> For the complete documentation index, see [llms.txt](https://docs.nexusglobalpayments.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexusglobalpayments.org/nexus-payments-apis/connectivity.md).

# Connectivity

Connectivity checks the IPSO calls on Nexus: a lightweight heartbeat (liveness) and an end-to-end health check that exercises every security control. The IPSO API exposes the mirror endpoints so that Nexus can check connectivity to the IPSO.

## Heartbeat - confirm that Nexus is reachable

> Lightweight liveness check that the IPSO calls to confirm that Nexus is reachable over the established VPN tunnel and able to answer HTTP requests. A successful call proves the full connection path to Nexus: private DNS resolution of the hostname, the BGP-learned route through the IPsec tunnel, TLS 1.3 with mutual TLS, validation of the certificate-bound access token, and that the Nexus service is up. The request has no body; it is signed per RFC 9421 over its method, authority, path and query, and the 200 response is signed by the responder, so a successful call also proves that both parties' signing keys and clocks are aligned. The mirror endpoint is hosted by the IPSO, so either party can verify connectivity to the other. Suitable for continuous monitoring.\
> \
> \---\
> \
> \#### Response validation rules\
> \
> \*\*200 OK\*\* — the body MUST conform to the response schema below. Response objects are open: additional properties may be introduced in later minor versions, and clients MUST ignore properties they do not recognise.\
> \
> \| Field | Type | Presence | Nullable | Constraints |\
> \|---|---|---|---|---|\
> \| \`status\` | string | Required | N | one of \`UP\` |\
> \| \`timestamp\` | string | Required | N | format \`date-time\` |\
> \
> \*\*Cross-field rules\*\*\
> \
> \- \`status\` is always \`UP\` on HTTP 200; an unavailable service is reported by a non-2xx status or no response.\
> \- \`timestamp\` is the responder's current time in UTC (\`Z\` suffix, no offset).\
> \
> \*\*Response signature\*\* — every 200 response carries \`Signature-Input\` and \`Signature\` and \`Content-Digest\` per the Nexus HTTP Message Signature Profile v1, signed by the responding server. The client MUST verify the response signature before using the response and MUST discard a response that fails verification.\
> \
> \*\*Error responses (4xx/5xx with a body)\*\* — the body MUST conform to \`ErrorApiResponse\`: \`statusCode\` = \`RJCT\`; \`reasonCode\` matches \`^\[A-Z]{2}\[0-9]{3}$\`; \`name\` is UPPER\_SNAKE\_CASE (≤ 50); \`description\` ≤ 500 characters and MUST NOT contain PII. \`reasonCode\` values for this operation: \`AE001\`, \`AE002\`, \`AE003\`, \`AE005\`, \`AE006\`, \`AE004\`, \`TE099\`. Gateway errors (405, 429, 502, 503, 504) carry no body.

```json
{"openapi":"3.1.0","info":{"title":"Nexus Payments API","version":"v1"},"tags":[{"name":"Connectivity","description":"Connectivity checks the IPSO calls on Nexus: a lightweight heartbeat (liveness) and an end-to-end health check that exercises every security control. The IPSO API exposes the mirror endpoints so that Nexus can check connectivity to the IPSO."}],"servers":[{"url":"https://{environment}.payments.nexus.net","description":"Nexus participant-facing API endpoint. Resolved via Nexus private DNS over the established IPsec IKEv2 tunnel and not reachable from the public Internet.","variables":{"environment":{"default":"prod","enum":["pat","prod"],"description":"Deployment environment subdomain."}}}],"security":[{"mutualTLS":[],"nexusOAuth":["connectivity.check"]}],"components":{"securitySchemes":{"mutualTLS":{"type":"mutualTLS","description":"Mutual TLS: the IPSO presents its X.509 client certificate on every connection, validated during the TLS handshake (fail-closed). The same certificate is the RFC 8705 binding anchor for the OAuth access token (see nexusOAuth)."}},"parameters":{"SignatureInputBodyless":{"name":"Signature-Input","in":"header","required":true,"description":"RFC 9421 signature metadata for a request without a body, per the Nexus HTTP Message Signature Profile v1 (RFC 9421, RFC 9530). One dictionary member labelled `nexus` whose covered components are exactly `\"@method\" \"@authority\" \"@path\" \"@query\"`, followed by `\"if-none-match\"` when that header is sent. `@query` is always covered; an empty query serialises as `?