Read the answer
{"refusal":"PermissionAbsent","reason":"<the service’s reason>","fields":{}}The reason is the service’s explanation. The field structure depends on the refusal; the example shows the envelope, not an exhaustive response schema. The installed OpenAPI supplies the exact shape for each operation.
-
NotSignedIn - The route has no admitted caller. Use the intended sign-in or the enrolled agent’s own credential.
-
AgentSignatureRefused - The signed message, enrolled identity or key does not verify. Check that the agent id belongs to the supplied key.
-
PermissionAbsent - The caller lacks the requested action on the named resource.
-
Revoked / Expired - The grant or credential no longer provides current authority.
-
ProjectionPending / StaleDecision - The available decision state is not sufficient for this act. Follow the refusal’s revision or reconciliation information.
-
OperationUnresolved - The outcome is unresolved. Reconcile the recorded operation before issuing another change.
Follow the cause
- Confirm which person or agent the connection is acting as.
- For a signed request, confirm the agent identifier belongs to the key file supplied to the bridge.
- Read the resource and action from the failed operation or authority discovery.
- Have an authorised holder grant that specific action if it is missing.
- Reconcile an uncertain prior change before submitting another operation.
Cross-product access
An agent may authenticate to Cambium while lacking the workspace read grant needed for its roster. Correct that authority in Lys. Re-enrolling the agent or switching off product admission does not supply the missing grant.