User updated successfully

Invalid request (validation errors)

TWO distinct causes answer this status, and a consumer should branch on type:

• .../errors/forbidden — access denied to the tenant, an insufficient scope, or a
  subset-rule refusal: the requested roles would confer a scope the CALLER does
  not hold. detail names the rejected scopes. This is the same rule, the same
  message and the same problem shape the custom-role composition surface
  produces, because both confer authority on somebody else.
• .../errors/impersonation-operation-forbidden — the caller is acting under a
  support-access impersonation session. The operator holds
  admin.tenant.user.update and is inside the tenant boundary; the refusal is not
  an authorization failure. UpdateHumanUserRequest carries a password field and
  the service applies it, so an impersonator could SET the tenant
  administrator's password and sign in under their own steam after the consent
  window closes. The refusal binds on SaaS deployments only (PRD §148): SaaS
  is the only place ANKATech operates a tenant belonging to somebody else.

User or tenant not found

Self-status modification attempted