Bad request — the input payload is invalid, missing required fields, or fails validation.

Unauthorized — no valid authentication token was provided, or the token has expired. Authenticate by passing a valid Bearer token in the Authorization header.

Forbidden — the authenticated user does not have permission to perform this action. Common causes: missing space membership, insufficient role (e.g. Member trying a Manager-only action), or accessing a record in a space the user cannot view.

Internal server error — an unexpected error occurred. This is not caused by the caller.