Surface: Authentication API · application/problem+json Type URI: https://docs.zeroset.com/problems/origin_not_allowed Code: origin_not_allowed HTTP status: 403

Cookie-mode requests must carry an Origin header on the configured allow-list.

Resolving it

Call from a configured origin, or use bearer tokens, which do not carry origin requirements.

Response shape

{
  "type": "https://docs.zeroset.com/problems/origin_not_allowed",
  "title": "Origin not allowed",
  "status": 403,
  "code": "origin_not_allowed",
  "detail": "a human-readable explanation"
}

Every field is required. Clients must reject an authentication problem whose type is not exactly the expansion shown above — the Nebula SDKs do.