Tenant-scoped endpoints; signing secrets are never returned on reads.

Invalid request payload or query parameters.

Missing or invalid authentication credentials.

Caller lacks the required role/permission for the resource.

Resource does not exist or is not visible to the caller.

Request conflicts with current resource state (e.g. duplicate key, stale version).

Unexpected server error.