diff --git a/src/boxerror.js b/src/boxerror.js
index 991dd582f..55c051ad0 100644
--- a/src/boxerror.js
+++ b/src/boxerror.js
@@ -3,6 +3,7 @@
 'use strict';
 
 const assert = require('assert'),
+    HttpError = require('connect-lastmile').HttpError,
     util = require('util'),
     _ = require('underscore');
 
@@ -67,4 +68,30 @@ BoxError.prototype.setMessage = function (message) {
     assert.strictEqual(typeof message, 'string');
 
     this.message = message;
-};
\ No newline at end of file
+};
+
+// this is a class method for now in case error is not a BoxError
+BoxError.toHttpError = function (error) {
+    switch (error.reason) {
+    case BoxError.BAD_FIELD:
+        return new HttpError(400, error);
+    case BoxError.LICENSE_ERROR:
+        return new HttpError(402, error);
+    case BoxError.NOT_FOUND:
+        return new HttpError(404, error);
+    case BoxError.ALREADY_EXISTS:
+    case BoxError.BAD_STATE:
+    case BoxError.CONFLICT:
+        return new HttpError(409, error);
+    case BoxError.INVALID_CREDENTIALS:
+        return new HttpError(412, error);
+    case BoxError.EXTERNAL_ERROR:
+    case BoxError.NETWORK_ERROR:
+    case BoxError.FS_ERROR:
+        return new HttpError(424, error);
+    case BoxError.DATABASE_ERROR:
+    case BoxError.INTERNAL_ERROR:
+    default:
+        return new HttpError(500, error);
+    }
+};
diff --git a/src/routes/apps.js b/src/routes/apps.js
index 26a698acd..beae0b699 100644
--- a/src/routes/apps.js
+++ b/src/routes/apps.js
@@ -52,32 +52,11 @@ var apps = require('../apps.js'),
     util = require('util'),
     WebSocket = require('ws');
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.ALREADY_EXISTS:
-    case BoxError.BAD_STATE:
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.LICENSE_ERROR:
-        return new HttpError(402, error);
-    case BoxError.EXTERNAL_ERROR:
-    case BoxError.NETWORK_ERROR:
-    case BoxError.FS_ERROR:
-        return new HttpError(424, error);
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function getApp(req, res, next) {
     assert.strictEqual(typeof req.params.id, 'string');
 
     apps.get(req.params.id, function (error, app) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, apps.removeInternalFields(app)));
     });
@@ -87,7 +66,7 @@ function getApps(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
     apps.getAllByUser(req.user, function (error, allApps) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         allApps = allApps.map(apps.removeRestrictedFields);
 
@@ -99,7 +78,7 @@ function getAppIcon(req, res, next) {
     assert.strictEqual(typeof req.params.id, 'string');
 
     apps.getIconPath(req.params.id, { original: req.query.original }, function (error, iconPath) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.sendFile(iconPath);
     });
@@ -155,7 +134,7 @@ function installApp(req, res, next) {
     debug('Installing app :%j', data);
 
     apps.install(data, req.user, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { id: result.id, taskId: result.taskId }));
     });
@@ -168,7 +147,7 @@ function setAccessRestriction(req, res, next) {
     if (typeof req.body.accessRestriction !== 'object') return next(new HttpError(400, 'accessRestriction must be an object'));
 
     apps.setAccessRestriction(req.params.id, req.body.accessRestriction, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -181,7 +160,7 @@ function setLabel(req, res, next) {
     if (typeof req.body.label !== 'string') return next(new HttpError(400, 'label must be a string'));
 
     apps.setLabel(req.params.id, req.body.label, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -195,7 +174,7 @@ function setTags(req, res, next) {
     if (req.body.tags.some((t) => typeof t !== 'string')) return next(new HttpError(400, 'tags array must contain strings'));
 
     apps.setTags(req.params.id, req.body.tags, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -208,7 +187,7 @@ function setIcon(req, res, next) {
     if (req.body.icon !== null && typeof req.body.icon !== 'string') return next(new HttpError(400, 'icon is null or a base-64 image string'));
 
     apps.setIcon(req.params.id, req.body.icon, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -221,7 +200,7 @@ function setMemoryLimit(req, res, next) {
     if (typeof req.body.memoryLimit !== 'number') return next(new HttpError(400, 'memoryLimit is not a number'));
 
     apps.setMemoryLimit(req.params.id, req.body.memoryLimit, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -234,7 +213,7 @@ function setAutomaticBackup(req, res, next) {
     if (typeof req.body.enable !== 'boolean') return next(new HttpError(400, 'enable must be a boolean'));
 
     apps.setAutomaticBackup(req.params.id, req.body.enable, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -247,7 +226,7 @@ function setAutomaticUpdate(req, res, next) {
     if (typeof req.body.enable !== 'boolean') return next(new HttpError(400, 'enable must be a boolean'));
 
     apps.setAutomaticUpdate(req.params.id, req.body.enable, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -262,7 +241,7 @@ function setReverseProxyConfig(req, res, next) {
     if (req.body.csp !== null && typeof req.body.csp !== 'string') return next(new HttpError(400, 'csp is not a string'));
 
     apps.setReverseProxyConfig(req.params.id, req.body, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -278,7 +257,7 @@ function setCertificate(req, res, next) {
     if (!req.body.cert && req.body.key) return next(new HttpError(400, 'cert must be provided'));
 
     apps.setCertificate(req.params.id, req.body, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -292,7 +271,7 @@ function setEnvironment(req, res, next) {
     if (Object.keys(req.body.env).some((key) => typeof req.body.env[key] !== 'string')) return next(new HttpError(400, 'env must contain values as strings'));
 
     apps.setEnvironment(req.params.id, req.body.env, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -305,7 +284,7 @@ function setDebugMode(req, res, next) {
     if (req.body.debugMode !== null && typeof req.body.debugMode !== 'object') return next(new HttpError(400, 'debugMode must be an object'));
 
