API returns 401 - Symmetry Docs

The CBS API returns HTTP 401 for every authentication and key problem (there is no 403). The body is { "message": "…" }.

Message	Cause	Fix
`No api key found`	The `pcc-api-key` header is missing or blank	Send your key in the header on every request (the root/listing endpoint requires it too).
`Invalid api key`	The key isn’t recognized	Double-check the value. Need one? See Getting support.
`Profile has been disabled`	The key is disabled	Contact Symmetry.
`Profile does not have access to this product`	The key isn’t entitled to CBS	Ask Symmetry to enable CBS for the key.
`Failed security check`	The request origin isn’t on the key’s allowed domains	Add your domain to the key, or call from an allowed origin.
`API rate limit has been exceeded.`	A trial key is over its cap	See Rate limit exceeded.

Validation problems are not 401. A bad or missing body field returns 400, and malformed JSON or an invalid state parameter returns 422. See Error codes and fixes.

Authentication details: Authentication model.