api_clients.bound_business_client_uuid).client_id / client_number in query or body — returns 400 CLIENT_ID_NOT_ALLOWED.client_id (caa_ck_...) is only for exchanging a tenant_access_token.api_clients.allowed_meta_ids is set: lists only those Meta accounts; writes elsewhere → 403 FORBIDDEN_ACCOUNT; detail GETs → 404.fund_transfers:read. Account→account transfer is not exposed.429 RATE_LIMITED + Retry-After.