# Gateway error codes

What the Gateway returns when something is wrong, and what each one means for you.

| Code | Meaning | What to do |
|---|---|---|
| **401** | No token, or an invalid one | The device may be revoked or its session expired — sign in again in the Endpoint Suite |
| **403** | The token lacks `gateway:invoke` | Grant the scope, or use a credential that has it |
| **409** | Ambiguous provider key — the model is in more than one key's enabled-models list | Make the model lists disjoint on **Providers** |
| **424** | No provider key configured for this request | Add a matching key on **Providers**, or move the tool to subscription mode |

## Upstream errors

Errors from the AI provider itself are passed through unchanged and appear in **Activity**
with the **Upstream error** outcome. Rate limits, provider outages and model deprecations
all arrive this way. The provider's own message tells you which.

## Blocked is not an error

A request stopped by your policy is not a failure of the Gateway. It shows in Activity as
**Blocked**, with the rule that stopped it in the Signals column. If a developer reports
"an error", check the outcome column before assuming something is broken — it may be
working exactly as configured.

## Revocation timing

Revoking a device, or a device session expiring, takes effect within roughly 30 seconds
rather than instantly. The Gateway notices at the next token refresh.