Gateway error codes

What the Gateway returns when something is wrong, and what each one means for you.

Code	Meaning	What to do
401	No token, or an invalid one	The device may be revoked or its session expired — sign in again in the Endpoint Suite
403	The token lacks `gateway:invoke`	Grant the scope, or use a credential that has it
409	Ambiguous provider key — the model is in more than one key's enabled-models list	Make the model lists disjoint on Providers
424	No provider key configured for this request	Add a matching key on Providers, or move the tool to subscription mode

Upstream errors

Errors from the AI provider itself are passed through unchanged and appear in Activity with the Upstream error outcome. Rate limits, provider outages and model deprecations all arrive this way. The provider's own message tells you which.

Long requests

Some intermediaries — load balancers, corporate proxies, CDNs — close a connection that has been silent for a couple of minutes, and a long agent turn over a large context can take that long before the provider says anything. So when the provider has not started answering after about 20 seconds, the Gateway starts the response itself and keeps the connection alive (comment frames for a streamed request, whitespace for a JSON one) until the provider speaks.

The consequence to know about: for those requests the status code has already been sent as 200 before the outcome is known. If the provider then fails, the failure arrives inside the response — an error event in a stream, or the provider's error object as the JSON body — rather than as a status code. The audit record always keeps the provider's real status, so trust Activity and the SIEM export over what a client logged.

The Gateway also ends an exchange that has clearly died: a provider that has not started answering after 5 minutes, or a response that goes completely silent for 90 seconds, is closed with 504. A slow response that is still sending anything — including the providers' own keep-alive pings — is never cut.

Blocked is not an error

A request stopped by your policy is not a failure of the Gateway. It shows in Activity as Blocked, with the rule that stopped it in the Signals column. If a developer reports "an error", check the outcome column before assuming something is broken — it may be working exactly as configured.

Revocation timing

Revoking a device, or a device session expiring, takes effect within roughly 30 seconds rather than instantly. The Gateway notices at the next token refresh.