     apps.setDebugMode(req.params.id, req.body.debugMode, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -318,7 +297,7 @@ function setMailbox(req, res, next) {
     if (req.body.mailboxName !== null && typeof req.body.mailboxName !== 'string') return next(new HttpError(400, 'mailboxName must be a string'));
 
     apps.setMailbox(req.params.id, req.body.mailboxName, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -342,7 +321,7 @@ function setLocation(req, res, next) {
     if ('overwriteDns' in req.body && typeof req.body.overwriteDns !== 'boolean') return next(new HttpError(400, 'overwriteDns must be boolean'));
 
     apps.setLocation(req.params.id, req.body, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -355,7 +334,7 @@ function setDataDir(req, res, next) {
     if (req.body.dataDir !== null && typeof req.body.dataDir !== 'string') return next(new HttpError(400, 'dataDir must be a string'));
 
     apps.setDataDir(req.params.id, req.body.dataDir, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -383,7 +362,7 @@ function repairApp(req, res, next) {
     if ('overwriteDns' in req.body && typeof req.body.overwriteDns !== 'boolean') return next(new HttpError(400, 'overwriteDns must be boolean'));
 
     apps.repair(req.params.id, data, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -401,7 +380,7 @@ function restoreApp(req, res, next) {
     if (data.backupId !== null && typeof data.backupId !== 'string') return next(new HttpError(400, 'backupId must be string or null'));
 
     apps.restore(req.params.id, data, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -419,7 +398,7 @@ function importApp(req, res, next) {
     if (typeof data.backupFormat !== 'string') return next(new HttpError(400, 'backupFormat must be string'));
 
     apps.importApp(req.params.id, data, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -441,7 +420,7 @@ function cloneApp(req, res, next) {
     if ('overwriteDns' in req.body && typeof req.body.overwriteDns !== 'boolean') return next(new HttpError(400, 'overwriteDns must be boolean'));
 
     apps.clone(req.params.id, data, req.user, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, { id: result.id, taskId: result.taskId }));
     });
@@ -453,7 +432,7 @@ function backupApp(req, res, next) {
     debug('Backup app id:%s', req.params.id);
 
     apps.backup(req.params.id, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -465,7 +444,7 @@ function uninstallApp(req, res, next) {
     debug('Uninstalling app id:%s', req.params.id);
 
     apps.uninstall(req.params.id, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -477,7 +456,7 @@ function startApp(req, res, next) {
     debug('Start app id:%s', req.params.id);
 
     apps.start(req.params.id, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -489,7 +468,7 @@ function stopApp(req, res, next) {
     debug('Stop app id:%s', req.params.id);
 
     apps.stop(req.params.id, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -512,7 +491,7 @@ function updateApp(req, res, next) {
     debug('Update app id:%s to manifest:%j', req.params.id, data.manifest);
 
     apps.update(req.params.id, req.body, auditSource.fromRequest(req), function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));
     });
@@ -538,7 +517,7 @@ function getLogStream(req, res, next) {
     };
 
     apps.getLogs(req.params.id, options, function (error, logStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.writeHead(200, {
             'Content-Type': 'text/event-stream',
@@ -573,7 +552,7 @@ function getLogs(req, res, next) {
     };
 
     apps.getLogs(req.params.id, options, function (error, logStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.writeHead(200, {
             'Content-Type': 'application/x-logs',
@@ -627,7 +606,7 @@ function exec(req, res, next) {
     var tty = req.query.tty === 'true' ? true : false;
 
     apps.exec(req.params.id, { cmd: cmd, rows: rows, columns: columns, tty: tty }, function (error, duplexStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         if (req.headers['upgrade'] !== 'tcp') return next(new HttpError(404, 'exec requires TCP upgrade'));
 
@@ -667,7 +646,7 @@ function execWebSocket(req, res, next) {
     var tty = req.query.tty === 'true' ? true : false;
 
     apps.exec(req.params.id, { cmd: cmd, rows: rows, columns: columns, tty: tty }, function (error, duplexStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         debug('Connected to terminal');
 
@@ -707,7 +686,7 @@ function listBackups(req, res, next) {
     if (!perPage || perPage < 0) return next(new HttpError(400, 'per_page query param has to be a postive number'));
 
     apps.listBackups(page, perPage, req.params.id, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { backups: result }));
     });
@@ -722,7 +701,7 @@ function uploadFile(req, res, next) {
     if (!req.files.file) return next(new HttpError(400, 'file must be provided as multipart'));
 
     apps.uploadFile(req.params.id, req.files.file.path, req.query.file, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         debug('uploadFile: done');
 
@@ -738,7 +717,7 @@ function downloadFile(req, res, next) {
     if (typeof req.query.file !== 'string' || !req.query.file) return next(new HttpError(400, 'file query argument must be provided'));
 
     apps.downloadFile(req.params.id, req.query.file, function (error, stream, info) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         var headers = {
             'Content-Type': 'application/octet-stream',
diff --git a/src/routes/appstore.js b/src/routes/appstore.js
index 15d89ef7b..345c5f5d7 100644
--- a/src/routes/appstore.js
+++ b/src/routes/appstore.js
@@ -16,28 +16,6 @@ var appstore = require('../appstore.js'),
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess;
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.LICENSE_ERROR:
-    case BoxError.INVALID_CREDENTIALS:
-        return new HttpError(402, error);
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.ALREADY_EXISTS:
-    case BoxError.CONFLICT:
-        return new HttpError(409, error);
-    case BoxError.ACCESS_DENIED:
-        return new HttpError(412, error);
-    case BoxError.EXTERNAL_ERROR:
-    case BoxError.NETWORK_ERROR:
-    case BoxError.FS_ERROR:
-        return new HttpError(424, error);
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function isAppAllowed(appstoreId) {
     if (custom.spec().appstore.blacklist.includes(appstoreId)) return false;
 
