SSP response status
200 returns a single winning bid as application/json. Other business responses below have an empty body, not a JSON error object. Business responses carry Cache-Control: no-store. Errors do not echo credentials, DSP endpoints, or request bodies.
| Status | Meaning | Suggested action |
|---|---|---|
200 |
Valid winning bid | Parse a single seatbid / bid; outer price is net; notify against real events |
204 |
Normal no eligible bid | Not necessarily an outage: no route, DSP failures / no bids, all blocked, or no result within the budget |
400 |
Invalid / unsupported request, or a query on the business path | Fix fields, duplicate JSON keys, currency, auction type, and path before resending |
401 |
Unauthorized, disabled partner, or invalid credential | Check identity, audience, key, clock, and signature; no fallback to an old token |
404 |
Invalid business path | Use canonical /openrtb/{ssp_id} |
405 |
Correct path but method is not POST | Use POST |
408 |
Body did not finish within its remaining read budget | Investigate connection and upload speed; do not reuse the nonce |
409 |
This HMAC nonce is already registered in this process | Use a new nonce and signature for a new attempt; investigate duplicate sends |
413 |
Inbound request or rewritten downstream request exceeds the limit | Reduce body size and leave room for added fields; request limit is 256 KiB |
415 |
Not JSON, duplicate Content-Type, or unsupported content encoding | Use a single JSON media type and uncompressed body |
429 |
SSP per-instance QPS gate exceeded | Reduce rate and back off; this is not a cluster-wide quota claim |
503 |
Service or authentication / in-flight resources unavailable | Back off briefly and investigate through the agreed integration channel; avoid retry storms |
500 |
Internal orchestration or response invariant failure | Keep sanitized correlation details for investigation; avoid endless retries |
Connection rejection, header timeout, or disconnection before HTTP processing may produce no business response. Do not invent a G24ad 504 or 499 when no HTTP response was received.
DSP statuses and invalid responses
Only DSP HTTP 200 enters bid JSON validation. 204 is no-bid; other statuses and network, timeout, compression, size, or JSON failures leave that DSP without an eligible candidate. One bad DSP should not turn into SSP 500; other valid candidates can still win, and no remaining candidate normally produces 204.
An invalid overall response structure, currency, or request.id drops the whole DSP response. An individual bid’s invalid correlation, price, creative, or block-check result drops only that bid. See the field matrix.
Retrying is not replaying
Use a current timestamp, new random nonce, and new signature for every new attempt, even after 400, 408, 415, or no client-visible response. Authentication happens before body processing and may already have registered the previous nonce. Changing key ID cannot bypass nonce deduplication for the same SSP.
A network failure does not establish whether the original auction was processed. A new nonce addresses authentication replay, not business idempotency. Agree whether to retry the same impression opportunity and how to prevent duplicate rendering and notifications at the application level. Use bounded retries with backoff within the remaining opportunity deadline. Do not blindly retry 204 or uncorrected 4xx responses.
For investigation, share time, sanitized request ID, HTTP status, format, and approximate body size. Do not share secrets, complete signature headers, user identifiers, or full user-bearing bodies. See the launch checklist for preparation.
Protocol and implementation checked: 2026-09-21.