HTTP status map
| Status | Typical cause | What to do |
|---|---|---|
| 401 | Missing/invalid Bearer API key | Create a Cloud zk_ key or Gateway API key; do not use session cookies |
| 402 | Cloud wallet empty (hosted plans) | Top up or confirm Free starter credit; BYOK skips wallet debit |
| 403 | License required, plan entitlement, or policy deny | Activate .lic on Gateway; check Cloud plan / governance policy |
| 429 | Rate limited | Back off; check Gateway pool/RPM limits |
| 502 | Upstream provider failure | Check provider keys, health, and Gateway routing |
Health vs ready
- /healthz — process is serving; always 200 when up.
- Gateway /readyz — 503 until licensed; then structured readiness.
- Cloud /readyz — dependency readiness for the issuer/cloud process.
Support
Include the request ID from error responses, the surface (Cloud vs Gateway), base URL you configured, and whether model was auto, a BYOK namespaced id, or a pool alias. Never send raw API keys.