What applies to your deal requests.

The API key was missing or not accepted. Not JSON: a bare text/plain string: api key not provided, invalid api key, or invalid api key syntax.

The key is valid but not permitted. {"message": "Insufficient scope"}: a read-only key sent a write (POST or PATCH). It is checked before the body is validated, even with ?dryRun=true. {"message": "Partner not authorized for this API"}: the account is not enabled for this API. It is checked after the request is validated, so an invalid request gets its 400 first.