`, so query parameters cannot be added or removed undetected. Signature parameters, emitted in this order: `created` and `expires` (Unix seconds; `expires` = `created` + 300; the receiver rejects `created` more than ±5 minutes from its clock or a signature past `expires`), `keyid` (base64url SHA-256 thumbprint of the signer's signing public key, registered at onboarding; a missing, unknown, expired or revoked key id is rejected - never resolved to a default key), `alg` (always `rsa-pss-sha512`) and `tag` (always `nexus-v1`). The signature parameters are signed through the `@signature-params` line of the signature base. A missing, malformed or non-conforming value is rejected with AE005.","schema":{"type":"string","maxLength":512,"pattern":"^nexus=\\(\"@method\" \"@authority\" \"@path\" \"@query\"( \"if-none-match\")?\\);created=[0-9]{1,15};expires=[0-9]{1,15};keyid=\"[A-Za-z0-9_-]{43}\";alg=\"rsa-pss-sha512\";tag=\"nexus-v1\"$"}},"Signature":{"name":"Signature","in":"header","required":true,"description":"RFC 9421 signature value: one dictionary member labelled `nexus` holding an RFC 8941 byte sequence - the **standard base64** (not base64url) RSASSA-PSS signature using SHA-512 (`rsa-pss-sha512`), computed over the RFC 9421 signature base built from the components and parameters declared in `Signature-Input`. Produced with the sender's own signing private key; the receiver verifies it against the sender's registered signing public key resolved from `keyid`. With the minimum RSA-3072 key the signature is 384 bytes, i.e. 512 base64 characters. A missing, malformed or non-verifying signature is rejected with AE005.","schema":{"type":"string","minLength":520,"maxLength":1400,"pattern":"^nexus=:[A-Za-z0-9+/]+={0,2}:$"}}},"headers":{"ResponseSignatureInput":{"description":"RFC 9421 signature metadata for a GET response, per the Nexus HTTP Message Signature Profile v1 (RFC 9421, RFC 9530). Signed by the responding server with its own signing private key. Covered components: `\"@status\" \"content-type\" \"content-digest\"` on 200, or `\"@status\" \"etag\"` on 304, followed in both cases by the request-bound components `\"@method\";req \"@path\";req \"@query\";req`, which tie the response to the resource that was requested. Same `created`, `expires`, `keyid`, `alg` and `tag` rules as requests. The client MUST verify the response signature before using the response and MUST discard a response that fails verification.","required":true,"schema":{"type":"string","maxLength":512,"pattern":"^nexus=\\(\"@status\" (\"content-type\" \"content-digest\"|\"etag\") \"@method\";req \"@path\";req \"@query\";req\\);created=[0-9]{1,15};expires=[0-9]{1,15};keyid=\"[A-Za-z0-9_-]{43}\";alg=\"rsa-pss-sha512\";tag=\"nexus-v1\"$"}},"ResponseSignature":{"description":"RFC 9421 response signature: one dictionary member labelled `nexus` holding the standard base64 `rsa-pss-sha512` signature produced by the responding server over the signature base declared in the response `Signature-Input`. Verified by the client against the server's registered signing public key.","required":true,"schema":{"type":"string","minLength":520,"maxLength":1400,"pattern":"^nexus=:[A-Za-z0-9+/]+={0,2}:$"}},"ResponseContentDigest":{"description":"RFC 9530 SHA-512 digest of the exact response body bytes, covered by the response signature.","required":true,"schema":{"type":"string","pattern":"^sha-512=:[A-Za-z0-9+/]{86}==:$"}}},"schemas":{"HeartbeatResponse":{"type":"object","description":"Heartbeat result. Returned only with HTTP 200; an unavailable service is reported by a non-2xx status or no response.","properties":{"status":{"type":"string","enum":["UP"],"description":"Service state. Always UP on HTTP 200."},"timestamp":{"type":"string","format":"date-time","description":"Responder's current time, ISO 8601 UTC (no offset)."}},"required":["status","timestamp"]},"ErrorApiResponse":{"type":"object","description":"Standard structured rejection body. Returned for all non-2xx responses produced by the Nexus authentication layer or the application. Gateway level errors (405, 409, 413, 429, 502, 503, 504) do NOT carry this body.\n\n#### Validation rules\n\n- All four fields are required and never `null`.\n- `statusCode`: always `RJCT`.\n- `reasonCode`: 5 characters matching `^[A-Z]{2}[0-9]{3}$`; family prefix `TE` (technical), `AE` (authentication/authorisation, enforced at authentication) or `BE` (business); one of the values enumerated in the `reasonCode` schema.