Every refusalcarries a type.
You read one in a problem-details body and followed it here. Each section below is one type: what it means, which service answers it and what to do next.
A GuestGraph service refuses a request with an RFC 9457 problem detail: a type, a title, a status and a detail, sometimes an instance, and for a few problems named members beside them. The type is this page's address with the section's name as its fragment, so the URI in the body leads to the section that explains it. The engine and the connector answer from one list, and each section says which of them answers it.
Invalid request
The request could not be used as sent. The detail says what was wrong. Every service answers it. Fix the request and send it again.
Invalid actor claim
The request claimed an actor its credential does not grant. This is a malformed claim, not a failed authorization: the credential was accepted, and what it said about who is acting was not. The engine answers it. Send an actor claim the credential grants.
Invalid unmerge
The requested unmerge cannot be carried out. A guest with a single record has nothing to split off, and a record that is not linked to the guest cannot be taken from it. The engine answers it. Read the guest, then ask for an unmerge it can perform.
Unauthorized
The credential is missing, unknown or revoked. The engine reads the X-API-Key header; a token-guarded surface reads a bearer token in the Authorization header. Every service answers it. Check that the credential is sent in the header the service reads, and that it is still valid.
Resource not found
Nothing with that id exists in the caller's tenant. An id that belongs to another tenant gets the same answer as one that never existed, on purpose: a refusal must not say whether an id is in use elsewhere. Every service answers it. Check the id, and check which tenant the credential belongs to.
Conflict
The thing already exists. A source system registered twice is the usual case: the second registration is refused rather than overwriting the first. The engine answers it. Read what is there before creating it again.
Conflict
A match review is decided exactly once, and the first decision stands. A second decision on the same review is refused, whatever it says. The engine answers it. Read the review to see the decision that stands.
A run is in progress
A full sync or a reconciliation is running on this connection, and a second run cannot start beside it. The connector answers it. Wait for the run to finish, or read the run to see where it stands.
Guest id retired
The guest id was absorbed by a merge or emptied by a split, and nothing is read under it any more. The engine answers it, with three named members beside the detail: guestId, the id that was read; resolutionStatus, which is MERGED, SPLIT or RETIRED; and currentGuestIds, where the guest is now. Read the current guest. When there are several, the graph cannot say which one was meant, and a person has to.
Payload too large
The body exceeds the service's cap. The detail names the cap in bytes. Every service answers it. Send less in one request.
Apaleo could not be reached
The connector asked Apaleo to do something and Apaleo refused or did not answer, so what you asked for did not happen. Your request was well formed; the failure is between the connector and the system it fills the graph from. The connector answers it. Try again, and if it persists, check whether the connection's credentials still work and whether Apaleo is up. A removal that returns this removed nothing: nothing is ever reported gone while Apaleo still holds it.
Internal server error
Something nobody foresaw. The detail says nothing of the cause on purpose; the server log has it in full. Every service answers it. Retry once. If it happens again, report it with the instance path and the time.