The caller is authenticated but not allowed to do this. When the caller's token is not one this route admits, or does not carry the scope this route requires, the response has no body.
Error codes:
recordAccessDenied — the caller may not read the record named by primaryRecordId. field is primaryRecord.id. A guest-share guest gets this for any record other than its shared record.
guestForbidden — the caller holds a guest token that is not a guest-share token, or a guest-share guest filtered by createdById or asked for a relationshipDepth other than Self. When the guest named a filter, field is that filter.
This endpoint also refuses a request whose createdById names a user that does not exist, or one the caller may not see. The response does not say which. That answer carries no errors array.