What it means
acting-account selector unknown or not yours (one answer for both), or the header is not allowed on this route.
How to handle it
Stop using the acting-account selector or choose an account the principal may reach; inspect meta.reason for the refusal category.
Wire contract
| Code | account_not_permitted |
|---|---|
| Class | permission |
| HTTP status | 403 |
| Meta keys | reason |
| Raised | Yes |
The response uses the standard {"error": {…}} envelope. Branch on error.code, not the human-readable message. Preserve request_id when reporting a failure.