error message; the create call’s 503 also has a code. A 429 or 502 from the edge in front of the API may not be JSON, so read the status first and parse the body defensively.
401 Unauthorized: Missing or invalid Authorization header or Unauthorized: Invalid token; 402 Insufficient balance; 403 Session limit reached (concurrency) or Extensions API is not enabled for this account; 400 names the field, for example Unsupported timezone "Europe/Berlin" for country US. or windowSize must be WIDTHxHEIGHT with width 320–16384 and height 200–16384. Unknown fields in a body are a 400 too.
Status codes
The dedicated-IP codes here (
invalid_spec, dedicated_ip_not_owned, no_dedicated_ip, dedicated_ip_unhealthy) come back when proxyUrl names a dedicated:// address. The dashboard resolves the address before the create call, so Launch browser never returns them.Guidance for agents and automations
- Never loop on
402or403. Surface the message; a person has to act. 503is transient: start at theRetry-Afterof 2 seconds, grow with jitter, cap the attempts, then report. Retry504and500once.- After a
504nothing is running; no stop call needed. DELETEon an ended session still returns{ "success": true }. A404means the id was never a session of this workspace.