csrf_token_refused
An unsafe request carrying the session cookie presented no X-CSRF-Token, or one that is not this session's synchronizer. Raised on /admin too since ADR-0017 decision 5, where it is declared on the mount and covers every console mutation. The token is served by GET /v1/auth/session and rotates with the session; refresh and retry.
Problem shape
Every non-2xx response is an RFC 9457 application/problem+json body. The type URI below is stable and machine-matchable, so branch on the final path segment (the code) and treat the status as redundant confirmation. See the error-handling guide.
{
"type": "https://docs.vocapable.com/errors/csrf_token_refused",
"title": "…",
"status": 403,
"detail": "…",
"instance": "/v1/…"
}