unauthenticated
Absent, malformed, unrecognized, revoked, or expired API key. One byte-identical body covers all five deliberately - "revoked" and "expired" are facts about a key that was issued, so a per-reason message would answer whether a token ever existed here - and the same body answers the /internal service credential's refusals (§9.9). The response carries WWW-Authenticate: Bearer. Pinned by test_every_api_key_refusal_is_byte_identical; posture owned by 10-security.md.
Problem shape
Every non-2xx response is an RFC 9457 application/problem+json body. The type URI below is stable and machine-matchable, so branch on the final path segment (the code) and treat the status as redundant confirmation. See the error-handling guide.
{
"type": "https://docs.vocapable.com/errors/unauthenticated",
"title": "…",
"status": 401,
"detail": "…",
"instance": "/v1/…"
}