@@ -49,7 +27,7 @@ function isAppAllowed(appstoreId) {
 
 function getApps(req, res, next) {
     appstore.getApps(function (error, apps) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         let filteredApps = apps.filter((app) => !custom.spec().appstore.blacklist.includes(app.id));
         if (custom.spec().appstore.whitelist) filteredApps = filteredApps.filter((app) => app.id in custom.spec().appstore.whitelist);
@@ -64,7 +42,7 @@ function getApp(req, res, next) {
     if (!isAppAllowed(req.params.appstoreId)) return next(new HttpError(405, 'feature disabled by admin'));
 
     appstore.getApp(req.params.appstoreId, function (error, app) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, app));
     });
@@ -77,7 +55,7 @@ function getAppVersion(req, res, next) {
     if (!isAppAllowed(req.params.appstoreId)) return next(new HttpError(405, 'feature disabled by admin'));
 
     appstore.getAppVersion(req.params.appstoreId, req.params.versionId, function (error, manifest) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, manifest));
     });
@@ -92,7 +70,7 @@ function registerCloudron(req, res, next) {
     if (typeof req.body.signup !== 'boolean') return next(new HttpError(400, 'signup must be a boolean'));
 
     appstore.registerWithLoginCredentials(req.body, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, {}));
     });
@@ -102,7 +80,7 @@ function getSubscription(req, res, next) {
     assert.strictEqual(typeof req.body, 'object');
 
     appstore.getSubscription(function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, result)); // { email, cloudronId, plan, cancel_at, status }
     });
diff --git a/src/routes/backups.js b/src/routes/backups.js
index d8a19317c..14af246f4 100644
--- a/src/routes/backups.js
+++ b/src/routes/backups.js
@@ -13,23 +13,6 @@ let auditSource = require('../auditsource.js'),
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess;
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.BAD_STATE:
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.EXTERNAL_ERROR:
-        return new HttpError(424, error);
-    case BoxError.INTERNAL_ERROR:
-    case BoxError.DATABASE_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function list(req, res, next) {
     var page = typeof req.query.page !== 'undefined' ? parseInt(req.query.page) : 1;
     if (!page || page < 0) return next(new HttpError(400, 'page query param has to be a postive number'));
@@ -38,7 +21,7 @@ function list(req, res, next) {
     if (!perPage || perPage < 0) return next(new HttpError(400, 'per_page query param has to be a postive number'));
 
     backups.getByStatePaged(backupdb.BACKUP_STATE_NORMAL, page, perPage, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { backups: result }));
     });
@@ -46,7 +29,7 @@ function list(req, res, next) {
 
 function startBackup(req, res, next) {
     backups.startBackupTask(auditSource.fromRequest(req), function (error, taskId) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId }));
     });
@@ -54,7 +37,7 @@ function startBackup(req, res, next) {
 
 function cleanup(req, res, next) {
     backups.startCleanupTask(auditSource.fromRequest(req), function (error, taskId) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId }));
     });
diff --git a/src/routes/clients.js b/src/routes/clients.js
index 112518284..1bbe23254 100644
--- a/src/routes/clients.js
+++ b/src/routes/clients.js
@@ -19,18 +19,6 @@ var assert = require('assert'),
     HttpSuccess = require('connect-lastmile').HttpSuccess,
     validUrl = require('valid-url');
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function add(req, res, next) {
     var data = req.body;
 
@@ -41,7 +29,7 @@ function add(req, res, next) {
     if (!validUrl.isWebUri(data.redirectURI)) return next(new HttpError(400, 'redirectURI must be a valid uri'));
 
     clients.add(data.appId, clients.TYPE_EXTERNAL, data.redirectURI, data.scope, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, result));
     });
@@ -51,7 +39,7 @@ function get(req, res, next) {
     assert.strictEqual(typeof req.params.clientId, 'string');
 
     clients.get(req.params.clientId, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, result));
     });
@@ -61,13 +49,13 @@ function del(req, res, next) {
     assert.strictEqual(typeof req.params.clientId, 'string');
 
     clients.get(req.params.clientId, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         // we do not allow to use the REST API to delete addon clients
         if (result.type !== clients.TYPE_EXTERNAL) return next(new HttpError(405, 'Deleting app addon clients is not allowed.'));
 
         clients.del(req.params.clientId, function (error, result) {
-            if (error) return next(toHttpError(error));
+            if (error) return next(BoxError.toHttpError(error));
 
             next(new HttpSuccess(204, result));
         });
@@ -76,7 +64,7 @@ function del(req, res, next) {
 
 function getAll(req, res, next) {
     clients.getAll(function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { clients: result }));
     });
@@ -93,7 +81,7 @@ function addToken(req, res, next) {
     if ('name' in req.body && typeof req.body.name !== 'string') return next(new HttpError(400, 'name must be a string'));
 
     clients.addTokenByUserId(req.params.clientId, req.user.id, expiresAt, { name: req.body.name || '' }, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, { token: result }));
     });
@@ -104,7 +92,7 @@ function getTokens(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
     clients.getTokensByUserId(req.params.clientId, req.user.id, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         result = result.map(clients.removeTokenPrivateFields);
 
