All API errors are JSON with an error string and optional details.
{
"error": "invalid_token"
}
signed_download.php returns 403 if the contract is not fully signed.mail() in this add-on. If you need SMTP/Resend/SendGrid, adapt api_send_mail() only.