body property

The response body exactly as it arrived, when there was one.

code is the supported way to tell one failure from another; this is here for the cases it cannot cover - a reason a newer API added, or a validation error whose detail you need to show.

Treat it as untrusted and do not log it wholesale. An API is free to echo the request back in a validation error, so this may hold whatever was submitted - including a password. toString deliberately does not carry it, so logging the exception is safe by default; reaching for this field is the deliberate act of accepting that risk.