Wasl API Error Codes: Causes and How to Fix Them

A complete reference for all eight Wasl API error codes — what triggers each one and the exact steps to resolve it in your integration.

When a Wasl API request cannot be completed, the response body contains a structured error object rather than a success payload. Every error response sets status to false, includes a numeric code that identifies the specific failure, and provides a human-readable description in the error field. Use the code value — not the description text — to drive any error-handling logic in your integration, as description wording may change between API versions.

A typical error response looks like this:

{
  "status": false,
  "code": 10002,
  "error": "No Card Data Found"
}

---

Error Code Reference

The table below lists all error codes returned by the Wasl API, along with a brief description of what each one means.

Code	Description
10000	Incorrect Token Access
10001	Error while Processing the request
10002	No Card Data Found
10003	Improper Way for Calling API - Method
10005	Card ID Missing
10006	Insufficient Balance
10007	Username missing
10008	Password missing

---

Troubleshooting by Error Code

Expand any error code below for a detailed explanation of what causes it and the steps you should take to resolve it.

10000 — Incorrect Token Access

What it means: The Bearer token you included in the Authorization header is missing, malformed, or has expired. The API cannot verify your identity, so the request is rejected before any processing occurs.

How to fix:

1. Re-authenticate by sending a fresh POST /api-service/card/login request with your user_name and password.
2. Extract the new token from the login response.
3. Update the Authorization: Bearer <token> header in your request and retry.

Build token refresh logic into your integration so that a 10000 response automatically triggers a re-login and retries the original request, rather than surfacing an error to the end user.

10001 — Error while Processing the Request

What it means: Payzah’s servers encountered an unexpected condition while handling your request. This is a server-side error and is not caused by a problem with your request format or credentials.

How to fix:

1. Wait a few seconds, then retry the same request — transient server errors often resolve on the next attempt.
2. If the error persists after two or three retries, contact Payzah support with the full request details (endpoint, timestamp, and any request ID returned in the response) so the issue can be investigated.

Implement exponential back-off in your retry logic rather than hammering the API in rapid succession, which may delay recovery.

10002 — No Card Data Found

What it means: The card identifier or vendor identifier you supplied does not match any record in your account’s card catalog. This can happen if the card_id or vendor_id is mistyped, belongs to a different merchant account, or references a card type that has not been enabled for your account.

How to fix:

1. Query your available card catalog to retrieve the correct identifiers for the cards in your account.
2. Verify that the card_id or vendor_id in your request exactly matches a value returned by the catalog endpoint — identifiers are case-sensitive.
3. If the card type you expect to see is not in your catalog, contact Payzah to request access to that card type.

10003 — Improper Way for Calling API - Method

What it means: You used the wrong HTTP method for the endpoint you are calling. For example, you sent a GET request to an endpoint that only accepts POST, or vice versa.

How to fix:

1. Check the API reference for the endpoint you are targeting and confirm the required HTTP method (e.g., GET, POST).
2. Update your request to use the correct method and retry.

Some HTTP clients silently follow redirects and change the method from POST to GET. If you are using a redirect-following client, ensure it preserves the original method.

10005 — Card ID Missing

What it means: Your request body is missing the required card_id field. This field is mandatory for any endpoint that operates on a specific card.

How to fix:

1. Add the card_id field to your JSON request body before retrying.
2. Double-check that the field name is exactly card_id — not cardId, card_ID, or any other variation.

A correctly formed request body looks like this:

{
  "card_id": "your_card_id_here"
}

10006 — Insufficient Balance

What it means: Your account does not have enough balance to fulfill the requested order. The total cost of the cards you are trying to purchase exceeds your current available balance.

How to fix:

1. Query your account balance before placing large orders to confirm you have sufficient funds.
2. Reduce the quantity of cards in your order so the total cost falls within your available balance.
3. Alternatively, choose a lower-denomination card type to stay within your balance.
4. If you need to top up your account balance, contact Payzah to arrange a deposit.

Add a pre-order balance check to your integration workflow to catch this error before it reaches the API, providing a better experience for your team or end users.

10007 — Username Missing

What it means: You called the login endpoint without including the user_name field in the request body. Authentication cannot proceed without a username.

How to fix:

1. Add the user_name field to your login request body.
2. Ensure the field is spelled exactly as user_name (with an underscore).

A correctly formed login request looks like this:

{
  "user_name": "your_username",
  "password": "your_password"
}

10008 — Password Missing

What it means: You called the login endpoint without including the password field in the request body. Authentication cannot proceed without a password.

How to fix:

1. Add the password field to your login request body.
2. Ensure the field is spelled exactly as password.

A correctly formed login request looks like this:

{
  "user_name": "your_username",
  "password": "your_password"
}

Never hard-code your password directly in your application source code. Store it in an environment variable or a secrets manager and read it at runtime.