@@ -117,7 +105,7 @@ function delTokens(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
     clients.delTokensByUserId(req.params.clientId, req.user.id, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -129,7 +117,7 @@ function delToken(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
     clients.delToken(req.params.clientId, req.params.tokenId, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
diff --git a/src/routes/cloudron.js b/src/routes/cloudron.js
index 2a6521e81..e1ca57ccf 100644
--- a/src/routes/cloudron.js
+++ b/src/routes/cloudron.js
@@ -29,19 +29,6 @@ let assert = require('assert'),
     updater = require('../updater.js'),
     updateChecker = require('../updatechecker.js');
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.BAD_STATE:
-        return new HttpError(409, error);
-    case BoxError.DATABASE_ERROR:
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function reboot(req, res, next) {
     // Finish the request, to let the appstore know we triggered the reboot
     next(new HttpSuccess(202, {}));
@@ -51,7 +38,7 @@ function reboot(req, res, next) {
 
 function isRebootRequired(req, res, next) {
     cloudron.isRebootRequired(function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { rebootRequired: result }));
     });
@@ -59,7 +46,7 @@ function isRebootRequired(req, res, next) {
 
 function getConfig(req, res, next) {
     cloudron.getConfig(function (error, cloudronConfig) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, cloudronConfig));
     });
@@ -67,7 +54,7 @@ function getConfig(req, res, next) {
 
 function getDisks(req, res, next) {
     disks.getDisks(function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, result));
     });
@@ -115,7 +102,7 @@ function getLogs(req, res, next) {
     };
 
     cloudron.getLogs(req.params.unit, options, function (error, logStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.writeHead(200, {
             'Content-Type': 'application/x-logs',
@@ -144,7 +131,7 @@ function getLogStream(req, res, next) {
     };
 
     cloudron.getLogs(req.params.unit, options, function (error, logStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.writeHead(200, {
             'Content-Type': 'text/event-stream',
@@ -170,7 +157,7 @@ function setDashboardAndMailDomain(req, res, next) {
     if (!custom.spec().domains.changeDashboardDomain) return next(new HttpError(405, 'feature disabled by admin'));
 
     cloudron.setDashboardAndMailDomain(req.body.domain, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204, {}));
     });
@@ -182,7 +169,7 @@ function prepareDashboardDomain(req, res, next) {
     if (!custom.spec().domains.changeDashboardDomain) return next(new HttpError(405, 'feature disabled by admin'));
 
     cloudron.prepareDashboardDomain(req.body.domain, auditSource.fromRequest(req), function (error, taskId) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId }));
     });
@@ -190,7 +177,7 @@ function prepareDashboardDomain(req, res, next) {
 
 function renewCerts(req, res, next) {
     cloudron.renewCerts({ domain: req.body.domain || null }, auditSource.fromRequest(req), function (error, taskId) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId }));
     });
diff --git a/src/routes/domains.js b/src/routes/domains.js
index c0c28d329..6a5e7acfe 100644
--- a/src/routes/domains.js
+++ b/src/routes/domains.js
@@ -19,27 +19,11 @@ var assert = require('assert'),
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess;
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND: //
-        return new HttpError(404, error);
-    case BoxError.ALREADY_EXISTS: //
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD: //
-        return new HttpError(400, error);
-    case BoxError.EXTERNAL_ERROR: //
-        return new HttpError(424, error);
-    case BoxError.DATABASE_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function verifyDomainLock(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
 
     domains.get(req.params.domain, function (error, domain) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         if (domain.locked) return next(new HttpError(423, 'This domain is locked'));
 
@@ -83,7 +67,7 @@ function add(req, res, next) {
     };
 
     domains.add(req.body.domain, data, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, { domain: req.body.domain, config: req.body.config }));
     });
@@ -93,7 +77,7 @@ function get(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
 
     domains.get(req.params.domain, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, domains.removePrivateFields(result)));
     });
@@ -145,7 +129,7 @@ function update(req, res, next) {
     };
 
     domains.update(req.params.domain, data, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204, {}));
     });
@@ -155,7 +139,7 @@ function del(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
 
     domains.del(req.params.domain, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -171,7 +155,7 @@ function checkDnsRecords(req, res, next) {
 
     domains.checkDnsRecords(req.query.subdomain, req.params.domain, function (error, result) {
         if (error && error.reason === BoxError.ACCESS_DENIED) return next(new HttpSuccess(200, { error: { reason: error.reason, message: error.message }}));
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { needsOverwrite: result.needsOverwrite }));
     });
diff --git a/src/routes/eventlog.js b/src/routes/eventlog.js
index 9032ebf07..a779bc613 100644
--- a/src/routes/eventlog.js
+++ b/src/routes/eventlog.js
@@ -10,19 +10,9 @@ var BoxError = require('../boxerror.js'),
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess;
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.DATABASE_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function get(req, res, next) {
     eventlog.get(req.params.eventId, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { event: result }));
     });
@@ -43,7 +33,7 @@ function list(req, res, next) {
     if (req.query.action) actions.push(req.query.action);
 
     eventlog.getAllPaged(actions, req.query.search || null, page, perPage, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { eventlogs: result }));
     });
diff --git a/src/routes/groups.js b/src/routes/groups.js
index 81604e161..650b6a131 100644
--- a/src/routes/groups.js
+++ b/src/routes/groups.js
@@ -15,27 +15,13 @@ var assert = require('assert'),
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess;
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.ALREADY_EXISTS:
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function create(req, res, next) {
     assert.strictEqual(typeof req.body, 'object');
 
     if (typeof req.body.name !== 'string') return next(new HttpError(400, 'name must be string'));
 
     groups.create(req.body.name, function (error, group) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         var groupInfo = {
             id: group.id,
@@ -50,7 +36,7 @@ function get(req, res, next) {
     assert.strictEqual(typeof req.params.groupId, 'string');
 
     groups.getWithMembers(req.params.groupId, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, result));
     });
@@ -63,7 +49,7 @@ function update(req, res, next) {
     if ('name' in req.body && typeof req.body.name !== 'string') return next(new HttpError(400, 'name must be a string'));
 
     groups.update(req.params.groupId, req.body, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { }));
     });
@@ -76,7 +62,7 @@ function updateMembers(req, res, next) {
     if (!Array.isArray(req.body.userIds)) return next(new HttpError(404, 'userIds must be an array'));
 
     groups.setMembers(req.params.groupId, req.body.userIds, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { }));
     });
@@ -84,7 +70,7 @@ function updateMembers(req, res, next) {
 
