The supplied Bearer token was rejected: malformed, bad signature, wrong audience, or expired. The Authorization header is required and checked at the gateway, so an absent header returns 400, not 401. Re-authenticate at POST /customer/auth/token.

Insufficient token scope, or client certificate/source IP not allowed

Merchant group not found

Internal server error