\n- `name`: UPPER_SNAKE_CASE, 1–50 characters; the name paired with `reasonCode` (e.g. `TE001` ↔ `INVALID_REQUEST`).\n- `description`: 1–500 characters; MUST NOT contain PII.\n- Gateway-level errors (405, 409, 413, 429, 502, 503, 504) do not carry this body.","properties":{"statusCode":{"type":"string","description":"Business-level status code. Always RJCT (Rejected) — the structured error body is only returned for rejection cases. Successful responses use HTTP status alone (200 OK for sync, 202 Accepted for async ingress) with no structured statusCode body.","enum":["RJCT"],"maxLength":4,"minLength":4},"reasonCode":{"type":"string","description":"Categorised reason code. Three families: TE (Technical Error, e.g. TE001/TE002/TE099), AE (Authentication / Authorization Error, AE001–AE006, enforced at authentication), BE (Business Error, BE001–BE031).","enum":["TE001","TE002","TE099","AE001","AE002","AE003","AE004","AE005","AE006","BE001","BE002","BE007","BE008","BE009","BE010","BE011","BE012","BE013","BE014","BE015","BE016","BE017","BE018","BE019","BE020","BE021","BE030","BE031"],"maxLength":5,"pattern":"^[A-Z]{2}[0-9]{3}$","minLength":5},"name":{"type":"string","description":"Machine-readable error name paired with the reason code.","maxLength":50,"pattern":"^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$","minLength":1},"description":{"type":"string","description":"Human-readable error description. MUST NOT contain PII.","maxLength":500,"minLength":1}},"required":["description","name","reasonCode","statusCode"]}}},"paths":{"/v1/connectivity/heartbeat":{"get":{"tags":["Connectivity"],"summary":"Heartbeat - confirm that Nexus is reachable","description":"Lightweight liveness check that the IPSO calls to confirm that Nexus is reachable over the established VPN tunnel and able to answer HTTP requests. A successful call proves the full connection path to Nexus: private DNS resolution of the hostname, the BGP-learned route through the IPsec tunnel, TLS 1.3 with mutual TLS, validation of the certificate-bound access token, and that the Nexus service is up. The request has no body; it is signed per RFC 9421 over its method, authority, path and query, and the 200 response is signed by the responder, so a successful call also proves that both parties' signing keys and clocks are aligned. The mirror endpoint is hosted by the IPSO, so either party can verify connectivity to the other. Suitable for continuous monitoring.\n\n---\n\n#### Response validation rules\n\n**200 OK** — the body MUST conform to the response schema below. Response objects are open: additional properties may be introduced in later minor versions, and clients MUST ignore properties they do not recognise.\n\n| Field | Type | Presence | Nullable | Constraints |\n|---|---|---|---|---|\n| `status` | string | Required | N | one of `UP` |\n| `timestamp` | string | Required | N | format `date-time` |\n\n**Cross-field rules**\n\n- `status` is always `UP` on HTTP 200; an unavailable service is reported by a non-2xx status or no response.\n- `timestamp` is the responder's current time in UTC (`Z` suffix, no offset).\n\n**Response signature** — every 200 response carries `Signature-Input` and `Signature` and `Content-Digest` per the Nexus HTTP Message Signature Profile v1, signed by the responding server. The client MUST verify the response signature before using the response and MUST discard a response that fails verification.\n\n**Error responses (4xx/5xx with a body)** — the body MUST conform to `ErrorApiResponse`: `statusCode` = `RJCT`; `reasonCode` matches `^[A-Z]{2}[0-9]{3}$`; `name` is UPPER_SNAKE_CASE (≤ 50); `description` ≤ 500 characters and MUST NOT contain PII. `reasonCode` values for this operation: `AE001`, `AE002`, `AE003`, `AE005`, `AE006`, `AE004`, `TE099`. Gateway errors (405, 429, 502, 503, 504) carry no body.","operationId":"getHeartbeat","parameters":[{"name":"Accept","in":"header","description":"*/*","required":true,"schema":{"type":"string","default":"*/*"}},{"$ref":"#/components/parameters/SignatureInputBodyless"},{"$ref":"#/components/parameters/Signature"}],"responses":{"200":{"description":"Nexus is reachable and the service is up.","headers":{"Cache-Control":{"description":"Connectivity responses must not be