Error shape
message field can be a string or an array of validation messages.
Common statuses
Validation errors
Validation errors normally return400 Bad Request. Fix the payload before retrying.
Ownership errors
For security, cross-owner resource access usually returns a not-found response. Treat404 as either missing or inaccessible.