What it means
content.auth sent with anything but url.
How to handle it
Remove content.auth unless content is delivered by url; inline data cannot carry origin credentials.
Wire contract
| Code | content_auth_not_allowed |
|---|---|
| Class | invalid_request |
| HTTP status | 400 |
| Meta keys | None |
| Raised | Yes |
The response uses the standard {"error": {…}} envelope. Branch on error.code, not the human-readable message. Preserve request_id when reporting a failure.