No credential was presented. Send your API key as
Authorization: Bearer <key> on every request — there is no
session, so a key that worked on the previous call still has to be
sent on this one.
Switch on the code member — unauthenticated — which is
stable. Do not parse the type URI: it points here, and where
"here" is may change.