Movements, oldest first.

The API key is known, but this request does not yet include proof of its
private key. Sign the exact UTF-8 characters in payloadToSign (the
base64 text itself; do not decode it), then
repeat the identical method, path, query, body bytes, and
Idempotency-Key with X-Anzo-Request-Id and X-Anzo-Signature.

This is an authentication handshake, not acceptance of the business
operation. Nothing has been created, sent, funded, or cancelled yet.

Missing, invalid, or revoked key — or a key on a route that does not accept one.

Valid key, wrong organization.

Too many requests. The default ceiling is 100 requests per minute per
API credential on a 60-second window. High-volume payout and
reconciliation routes declare a 600/minute override. A separate
2,000/minute per-source-IP abuse ceiling always applies.

Obey Retry-After; it is in seconds and is authoritative. A 429 means
the request was refused before the handler ran. Retry reads normally;
retry an idempotent mutation with its same Idempotency-Key.