Surface: Authentication API · application/problem+json Type URI: https://docs.zeroset.com/problems/csrf_failed Code: csrf_failed HTTP status: 403

Browser cookie mode rejected the request because the CSRF protection header was missing or the origin was not allowed.

Resolving it

Send the documented CSRF protection header from an allowed HTTPS origin, or use bearer tokens instead of cookie mode.

Response shape

{
  "type": "https://docs.zeroset.com/problems/csrf_failed",
  "title": "CSRF check failed",
  "status": 403,
  "code": "csrf_failed",
  "detail": "a human-readable explanation"
}

Every field is required. Clients must reject an authentication problem whose type is not exactly the expansion shown above — the Nebula SDKs do.