A value was removed. effective carries what the setting now resolves to, or is null when a cleared credential leaves nothing to resolve; assignment reports whether anything is still assigned.

The caller lacks admin.platform.config.dangerous for a DANGEROUS key, or admin.platform.deployment-secret.write for a secret. Both refusals are oracle-safe: neither reveals whether a value was assigned.

No such setting key in the catalog

The setting is NOT WRITABLE, which is one refusal covering TWO distinct propagation types: READ_ONLY_DIAGNOSTIC, an observation of the platform that nothing can clear; and DEPLOYMENT_OWNED, a real parameter whose owner is the deployment — the entry names the environment variable to change instead, in deploymentVariable. Also covers an ANKA-managed tier credential, whose lifecycle belongs to the rotation endpoint, and an ops-provisioned Docker secret this product does not own. The detail is a fixed, type-neutral literal: it names neither the key, nor the propagation type, nor the variable.

The setting is deployment-type-gated and does not apply to this deployment