vocapablesso_required
The company enforces single sign-on and this browser session did not come through its identity provider (company_id names it). Sign in with SSO; only the named break-glass owner keeps password sign-in. Raised by POST /auth/console-key and GET /mobile/authorize.
Problem shape
Every non-2xx response is an RFC 9457 application/problem+json body. The type URI below is stable and machine-matchable, so branch on the final path segment (the code) and treat the status as redundant confirmation. See the error-handling guide.
{
"type": "https://docs.vocapable.com/errors/sso_required",
"title": "…",
"status": 403,
"detail": "…",
"instance": "/v1/…"
}