error field. Branch on that, never on message,
which is prose and may be reworded.
The URL was refused
Returned before any request is made.blocked_hostname and private_address are the SSRF defences. They are
load-bearing rather than decorative: a Worker’s fetch will happily connect to
127.0.0.1, so these checks are the only thing preventing it.
The fetch failed
upstream_status appears only on http_error, so a consumer can tell a 404
from a 503 without parsing English.