Errors

Use the HTTP status first. Bodies are not a single envelope: some routes return MessageException, others a validation array.

HTTP	Meaning
400	Validation or illegal state
401	Missing or expired `token`
403	Authenticated, but not allowed for that branch or case
404	Unknown application or applicant. Also used for invalid login credentials.
406	Payload does not meet submit-time rules
500	Unhandled server error

MessageException

{
  "Translations": [
    {
      "Text": "Application was not found",
      "XmlLang": "en"
    }
  ]
}

Typical 403/404 body. Show Text to the user; do not switch on the string, it is not a stable code.

ValidationException

[
  ["EmailAddress"],
  ["ShareOfRent"]
]

Typical 400 body: nested arrays of field names. There is no per-field reason code.

Authentication

POST /Authenticate returns 404 for invalid credentials, not 401.
403 on authenticate means the BOX user exists but is not activated.
POST /ReapitAuthenticate returns 400 for a bad JWT and 404 if the user is unknown.

Some 500 responses include ExceptionMessage, ExceptionType and StackTrace. Ignore them; they are diagnostic leftovers, not part of the contract.