Conflict — request is valid but cannot be processed due to current state. Common codes: HOSTNAME_CONFLICT — hostname already assigned to another App; BARE_IPS_CONFLICT — POST/PATCH app: one or more of the provided bareIps IP ranges conflict with an existing app (field: bareIps); DEDICATED_IPS_LIMIT — dedicatedIps.enabled: true quota exhausted; IPSEC_LIMIT — IPSec egress tunnel limit reached; TLD_LIMIT_EXCEEDED — limit on distinct top-level domains exceeded; MISSING_CATEGORY_NAME — categoryName does not match any category returned by GET /v1/categories; MISSING_SKU2_FOR_RISK_CONTROL — risk controls require SKU2 entitlement not held by this customer; MISSING_USER_GROUPS — one or more assignment group IDs do not exist for this customer; UNSUPPORTED_BARE_IP_IN_REFERENCED_GATEWAY_IPSEC_CONFIG — a bareIps subnet is not covered by the referenced gateway's IPSec tunnel right.subnets; GATEWAY_REFERENCED_BY_ACCESS_POLICIES — DELETE gateway: still referenced by one or more Access Policies; GATEWAY_REFERENCED_BY_GROUPED_GATEWAYS — DELETE gateway: still a member of one or more grouped gateways; GATEWAY_REFERENCED_BY_DNS_ZONES — DELETE gateway: still referenced by one or more Custom DNS Zones; GROUPED_GATEWAY_REFERENCED_BY_ACCESS_POLICIES — DELETE grouped-gateway: still referenced by one or more Access Policies; GROUPED_GATEWAY_REFERENCED_BY_DNS_ZONES — DELETE grouped-gateway: still referenced by one or more Custom DNS Zones; CUSTOMERS_REFERENCED_BY_ACCESS_POLICIES — PATCH gateway or grouped gateway: an unassigned customer is still referenced by one or more Access Policies; CUSTOMERS_REFERENCED_BY_GROUPED_GATEWAYS — PATCH gateway: an unassigned customer still uses this gateway via a grouped gateway; CUSTOMERS_REFERENCED_BY_DNS_ZONES — PATCH gateway or grouped gateway: an unassigned customer is still referenced by one or more Custom DNS Zones; CUSTOMERS_FROM_DIFFERENT_ORGANIZATIONS — PATCH gateway: the provided customers belong to different organizations; only customers from the same organization may be assigned together; GATEWAYS_TUNNEL_FLAG_MISMATCH — PATCH grouped-gateway: the combined set of referenced gateways (supplied plus the group's existing members) does not all share the same tunneled flag; distinct from 422 MIXED_TUNNEL_TYPES, which rejects a supplied gatewayIds set that is itself mixed (field: gatewayIds); IPSEC_CONFIG_DUPLICATE — POST/PATCH gateway: a gateway with the same IPSec configuration already exists (field: ipsec); PREDEFINED_APP_NOT_FOUND — POST app: predefinedAppId does not resolve to an existing predefined app (field: predefinedAppId). Returned as 409 (not 422): the id is checked against existing predefined apps, not the request's shape. CONFLICT — generic conflict fallback; emitted for conflict cases not covered by a specific code above (e.g. removing the contact from a dedicated VPN route). Note: inaccessible gateway IDs in request bodies return 422 GATEWAY_NOT_FOUND, not 409. An unresolvable predefinedAppId is the deliberate exception — it returns 409 PREDEFINED_APP_NOT_FOUND.