 function list(req, res, next) {
     groups.getAll(function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { groups: result }));
     });
@@ -94,7 +80,7 @@ function remove(req, res, next) {
     assert.strictEqual(typeof req.params.groupId, 'string');
 
     groups.remove(req.params.groupId, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
diff --git a/src/routes/mail.js b/src/routes/mail.js
index e895be0d0..d8d4ab420 100644
--- a/src/routes/mail.js
+++ b/src/routes/mail.js
@@ -45,28 +45,11 @@ var assert = require('assert'),
 
 var mailProxy = middleware.proxy(url.parse('http://127.0.0.1:2020'));
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.ALREADY_EXISTS:
-    case BoxError.CONFLICT:
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.EXTERNAL_ERROR:
-        return new HttpError(424, error);
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function getDomain(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
 
     mail.getDomain(req.params.domain, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, mail.removePrivateFields(result)));
     });
@@ -78,7 +61,7 @@ function addDomain(req, res, next) {
     if (typeof req.body.domain !== 'string') return next(new HttpError(400, 'domain must be a string'));
 
     mail.addDomain(req.body.domain, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, { domain: req.body.domain }));
     });
@@ -106,7 +89,7 @@ function setDnsRecords(req, res, next) {
     req.clearTimeout();
 
     mail.setDnsRecords(req.params.domain, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201));
     });
@@ -116,7 +99,7 @@ function removeDomain(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
 
     mail.removeDomain(req.params.domain, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -129,7 +112,7 @@ function getStatus(req, res, next) {
     req.clearTimeout();
 
     mail.getStatus(req.params.domain, function (error, records) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, records));
     });
@@ -142,7 +125,7 @@ function setMailFromValidation(req, res, next) {
     if (typeof req.body.enabled !== 'boolean') return next(new HttpError(400, 'enabled is required'));
 
     mail.setMailFromValidation(req.params.domain, req.body.enabled, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202));
     });
@@ -160,7 +143,7 @@ function setCatchAllAddress(req, res, next) {
     }
 
     mail.setCatchAllAddress(req.params.domain, req.body.addresses, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202));
     });
@@ -178,7 +161,7 @@ function setMailRelay(req, res, next) {
     if ('acceptSelfSignedCerts' in req.body && typeof req.body.acceptSelfSignedCerts !== 'boolean') return next(new HttpError(400, 'acceptSelfSignedCerts must be a boolean'));
 
     mail.setMailRelay(req.params.domain, req.body, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202));
     });
@@ -191,7 +174,7 @@ function setMailEnabled(req, res, next) {
     if (typeof req.body.enabled !== 'boolean') return next(new HttpError(400, 'enabled is required'));
 
     mail.setMailEnabled(req.params.domain, !!req.body.enabled, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202));
     });
@@ -204,7 +187,7 @@ function sendTestMail(req, res, next) {
     if (!req.body.to || typeof req.body.to !== 'string') return next(new HttpError(400, 'to must be a non-empty string'));
 
     mail.sendTestMail(req.params.domain, req.body.to, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202));
     });
@@ -220,7 +203,7 @@ function listMailboxes(req, res, next) {
     if (!perPage || perPage < 0) return next(new HttpError(400, 'per_page query param has to be a postive number'));
 
     mail.listMailboxes(req.params.domain, page, perPage, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { mailboxes: result }));
     });
@@ -231,7 +214,7 @@ function getMailbox(req, res, next) {
     assert.strictEqual(typeof req.params.name, 'string');
 
     mail.getMailbox(req.params.name, req.params.domain, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { mailbox: result }));
     });
@@ -244,7 +227,7 @@ function addMailbox(req, res, next) {
     if (typeof req.body.userId !== 'string') return next(new HttpError(400, 'userId must be a string'));
 
     mail.addMailbox(req.body.name, req.params.domain, req.body.userId, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, {}));
     });
@@ -257,7 +240,7 @@ function updateMailbox(req, res, next) {
     if (typeof req.body.userId !== 'string') return next(new HttpError(400, 'userId must be a string'));
 
     mail.updateMailboxOwner(req.params.name, req.params.domain, req.body.userId, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -268,7 +251,7 @@ function removeMailbox(req, res, next) {
     assert.strictEqual(typeof req.params.name, 'string');
 
     mail.removeMailbox(req.params.name, req.params.domain, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, {}));
     });
@@ -284,7 +267,7 @@ function listAliases(req, res, next) {
     if (!perPage || perPage < 0) return next(new HttpError(400, 'per_page query param has to be a postive number'));
 
     mail.listAliases(req.params.domain, page, perPage, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { aliases: result }));
     });
@@ -295,7 +278,7 @@ function getAliases(req, res, next) {
     assert.strictEqual(typeof req.params.name, 'string');
 
     mail.getAliases(req.params.name, req.params.domain, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { aliases: result }));
     });
@@ -313,7 +296,7 @@ function setAliases(req, res, next) {
     }
 
     mail.setAliases(req.params.name, req.params.domain, req.body.aliases, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202));
     });
@@ -323,7 +306,7 @@ function getLists(req, res, next) {
     assert.strictEqual(typeof req.params.domain, 'string');
 
     mail.getLists(req.params.domain, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { lists: result }));
     });
@@ -334,7 +317,7 @@ function getList(req, res, next) {
     assert.strictEqual(typeof req.params.name, 'string');
 
     mail.getList(req.params.domain, req.params.name, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { list: result }));
     });
@@ -353,7 +336,7 @@ function addList(req, res, next) {
     }
 
     mail.addList(req.body.name, req.params.domain, req.body.members, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, {}));
     });
@@ -371,7 +354,7 @@ function updateList(req, res, next) {
     }
 
     mail.updateList(req.params.name, req.params.domain, req.body.members, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -382,7 +365,7 @@ function removeList(req, res, next) {
     assert.strictEqual(typeof req.params.name, 'string');
 
     mail.removeList(req.params.name, req.params.domain, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
diff --git a/src/routes/notifications.js b/src/routes/notifications.js
index a4a1ed8ab..5b4185b33 100644
--- a/src/routes/notifications.js
+++ b/src/routes/notifications.js
@@ -13,21 +13,11 @@ let assert = require('assert'),
     HttpSuccess = require('connect-lastmile').HttpSuccess,
     notifications = require('../notifications.js');
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.DATABASE_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function verifyOwnership(req, res, next) {
     if (!req.params.notificationId) return next();  // skip for listing
 
     notifications.get(req.params.notificationId, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         if (result.userId !== req.user.id) return next(new HttpError(403, 'User is not owner'));
 