cached.","schema":{"type":"string"}},"Signature-Input":{"$ref":"#/components/headers/ResponseSignatureInput"},"Signature":{"$ref":"#/components/headers/ResponseSignature"},"Content-Digest":{"$ref":"#/components/headers/ResponseContentDigest"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HeartbeatResponse"}}}},"401":{"description":"Authentication failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorApiResponse"}}}},"403":{"description":"Access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorApiResponse"}}}},"405":{"description":"Method Not Allowed. The HTTP method is not supported for this endpoint. Use the correct HTTP method.","headers":{"Allow":{"description":"Permitted HTTP methods for this endpoint","schema":{"type":"string"}}}},"429":{"description":"Too Many Requests. Rate limit exceeded. The Retry-After header indicates when to retry. Back off and retry after the indicated duration.","headers":{"Retry-After":{"description":"Duration after which the caller may retry","schema":{"type":"string"}}}},"500":{"description":"Internal error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorApiResponse"}}}},"502":{"description":"Bad Gateway. The Nexus gateway received an invalid response from its upstream service. The connectivity check has failed."},"503":{"description":"Service Unavailable. The Nexus service is not available to process requests. The connectivity check has failed; this is how an unavailable service is reported (no DOWN status is returned with HTTP 200)."},"504":{"description":"Gateway Timeout. The Nexus upstream service did not respond within the gateway's timeout window. The connectivity check has failed."}}}}}}
```

## Health check - confirm end-to-end request processing by Nexus

> End-to-end connectivity check that the IPSO calls to confirm that Nexus can receive, authenticate, verify, validate and process a request. Unlike the heartbeat, the health check carries a request body and is subject to every control that applies to the ISO 20022 message exchange: mutual TLS, the certificate-bound OAuth 2.0 access token, and the RFC 9421 message signature (Signature-Input, Signature, Content-Digest), which Nexus verifies before processing against the IPSO's registered signing public key. These controls are mandatory, not optional, so a successful health check proves that the production security configuration is working. Nexus validates the message, echoes it in the response, and returns its current UTC time so that the IPSO can confirm clock alignment within the signature tolerance window. The health check is synchronous (HTTP 200), has no business effect and is not persisted as a payment message. The mirror endpoint is hosted by the IPSO.

```json
{"openapi":"3.1.0","info":{"title":"Nexus Payments API","version":"v1"},"tags":[{"name":"Connectivity","description":"Connectivity checks the IPSO calls on Nexus: a lightweight heartbeat (liveness) and an end-to-end health check that exercises every security control. The IPSO API exposes the mirror endpoints so that Nexus can check connectivity to the IPSO."}],"servers":[{"url":"https://{environment}.payments.nexus.net","description":"Nexus participant-facing API endpoint. Resolved via Nexus private DNS over the established IPsec IKEv2 tunnel and not reachable from the public Internet.","variables":{"environment":{"default":"prod","enum":["pat","prod"],"description":"Deployment environment subdomain."}}}],"security":[{"mutualTLS":[],"nexusOAuth":["connectivity.check"]}],"components":{"securitySchemes":{"mutualTLS":{"type":"mutualTLS","description":"Mutual TLS: the IPSO presents its X.509 client certificate on every connection, validated during the TLS handshake (fail-closed). The same certificate is the RFC 8705 binding anchor for the OAuth access token (see nexusOAuth)."}},"parameters":{"SignatureInputWithBody":{"name":"Signature-Input","in":"header","required":true,"description":"RFC 9421 signature metadata for a request with a body, per the Nexus HTTP Message Signature Profile v1 (RFC 9421, RFC 9530). One dictionary member labelled `nexus` whose covered components are exactly `\"@method\" \"@authority\" \"@path\" \"@query\" \"content-type\" \"content-digest\"`, so the body is bound to the signature through its `Content-Digest`. Signature parameters, emitted in this order: `created` and `expires` (Unix seconds; `expires` = `created` + 300; the receiver rejects `created` more than ±5 minutes from its clock or a signature past `expires`), `keyid` (base64url