Where to send, how much, on which network, and by when.

The API key is known, but this request does not yet include proof of its
private key. Sign the exact UTF-8 characters in payloadToSign (the
base64 text itself; do not decode it), then
repeat the identical method, path, query, body bytes, and
Idempotency-Key with X-Anzo-Request-Id and X-Anzo-Signature.

This is an authentication handshake, not acceptance of the business
operation. Nothing has been created, sent, funded, or cancelled yet.

Missing, invalid, or revoked key — or a key on a route that does not accept one.

Valid key, wrong organization.

Too many requests. The default ceiling is 100 requests per minute per
API credential on a 60-second window. High-volume payout and
reconciliation routes declare a 600/minute override. A separate
2,000/minute per-source-IP abuse ceiling always applies.

Obey Retry-After; it is in seconds and is authoritative. A 429 means
the request was refused before the handler ran. Retry reads normally;
retry an idempotent mutation with its same Idempotency-Key.