@@ -55,7 +45,7 @@ function list(req, res, next) {
     else if (req.query.acknowledged) acknowledged = req.query.acknowledged === 'true' ? true : false;
 
     notifications.getAllPaged(req.user.id, acknowledged, page, perPage, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { notifications: result }));
     });
@@ -65,7 +55,7 @@ function ack(req, res, next) {
     assert.strictEqual(typeof req.params.notificationId, 'string');
 
     notifications.ack(req.params.notificationId, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204, {}));
     });
diff --git a/src/routes/profile.js b/src/routes/profile.js
index 26bad9585..e3cca1b59 100644
--- a/src/routes/profile.js
+++ b/src/routes/profile.js
@@ -17,24 +17,6 @@ var assert = require('assert'),
     users = require('../users.js'),
     _ = require('underscore');
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.ALREADY_EXISTS:
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.EXTERNAL_ERROR:
-        return new HttpError(424, error);
-    case BoxError.INVALID_CREDENTIALS:
-        return new HttpError(412, error);
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function get(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
@@ -61,7 +43,7 @@ function update(req, res, next) {
     var data = _.pick(req.body, 'email', 'fallbackEmail', 'displayName');
 
     users.update(req.user.id, data, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -74,7 +56,7 @@ function changePassword(req, res, next) {
     if (typeof req.body.newPassword !== 'string') return next(new HttpError(400, 'newPassword must be a string'));
 
     users.setPassword(req.user.id, req.body.newPassword, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -84,7 +66,7 @@ function setTwoFactorAuthenticationSecret(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
     users.setTwoFactorAuthenticationSecret(req.user.id, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, { secret: result.secret, qrcode: result.qrcode }));
     });
@@ -97,7 +79,7 @@ function enableTwoFactorAuthentication(req, res, next) {
     if (!req.body.totpToken || typeof req.body.totpToken !== 'string') return next(new HttpError(400, 'totpToken must be a nonempty string'));
 
     users.enableTwoFactorAuthentication(req.user.id, req.body.totpToken, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, {}));
     });
@@ -107,7 +89,7 @@ function disableTwoFactorAuthentication(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
     users.disableTwoFactorAuthentication(req.user.id, function (error) {
-        if (error) return next(new HttpError(500, error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, {}));
     });
diff --git a/src/routes/provision.js b/src/routes/provision.js
index b8772ac3f..36d09fc9b 100644
--- a/src/routes/provision.js
+++ b/src/routes/provision.js
@@ -18,22 +18,6 @@ var assert = require('assert'),
     sysinfo = require('../sysinfo.js'),
     superagent = require('superagent');
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.EXTERNAL_ERROR:
-        return new HttpError(424, error);
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.CONFLICT:
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function providerTokenAuth(req, res, next) {
     assert.strictEqual(typeof req.body, 'object');
 
@@ -75,7 +59,7 @@ function setup(req, res, next) {
     req.clearTimeout();
 
     provision.setup(dnsConfig, req.body.backupConfig || null, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -98,7 +82,7 @@ function activate(req, res, next) {
     debug('activate: username:%s ip:%s', username, ip);
 
     provision.activate(username, password, email, displayName, ip, auditSource.fromRequest(req), function (error, info) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(201, info));
     });
@@ -119,7 +103,7 @@ function restore(req, res, next) {
     if (typeof req.body.version !== 'string') return next(new HttpError(400, 'version must be a string'));
 
     provision.restore(backupConfig, req.body.backupId, req.body.version, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -127,7 +111,7 @@ function restore(req, res, next) {
 
 function getStatus(req, res, next) {
     provision.getStatus(function (error, status) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, status));
     });
diff --git a/src/routes/services.js b/src/routes/services.js
index 12f921733..297227100 100644
--- a/src/routes/services.js
+++ b/src/routes/services.js
@@ -16,20 +16,11 @@ var addons = require('../addons.js'),
     HttpError = require('connect-lastmile').HttpError,
     HttpSuccess = require('connect-lastmile').HttpSuccess;
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function getAll(req, res, next) {
     req.clearTimeout(); // can take a while to get status of all services
 
     addons.getServices(function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { services: result }));
     });
@@ -39,7 +30,7 @@ function get(req, res, next) {
     assert.strictEqual(typeof req.params.service, 'string');
 
     addons.getService(req.params.service, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { service: result }));
     });
@@ -56,7 +47,7 @@ function configure(req, res, next) {
     };
 
     addons.configureService(req.params.service, data, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, {}));
     });
@@ -77,7 +68,7 @@ function getLogs(req, res, next) {
     };
 
     addons.getServiceLogs(req.params.service, options, function (error, logStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.writeHead(200, {
             'Content-Type': 'application/x-logs',
@@ -109,7 +100,7 @@ function getLogStream(req, res, next) {
     };
 
     addons.getServiceLogs(req.params.service, options, function (error, logStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.writeHead(200, {
             'Content-Type': 'text/event-stream',
@@ -135,7 +126,7 @@ function restart(req, res, next) {
     debug(`Restarting service ${req.params.service}`);
 
     addons.restartService(req.params.service, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, {}));
     });
diff --git a/src/routes/settings.js b/src/routes/settings.js
index 177119353..9cc3d3bb1 100644
--- a/src/routes/settings.js
+++ b/src/routes/settings.js
@@ -17,24 +17,9 @@ var assert = require('assert'),
     safe = require('safetydance'),
     settings = require('../settings.js');
 
