Error format
Status codes
Authorization errors
401 and 403 are distinct:
401means no valid session token was provided403means the token is valid but the user’s role doesn’t permit the action
401 should trigger a re-auth flow, while 403 is a permission issue that re-auth won’t fix.