SHA-256 thumbprint of the signer's signing public key, registered at onboarding; a missing, unknown, expired or revoked key id is rejected - never resolved to a default key), `alg` (always `rsa-pss-sha512`) and `tag` (always `nexus-v1`). The signature parameters are signed through the `@signature-params` line of the signature base. A missing, malformed or non-conforming value is rejected with AE005.","schema":{"type":"string","maxLength":512,"pattern":"^nexus=\\(\"@method\" \"@authority\" \"@path\" \"@query\" \"content-type\" \"content-digest\"\\);created=[0-9]{1,15};expires=[0-9]{1,15};keyid=\"[A-Za-z0-9_-]{43}\";alg=\"rsa-pss-sha512\";tag=\"nexus-v1\"$"}},"Signature":{"name":"Signature","in":"header","required":true,"description":"RFC 9421 signature value: one dictionary member labelled `nexus` holding an RFC 8941 byte sequence - the **standard base64** (not base64url) RSASSA-PSS signature using SHA-512 (`rsa-pss-sha512`), computed over the RFC 9421 signature base built from the components and parameters declared in `Signature-Input`. Produced with the sender's own signing private key; the receiver verifies it against the sender's registered signing public key resolved from `keyid`. With the minimum RSA-3072 key the signature is 384 bytes, i.e. 512 base64 characters. A missing, malformed or non-verifying signature is rejected with AE005.","schema":{"type":"string","minLength":520,"maxLength":1400,"pattern":"^nexus=:[A-Za-z0-9+/]+={0,2}:$"}},"ContentDigest":{"name":"Content-Digest","in":"header","required":true,"description":"RFC 9530 digest of the exact request body bytes as sent: `sha-512=:<standard base64 SHA-512>:`. Covered by the signature. The receiver recomputes the digest over the received bytes and rejects a mismatch with AE005 before verifying the signature. Only `sha-512` is accepted.","schema":{"type":"string","pattern":"^sha-512=:[A-Za-z0-9+/]{86}==:$"}}},"schemas":{"HealthCheckRequest":{"type":"object","description":"Health check request.","properties":{"message":{"type":"string","minLength":1,"maxLength":30,"pattern":"^[a-zA-Z0-9 ]{1,30}$","description":"Caller-supplied message used to confirm that the request can be received, validated and processed. 1-30 characters; letters, digits and spaces only."}},"required":["message"],"additionalProperties":false},"HealthCheckResponse":{"type":"object","description":"Health check result. Returned only with HTTP 200; failures are reported by the corresponding non-2xx status.","properties":{"status":{"type":"string","enum":["SUCCESS"],"description":"Always SUCCESS on HTTP 200."},"message":{"type":"string","maxLength":30,"description":"The message received in the request, echoed unchanged."},"timestamp":{"type":"string","format":"date-time","description":"Responder's current time, ISO 8601 UTC (no offset), for clock-alignment checks against the signature tolerance window."}},"required":["status","message","timestamp"]},"ErrorApiResponse":{"type":"object","description":"Standard structured rejection body. Returned for all non-2xx responses produced by the Nexus authentication layer or the application. Gateway level errors (405, 409, 413, 429, 502, 503, 504) do NOT carry this body.\n\n#### Validation rules\n\n- All four fields are required and never `null`.\n- `statusCode`: always `RJCT`.\n- `reasonCode`: 5 characters matching `^[A-Z]{2}[0-9]{3}$`; family prefix `TE` (technical), `AE` (authentication/authorisation, enforced at authentication) or `BE` (business); one of the values enumerated in the `reasonCode` schema.\n- `name`: UPPER_SNAKE_CASE, 1–50 characters; the name paired with `reasonCode` (e.g. `TE001` ↔ `INVALID_REQUEST`).\n- `description`: 1–500 characters; MUST NOT contain PII.\n- Gateway-level errors (405, 409, 413, 429, 502, 503, 504) do not carry this body.","properties":{"statusCode":{"type":"string","description":"Business-level status code. Always RJCT (Rejected) — the structured error body is only returned for rejection cases. Successful responses use HTTP status alone (200 OK for sync, 202 Accepted for async ingress) with no structured statusCode body.","enum":["RJCT"],"maxLength":4,"minLength":4},"reasonCode":{"type":"string","description":"Categorised reason code. Three families: TE (Technical Error, e.g. TE001/TE002/TE099), AE (Authentication / Authorization Error, AE001–AE006, enforced at authentication), BE (Business