diff --git a/contracts/wally-cli-v1.openapi.json b/contracts/wally-cli-v1.openapi.json
index 0bf5d948..3372dee0 100644
--- a/contracts/wally-cli-v1.openapi.json
+++ b/contracts/wally-cli-v1.openapi.json
@@ -329,7 +329,12 @@
           "gateway_operation_pending",
           "reconciliation_unverified",
           "retention_managed_by_runanywhere",
-          "card_required"
+          "card_required",
+          "access_request_exists",
+          "access_request_closed",
+          "access_programme_closed",
+          "not_staff",
+          "invalid_transition"
         ],
         "title": "ApiErrorCode",
         "type": "string"
@@ -1413,7 +1418,7 @@
             "type": "integer"
           },
           "datacenters": {
-            "description": "Where the model is served from: one entry per country its serving nodes are in. OpenRouter's legacy provider field (openrouter.ai/docs 'Provider Integration (Legacy Format)'), added by the gateway to an entry whose model is described to OpenRouter; OpenAI clients ignore it.",
+            "description": "Where the model is served from: one entry per country. OpenRouter's legacy provider field (openrouter.ai/docs 'Provider Integration (Legacy Format)'), added by the gateway to an entry whose model is described to OpenRouter; OpenAI clients ignore it.",
             "items": {
               "$ref": "#/components/schemas/OpenRouterDatacenter"
             },
@@ -2459,8 +2464,8 @@
   },
   "x-runanywhere-source": {
     "artifact": "contracts/control-plane-v1.openapi.json",
-    "branch": "fix/codex-harness-live",
-    "commit": "3fb1fd00aa4045ee9f2f6bfc5b7fefd6062dbc52",
+    "branch": "feat/model-access-review",
+    "commit": "aa1298ba044ea8e0570991c0e7543ede0c85c8af",
     "repository": "RunanywhereAI/InferenceInfra"
   }
 }
diff --git a/src/account/console_contract.rs b/src/account/console_contract.rs
index d5eccd7f..b954dab0 100644
--- a/src/account/console_contract.rs
+++ b/src/account/console_contract.rs
@@ -10,7 +10,7 @@ use serde_json::Value;
 
 /// SHA-256 of contracts/wally-cli-v1.openapi.json this file was built from.
 pub const CONTRACT_SHA256: &str =
-    "298e6c27507aaffc032ea8c2f0640d8e1acf8873baadbb8f481ee4d5f8853d47";
+    "f0cd9d02482c6bbf041500133d48b6ce2ca35643efcd7d925bd3c4e70220a5cc";
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub enum ApiErrorCode {
@@ -51,6 +51,11 @@ pub enum ApiErrorCode {
     KReconciliationUnverified,
     KRetentionManagedByRunanywhere,
     KCardRequired,
+    KAccessRequestExists,
+    KAccessRequestClosed,
+    KAccessProgrammeClosed,
+    KNotStaff,
+    KInvalidTransition,
 }
 
 impl ApiErrorCode {
@@ -92,6 +97,11 @@ impl ApiErrorCode {
             ApiErrorCode::KReconciliationUnverified => "reconciliation_unverified",
             ApiErrorCode::KRetentionManagedByRunanywhere => "retention_managed_by_runanywhere",
             ApiErrorCode::KCardRequired => "card_required",
+            ApiErrorCode::KAccessRequestExists => "access_request_exists",
+            ApiErrorCode::KAccessRequestClosed => "access_request_closed",
+            ApiErrorCode::KAccessProgrammeClosed => "access_programme_closed",
+            ApiErrorCode::KNotStaff => "not_staff",
+            ApiErrorCode::KInvalidTransition => "invalid_transition",
         }
     }
 
@@ -133,6 +143,11 @@ impl ApiErrorCode {
             "reconciliation_unverified" => Ok(ApiErrorCode::KReconciliationUnverified),
             "retention_managed_by_runanywhere" => Ok(ApiErrorCode::KRetentionManagedByRunanywhere),
             "card_required" => Ok(ApiErrorCode::KCardRequired),
+            "access_request_exists" => Ok(ApiErrorCode::KAccessRequestExists),
+            "access_request_closed" => Ok(ApiErrorCode::KAccessRequestClosed),
+            "access_programme_closed" => Ok(ApiErrorCode::KAccessProgrammeClosed),
+            "not_staff" => Ok(ApiErrorCode::KNotStaff),
+            "invalid_transition" => Ok(ApiErrorCode::KInvalidTransition),
             other => Err(format!("unknown ApiErrorCode: {other}")),
         }
     }