403 — authenticated, but this org may not invoke that capability.
HTTP status, or null for failures that are not transport errors.