The room.

No key, or a key that is unknown, expired, revoked or deactivated —
all answered identically on purpose, so a caller cannot learn which
guesses are close. TENANT_INACTIVE (403) is the one credential
failure with its own code, because the hotel can fix it.

See Autenticación y API keys.

The key is valid but lacks the scope this operation needs.

Which scope unlocks what: Alcances y el header X-Property.

No such room in this property — or it exists and is not sellable
through this API. The two answer identically, so that probing ids
cannot map somebody else's account.

A room the hotel can see on its own screens is absent here until it has
an active rate plan on the api sales channel. That is the answer far
more often than a wrong id.