What belongs in a useful API error response?

Keep a stable machine-readable code separate from the human-readable message. Include only context the client needs to correct or trace the request, and avoid echoing secrets or raw input. The status code should match the failure category; clients shouldn't need to parse prose to decide what to do.