http-error-triagelisted

# HTTP error triage An HTTP error tells you a request failed. It usually does **not** tell you why. Concluding "the key is dead" from a 403 is a guess wearing a number. Born from a real incident (2026-07-30): a third-party contact-enrichment API returned `403 error code: 1010` to every call for six days. It was read as "key not entitled", "credits exhausted", "monthly quota reached". A 756-line browser automation workaround was built on that belief, and a customer was nearly asked to check a plan that was fine. The actual cause was a missing `User-Agent`, so the CDN banned the client at the edge. One header fixed it: 200 OK, full data, and the credit balance had been there the whole time. ## Run these three controls before you diagnose **1. The invalid-credential control.** Send the same request with a deliberately garbage credential, and again with none at all. ```python for label, key in [("real", REAL_KEY), ("garbage", "0"*36), ("empty", "")]: ... # same URL, same method, same headers ``` If all three return the **same** status and body, the error is not about your credential. It carries zero information about entitlement, quota or validity. Stop reasoning about the key. **2. The nonsense-path control.** Request a path that certainly does not exist, and the site root. ``` GET https://api.example.com/definitely-not-a-real-path-12345 GET https://api.example.com/ GET https://www.example.com/ # their marketing site ``` If the API error also comes back fr