryable": false,
"details": { "request_id": "…" }
},
"request_id": "6f0c…"
}Include request_id when you contact Summer support. Retry only when retryable is true, after Retry-After when present, and with the same Idempotency-Key. When a write returns outcome_uncertain, read the current state first; never repeat it blindly.
Event types
Events are read with GET /v1/companies/{company}/environments/{environment}/events?after=CURSOR or delivered to signed webhooks. Resume from next_cursor. Delivery is at least once, so deduplicate by event id. Company-wide events have a null environment.
| Type pattern | When |
|---|---|
credential.saved, credential.removed, credential.reveal_requested | A provider credential changed, or a person viewed one in Summer, in this environment. The event names the credential, never its value. |
doppler.saved, doppler.removed, integration.saved, integration.removed | The Doppler connection or a custom integration definition changed in this environment. |
messenger.installation.created, messenger.installation.updated, messenger.installation.key_rotated, messenger.installation.agent.configure | A website Messenger installation or its assistant settings changed in this environment. |
company.api.<operation> | A write made through the API or MCP, for example company.api.credentials.set. resource_id names the resource; the environment is set for environment-owned operations. |
company.knowledge.edited | A company knowledge document was edited. Company-wide. |
company.agent_connection.created, company.agent_connection.revoked | An agent connection to this company was approved or revoked. |
company.service_account.*, company.webhook.* | Automation was created, rotated, replayed or disabled. |
case.investigation.requested, case.actions.prepared | An investigation was requested, or a plan's work was prepared for human approval. |
company.<action> | Other company administration, such as settings and invitations. |
Webhook deliveries
Each delivery is a POST with a JSON body:
json
{
"id": "1042",
"type": "company.api.credentials.set",
"company": "COMPANY_ID",
"environment": "staging",
"resource_id": "STRIPE_READ_KEY",
"actor": "owner@example.com",
"data": {},
"created_at": "2026-10-20T07:30:00Z",
"delivery_attempt": 1
}Headers: Summer-Event-Id (the event id) and Summer-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body">. Verify the signature with the webhook secret before trusting the body, reject timestamps older than five minutes, and respond with any 2xx status within ten seconds. Failed deliveries retry with increasing delays, up to eight attempts. summer webhooks replay ID --after CURSOR sends earlier events again. See Automation for a verification example.