No key, or a key that is unknown, expired, revoked or deactivated —
all answered identically on purpose, so a caller cannot learn which
guesses are close. TENANT_INACTIVE (403) is the one credential
failure with its own code, because the hotel can fix it.

See Autenticación y API keys.

The key lacks webhooks:write, or — for a subscription that covers
any booking.* event — lacks bookings:read:all (housekeeping:read
for any unit.* event).

The second check runs on every write to an existing subscription
(update, delete, enable, disable, rotate-secret, test), not only one
that changes events: checked against the subscription's effective
events — the request's own events when it sends one, otherwise the
subscription's current list. A key holding only webhooks:write
cannot redirect a booking.* or unit.* subscription's url or
rotate its secret to reach a stream that bookings:read:all or
housekeeping:read gates at creation.

No such subscription for this key. A subscription the hotel created
from its own screens, or one outside this key's properties, answers
identically to one that does not exist.