Keystore imported. Body relays Core API's import summary, detection, imported keys/certificates, skipped entries, and failures.

Invalid input — over-limit keystore/password, missing parts, wrong password, or unsupported keystore format.

Unauthenticated — missing or invalid JWT.

Forbidden — missing scope migration.importKeystore or tenant boundary violation. A THIRD cause is the caller acting under a support-access impersonation session (impersonation-operation-forbidden), which is DISTINCT and not an authorization failure: the operator holds the scope and is inside the tenant boundary. It binds on SaaS deployments only (PRD §148) and is raised as the handler's FIRST statement. Branch on type, not on the status.

Conflict — an identifier in the keystore is already held, or an entry conflicts with existing key material. This status was reachable before it was declared: the Core API client has carried a 409 arm for this route throughout, and only the annotation was missing. The upstream type, title and detail are relayed verbatim under the PRD §126 relay contract, so branch on type rather than on this prose; instance and extensions.requestId are always this service's own. ProblemView carries no extension members, so an upstream extensions.code (for example INVALID_KEY_STATE) does NOT survive the relay — the type is the member to key on.

Unprocessable — all keystore entries failed validation (relayed from Core API).

Core API is unavailable (5xx / connection failure).