Errors

Error reference

Code	Status	Message	Type
`AB01`	400	Request Validation Error	Client Error
`AB02`	404	Request Validation Error	Client Error
`AB03`	403	User not allowed to access the resource	Client Error
`AB04`	500	Internal Server Error	Server Error
`AB05`	401	Unauthorized access	Client Error
`AB06`	429	Rate limit exceeded	Client Error
`AB07`	409	Resource already exists	Client Error
`AB08`	404	Resource not found	Client Error
`AB09`	402	Subscription exhausted	Client Error

The four you will actually hit

AB05: Unauthorized access (401)

The request never got as far as being authorised. In order of likelihood:

A gateway API key was sent instead of an access token. The Admin API does not accept the key your applications use for inference. Obtain a Strata Cloud Manager access token instead.
The token expired. Access tokens last 15 minutes. Request a fresh one.
The token is malformed, truncated in an environment variable or carrying a stray newline.

Paste the token into jwt.io to confirm what it actually contains.

AB03: User not allowed to access the resource (403)

The token is valid, but it does not reach this resource.

Wrong tenant. The token’s tsg_id names a different tenant from the one that owns the resource. A token cannot cross a TSG boundary unless an access policy grants it.
Insufficient role. The service account that obtained the token holds a role that does not cover this operation.
Wrong workspace. The resource belongs to a workspace, and the workspace_id you passed points somewhere else.

AB01: Request Validation Error (400)

The body did not match what the endpoint expects. Usually one of:

a required parameter is missing
a value has the wrong type, a number where a string belongs
a value sits outside the allowed set for an enum

The endpoint’s reference page lists every field and its type.

AB08: Resource not found (404)

The path is right and the resource is not there. Two causes dominate:

A slug was passed where an ID was expected, or the reverse. Configs, integrations and providers take slugs; guardrails, MCP servers, policies and API keys take IDs.
The resource belongs to a workspace you did not name. Pass workspace_id as a query parameter on GET, and in the body on POST and PUT.

AB07 on a create means the resource already exists. Most creates are not idempotent, so retrying a request that timed out can produce a 409 rather than a duplicate. Check before retrying blindly.

Authentication

Most Admin API errors are authentication errors. Start here.

API Reference

Gateway Configuration

Providers and Credentials

MCP

Administration

Observability

Error reference

The four you will actually hit

Authentication

​Error reference

​The four you will actually hit

Authentication

Error reference

The four you will actually hit