If KSC server throws error with X-KSC-ErrorId=1298 then field X-KSC-ErrorMsg may contain detailed error info from EntraId server in JSON format:

{
    "error":"invalid_client",
    "error_description":"AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '5d2f880f-4b1e-435d-907f-bf416f37b528'. Trace ID: f1a2ed74-93e7-4e3a-b21b-5aac20057a00 Correlation ID: 2ab8694d-dcfa-4810-864a-84d101fca65c Timestamp: 2024-06-10 08:07:55Z",
    "error_codes":[7000215],
    "timestamp":"2024-06-10 08:07:55Z",
    "trace_id":"f1a2ed74-93e7-4e3a-b21b-5aac20057a00",
    "correlation_id":"2ab8694d-dcfa-4810-864a-84d101fca65c",
    "error_uri":"https://login.microsoftonline.com/error?code=7000215"
}