Invalid input. The code field names the reason:

• BAD_REQUEST — a missing or malformed id, a missing or malformed body, a body id mismatch, or a client-supplied id on POST.
• INVARIANT_VIOLATION — the request would break a domain rule, or a supplied property has no write target under the org's mapping configuration.
• INVALID_TRANSITION — a forbidden status transition.
• CLOSED_CASE_LOCKED — a mutation of a closed case.

The API raises an INVARIANT_VIOLATION before it writes any record, so a rejected request persists nothing.

Field-level security denial. The running user lacks CRUD or FLS on a required field, or a mapping names a field that does not exist. The message names the column. The response body carries no separate field list.

Resource not found — the supplied id does not resolve to a Theft record type

Server error, or an org configuration problem. The code field names the reason:

• RECORD_TYPE_MISSING — the Theft record type is missing on Investigation__c.
• INTERNAL_SERVER_ERROR — any other unexpected failure.