The plan.

The request has no valid access token. Get a new token from POST /login and send it as Authorization: Bearer <token>.

Codes: UNAUTHORIZED_NO_TOKEN (no Authorization header), UNAUTHORIZED_INVALID_TOKEN (expired or malformed token),
UNAUTHORIZED_NO_CONTEXT (the token does not belong to a payor or merchant), UNAUTHORIZED_NO_PAYOR (the token gives access
to more than one payor and the request did not send x-payor-id). A few endpoints answer from the API gateway instead and
return only {"message": "Unauthorized"}.

The token is valid but is not allowed to perform this operation.

Codes: FORBIDDEN_INSUFFICIENT_TAGS (your credential's role does not allow this operation), FORBIDDEN_CONDITION_NOT_MET
(the payment amount is above your approval limit). Some endpoints add their own codes; they are listed in the endpoint
description.

The resource does not exist in your account.