Function disclosure_disabled 

fn disclosure_disabled(route: &str) -> ApiError

DisclosureDisabled: this deployment has closed a Credential::Disclosure route by configuration, so it is closed to everyone.

Its own name, distinct from authentication_required, on purpose: an outsider reading AuthenticationRequired off a route that is public everywhere else cannot tell “this deployment closed it” from “you forgot a header”, and both look identical to a route that does not exist. A stranger auditing this deployment — plan/ownership.md’s whole premise — needs to be able to tell “this server runs no agents” from “this server is not telling you”, and only a name of its own says which one happened. 403, like scheme_disabled: retrying with a different credential will not help either, because the deployment closed the route, not the caller’s credential.