-function toHttpError(appError) {
-    switch (appError.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, appError);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, appError);
-    case BoxError.EXTERNAL_ERROR:
-        return new HttpError(424, appError);
-    case BoxError.INTERNAL_ERROR:
-    case BoxError.DATABASE_ERROR:
-    default:
-        return new HttpError(500, appError);
-    }
-}
-
 function getAppAutoupdatePattern(req, res, next) {
     settings.getAppAutoupdatePattern(function (error, pattern) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { pattern: pattern }));
     });
@@ -46,7 +31,7 @@ function setAppAutoupdatePattern(req, res, next) {
     if (typeof req.body.pattern !== 'string') return next(new HttpError(400, 'pattern is required'));
 
     settings.setAppAutoupdatePattern(req.body.pattern, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -54,7 +39,7 @@ function setAppAutoupdatePattern(req, res, next) {
 
 function getBoxAutoupdatePattern(req, res, next) {
     settings.getBoxAutoupdatePattern(function (error, pattern) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { pattern: pattern }));
     });
@@ -66,7 +51,7 @@ function setBoxAutoupdatePattern(req, res, next) {
     if (typeof req.body.pattern !== 'string') return next(new HttpError(400, 'pattern is required'));
 
     settings.setBoxAutoupdatePattern(req.body.pattern, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -78,7 +63,7 @@ function setCloudronName(req, res, next) {
     if (typeof req.body.name !== 'string') return next(new HttpError(400, 'name is required'));
 
     settings.setCloudronName(req.body.name, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, {}));
     });
@@ -86,7 +71,7 @@ function setCloudronName(req, res, next) {
 
 function getCloudronName(req, res, next) {
     settings.getCloudronName(function (error, name) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { name: name }));
     });
@@ -94,7 +79,7 @@ function getCloudronName(req, res, next) {
 
 function getTimeZone(req, res, next) {
     settings.getTimeZone(function (error, tz) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { timeZone: tz }));
     });
@@ -106,7 +91,7 @@ function setTimeZone(req, res, next) {
     if (typeof req.body.timeZone !== 'string') return next(new HttpError(400, 'timeZone is required'));
 
     settings.setTimeZone(req.body.timeZone, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -119,7 +104,7 @@ function setCloudronAvatar(req, res, next) {
     var avatar = safe.fs.readFileSync(req.files.avatar.path);
 
     settings.setCloudronAvatar(avatar, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, {}));
     });
@@ -127,7 +112,7 @@ function setCloudronAvatar(req, res, next) {
 
 function getCloudronAvatar(req, res, next) {
     settings.getCloudronAvatar(function (error, avatar) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         // avoid caching the avatar on the client to see avatar changes immediately
         res.set('Cache-Control', 'no-cache');
@@ -139,7 +124,7 @@ function getCloudronAvatar(req, res, next) {
 
 function getBackupConfig(req, res, next) {
     settings.getBackupConfig(function (error, backupConfig) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         // always send provider as it is used by the UI to figure if backups are disabled ('noop' backend)
         if (!custom.spec().backups.configurable) {
@@ -170,7 +155,7 @@ function setBackupConfig(req, res, next) {
     req.clearTimeout();
 
     settings.setBackupConfig(req.body, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -178,7 +163,7 @@ function setBackupConfig(req, res, next) {
 
 function getPlatformConfig(req, res, next) {
     settings.getPlatformConfig(function (error, config) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, config));
     });
@@ -196,7 +181,7 @@ function setPlatformConfig(req, res, next) {
     }
 
     settings.setPlatformConfig(req.body, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -204,7 +189,7 @@ function setPlatformConfig(req, res, next) {
 
 function getExternalLdapConfig(req, res, next) {
     settings.getExternalLdapConfig(function (error, config) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, config));
     });
@@ -221,7 +206,7 @@ function setExternalLdapConfig(req, res, next) {
     if ('bindPassword' in req.body && typeof req.body.bindPassword !== 'string') return next(new HttpError(400, 'bindPassword must be a string'));
 
     settings.setExternalLdapConfig(req.body, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -229,7 +214,7 @@ function setExternalLdapConfig(req, res, next) {
 
 function getDynamicDnsConfig(req, res, next) {
     settings.getDynamicDnsConfig(function (error, enabled) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { enabled: enabled }));
     });
@@ -243,7 +228,7 @@ function setDynamicDnsConfig(req, res, next) {
     if (typeof req.body.enabled !== 'boolean') return next(new HttpError(400, 'enabled boolean is required'));
 
     settings.setDynamicDnsConfig(req.body.enabled, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -251,7 +236,7 @@ function setDynamicDnsConfig(req, res, next) {
 
 function getUnstableAppsConfig(req, res, next) {
     settings.getUnstableAppsConfig(function (error, enabled) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { enabled: enabled }));
     });
@@ -263,7 +248,7 @@ function setUnstableAppsConfig(req, res, next) {
     if (typeof req.body.enabled !== 'boolean') return next(new HttpError(400, 'enabled boolean is required'));
 
     settings.setUnstableAppsConfig(req.body.enabled, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, {}));
     });
@@ -271,7 +256,7 @@ function setUnstableAppsConfig(req, res, next) {
 
 function getRegistryConfig(req, res, next) {
     settings.getRegistryConfig(function (error, registryConfig) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, docker.removePrivateFields(registryConfig)));
     });
@@ -286,7 +271,7 @@ function setRegistryConfig(req, res, next) {
     if ('password' in req.body && typeof req.body.password !== 'string') return next(new HttpError(400, 'password is required'));
 
