When the api-umbrella-gatekeeper component denies a request, it can be for a variety of reasons (no API key is supplied, invalid API key, over rate limit, etc). However from a logging and analytics perspective, all that we log is the HTTP response status code (as we do for all responses). While you can usually use this HTTP response status code to help discern why a request may have been rejected, it's not the easiest thing to query, and we're having a growing number of possible errors that have overlapping HTTP status codes (eg, there's multiple reasons why we might return a 403 forbidden error).
To solve this, I think it would be helpful for us to begin logging our internal error code we return when the gatekeeper component is responsible for denying the request.
I'll flush this issue out with a bit more detail shortly on where all the different components this touches are located.