console_access_refused
HTTP 403§9.10 Agreements
POST /v1/auth/console-key was called by a session whose membership or whose workspace is not active. Fails closed for a suspended workspace, a deactivated member, and any legacy session shape that cannot prove either. Deliberately not role-gated - a member is entitled to the console, and what they may do inside it is the scope check on each endpoint (ADR-0033).
Problem shape
Every non-2xx response is an RFC 9457 application/problem+json body. The type URI below is stable and machine-matchable, so branch on the final path segment (the code) and treat the status as redundant confirmation. See the error-handling guide.
{
"type": "https://docs.vocapable.com/errors/console_access_refused",
"title": "…",
"status": 403,
"detail": "…",
"instance": "/v1/…"
}