Error, BE001–BE031).","enum":["TE001","TE002","TE099","AE001","AE002","AE003","AE004","AE005","AE006","BE001","BE002","BE007","BE008","BE009","BE010","BE011","BE012","BE013","BE014","BE015","BE016","BE017","BE018","BE019","BE020","BE021","BE030","BE031"],"maxLength":5,"pattern":"^[A-Z]{2}[0-9]{3}$","minLength":5},"name":{"type":"string","description":"Machine-readable error name paired with the reason code.","maxLength":50,"pattern":"^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$","minLength":1},"description":{"type":"string","description":"Human-readable error description. MUST NOT contain PII.","maxLength":500,"minLength":1}},"required":["description","name","reasonCode","statusCode"]}}},"paths":{"/v1/connectivity/health":{"post":{"tags":["Connectivity"],"summary":"Health check - confirm end-to-end request processing by Nexus","description":"End-to-end connectivity check that the IPSO calls to confirm that Nexus can receive, authenticate, verify, validate and process a request. Unlike the heartbeat, the health check carries a request body and is subject to every control that applies to the ISO 20022 message exchange: mutual TLS, the certificate-bound OAuth 2.0 access token, and the RFC 9421 message signature (Signature-Input, Signature, Content-Digest), which Nexus verifies before processing against the IPSO's registered signing public key. These controls are mandatory, not optional, so a successful health check proves that the production security configuration is working. Nexus validates the message, echoes it in the response, and returns its current UTC time so that the IPSO can confirm clock alignment within the signature tolerance window. The health check is synchronous (HTTP 200), has no business effect and is not persisted as a payment message. The mirror endpoint is hosted by the IPSO.","operationId":"checkHealth","parameters":[{"name":"Content-Type","in":"header","description":"application/json","required":true,"schema":{"type":"string"}},{"name":"Accept","in":"header","description":"*/*","required":true,"schema":{"type":"string","default":"*/*"}},{"$ref":"#/components/parameters/SignatureInputWithBody"},{"$ref":"#/components/parameters/Signature"},{"$ref":"#/components/parameters/ContentDigest"}],"requestBody":{"description":"Caller-supplied message used to confirm that the request can be received, validated and processed.","required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HealthCheckRequest"}}}},"responses":{"200":{"description":"The request was received, authenticated, signature-verified, validated and processed by Nexus.","headers":{"Cache-Control":{"description":"Connectivity responses must not be cached.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HealthCheckResponse"}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorApiResponse"}}}},"401":{"description":"Authentication failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorApiResponse"}}}},"403":{"description":"Access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorApiResponse"}}}},"405":{"description":"Method Not Allowed. The HTTP method is not supported for this endpoint. Use the correct HTTP method.","headers":{"Allow":{"description":"Permitted HTTP methods for this endpoint","schema":{"type":"string"}}}},"413":{"description":"Payload Too Large. The request body exceeds the Nexus gateway's maximum allowed size."},"415":{"description":"Unsupported Media Type. The Content-Type header does not match the media type this endpoint accepts (application/json)."},"429":{"description":"Too Many Requests. Rate limit exceeded. The Retry-After header indicates when to retry. Back off and retry after the indicated duration.","headers":{"Retry-After":{"description":"Duration after which the caller may retry","schema":{"type":"string"}}}},"500":{"description":"Internal error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorApiResponse"}}}},"502":{"description":"Bad Gateway. The Nexus gateway received an invalid response from its upstream service. The connectivity check has failed."},"503":{"description":"Service Unavailable. The Nexus service is not available to process requests. The connectivity check has failed; this is how an unavailable service is reported (no DOWN status is returned with HTTP 200)."},"504":{"description":"Gateway Timeout. The Nexus upstream service did not respond within the gateway's timeout window. The connectivity check has failed."}}}}}}
```