Gateway error codes
What the Gateway returns when something is wrong, and what each one means for you.
| Code | Meaning | What to do |
|---|---|---|
| 401 | No token, or an invalid one | The device may be revoked or its session expired — sign in again in the Endpoint Suite |
| 403 | The token lacks gateway:invoke |
Grant the scope, or use a credential that has it |
| 409 | Ambiguous provider key — the model is in more than one key's enabled-models list | Make the model lists disjoint on Providers |
| 424 | No provider key configured for this request | Add a matching key on Providers, or move the tool to subscription mode |
Upstream errors
Errors from the AI provider itself are passed through unchanged and appear in Activity with the Upstream error outcome. Rate limits, provider outages and model deprecations all arrive this way. The provider's own message tells you which.
Blocked is not an error
A request stopped by your policy is not a failure of the Gateway. It shows in Activity as Blocked, with the rule that stopped it in the Signals column. If a developer reports "an error", check the outcome column before assuming something is broken — it may be working exactly as configured.
Revocation timing
Revoking a device, or a device session expiring, takes effect within roughly 30 seconds rather than instantly. The Gateway notices at the next token refresh.