Errors

Unhandled exceptions and HttpException bodies are wrapped as:

{ "success": false, "error": { "code": "STRING", "message": "…", "requestId": "…", "timestamp": "ISO-8601", "details": {} } }

details is present only on some 4xx errors. X-Request-Id is always set on the response (generated if the client did not send x-request-id).

Unknown query/body fields are rejected (forbidNonWhitelisted). Validation failures use HTTP 400.