workspace_mismatch
This code is reserved: in v1 every key authenticates exactly one
workspace, so the public API never emits this code in practice — a
cross-workspace attempt becomes a 404 instead (see
not_found).
The code is documented and reserved so that Phase 5 OAuth tokens (which
authorise a user against multiple workspaces) can return a meaningful
403 when the workspace path parameter doesn’t match the resolved
principal.
If you see this code from v1, it’s a bug — please file an issue with
the request_id.