Missing merchantGroupId or tierId, the tier does not belong to the merchant group, the tier is inactive, or a missing or non-32-character Idempotency-Key. Request body shape is validated at the gateway on this route, so a missing or wrongly typed body field returns the generic 'Invalid request body' message with no field detail; errors raised past the gateway carry a descriptive messageKey.

The supplied Bearer token was rejected: malformed, bad signature, wrong audience, or expired. The Authorization header is required and checked at the gateway, so an absent header returns 400, not 401. Re-authenticate at POST /customer/auth/token.

Insufficient token scope, or client certificate/source IP not allowed

Customer, merchant group, or tier not found (including when it belongs to another company)

The Idempotency-Key was reused for a different request or is still in progress

Internal server error