     settings.setRegistryConfig(req.body, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200));
     });
diff --git a/src/routes/support.js b/src/routes/support.js
index 5426f592b..5787ea663 100644
--- a/src/routes/support.js
+++ b/src/routes/support.js
@@ -44,7 +44,7 @@ function enableRemoteSupport(req, res, next) {
     if (typeof req.body.enable !== 'boolean') return next(new HttpError(400, 'enabled is required'));
 
     support.enableRemoteSupport(req.body.enable, function (error) {
-        if (error) return next(new HttpError(500, error));
+        if (error) return next(new HttpError(503, 'Error enabling remote support. Try running "cloudron-support --enable-ssh" on the server'));
 
         next(new HttpSuccess(202, {}));
     });
diff --git a/src/routes/tasks.js b/src/routes/tasks.js
index c1a36dd7f..784c777d4 100644
--- a/src/routes/tasks.js
+++ b/src/routes/tasks.js
@@ -15,25 +15,11 @@ let assert = require('assert'),
     HttpSuccess = require('connect-lastmile').HttpSuccess,
     tasks = require('../tasks.js');
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.BAD_STATE:
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.DATABASE_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function stopTask(req, res, next) {
     assert.strictEqual(typeof req.params.taskId, 'string');
 
     tasks.stopTask(req.params.taskId, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204, {}));
     });
@@ -43,7 +29,7 @@ function get(req, res, next) {
     assert.strictEqual(typeof req.params.taskId, 'string');
 
     tasks.get(req.params.taskId, function (error, task) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, tasks.removePrivateFields(task)));
     });
@@ -59,7 +45,7 @@ function list(req, res, next) {
     if (req.query.type && typeof req.query.type !== 'string') return next(new HttpError(400, 'type must be a string'));
 
     tasks.listByTypePaged(req.query.type || null, page, perPage, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         result = result.map(tasks.removePrivateFields);
 
@@ -80,7 +66,7 @@ function getLogs(req, res, next) {
     };
 
     tasks.getLogs(req.params.taskId, options, function (error, logStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.writeHead(200, {
             'Content-Type': 'application/x-logs',
@@ -110,7 +96,7 @@ function getLogStream(req, res, next) {
     };
 
     tasks.getLogs(req.params.taskId, options, function (error, logStream) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         res.writeHead(200, {
             'Content-Type': 'text/event-stream',
diff --git a/src/routes/users.js b/src/routes/users.js
index 97c65678b..518c5651f 100644
--- a/src/routes/users.js
+++ b/src/routes/users.js
@@ -20,25 +20,6 @@ var assert = require('assert'),
     HttpSuccess = require('connect-lastmile').HttpSuccess,
     users = require('../users.js');
 
-function toHttpError(error) {
-    switch (error.reason) {
-    case BoxError.NOT_FOUND:
-        return new HttpError(404, error);
-    case BoxError.ALREADY_EXISTS:
-    case BoxError.CONFLICT:
-        return new HttpError(409, error);
-    case BoxError.BAD_FIELD:
-        return new HttpError(400, error);
-    case BoxError.EXTERNAL_ERROR:
-        return new HttpError(424, error);
-    case BoxError.INVALID_CREDENTIALS:
-        return new HttpError(412, error);
-    case BoxError.INTERNAL_ERROR:
-    default:
-        return new HttpError(500, error);
-    }
-}
-
 function create(req, res, next) {
     assert.strictEqual(typeof req.body, 'object');
 
@@ -54,7 +35,7 @@ function create(req, res, next) {
     var displayName = req.body.displayName || '';
 
     users.create(username, password, email, displayName, { invitor: req.user, admin: req.body.admin }, auditSource.fromRequest(req), function (error, user) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         var userInfo = {
             id: user.id,
@@ -89,7 +70,7 @@ function update(req, res, next) {
     if ('active' in req.body && typeof req.body.active !== 'boolean') return next(new HttpError(400, 'active must be a boolean'));
 
     users.update(req.params.userId, req.body, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -105,7 +86,7 @@ function list(req, res, next) {
     if (req.query.search && typeof req.query.search !== 'string') return next(new HttpError(400, 'search must be a string'));
 
     users.getAllPaged(req.query.search || null, page, perPage, function (error, results) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         results = results.map(users.removeRestrictedFields);
 
@@ -118,7 +99,7 @@ function get(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
     users.get(req.params.userId, function (error, result) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, users.removePrivateFields(result)));
     });
@@ -130,7 +111,7 @@ function remove(req, res, next) {
     if (req.user.id === req.params.userId) return next(new HttpError(409, 'Not allowed to remove yourself.'));
 
     users.remove(req.params.userId, auditSource.fromRequest(req), function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -144,7 +125,7 @@ function verifyPassword(req, res, next) {
     if (typeof req.body.password !== 'string') return next(new HttpError(400, 'API call requires user password'));
 
     users.verifyWithUsername(req.user.username, req.body.password, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         req.body.password = '<redacted>'; // this will prevent logs from displaying plain text password
 
@@ -156,7 +137,7 @@ function createInvite(req, res, next) {
     assert.strictEqual(typeof req.params.userId, 'string');
 
     users.createInvite(req.params.userId, function (error, resetToken) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { resetToken: resetToken }));
     });
@@ -166,7 +147,7 @@ function sendInvite(req, res, next) {
     assert.strictEqual(typeof req.params.userId, 'string');
 
     users.sendInvite(req.params.userId, { invitor: req.user }, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(200, { }));
     });
@@ -179,7 +160,7 @@ function setGroups(req, res, next) {
     if (!Array.isArray(req.body.groupIds)) return next(new HttpError(400, 'API call requires a groups array.'));
 
     users.setMembership(req.params.userId, req.body.groupIds, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });
@@ -192,7 +173,7 @@ function changePassword(req, res, next) {
     if (typeof req.body.password !== 'string') return next(new HttpError(400, 'password must be a string'));
 
     users.setPassword(req.params.userId, req.body.password, function (error) {
-        if (error) return next(toHttpError(error));
+        if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(204));
     });