How about. "Forbidden. Please request access by following this link: http://internal/?requestguid=GUID&custn=CUSTNAME
Your request will be handled within 24 hours."
That link?
If they click the link - which they will - you have all the information they should email you (but don't.) Because you told us all you need is the GUID.
Remember: Error messages are literally an API between you and the human. If the human isn't doing what you want, you need to debug your API code until the human is doing what you want. The human is like a device! It might be flaky, but you're stuck with it. So debug your API code (the error message) until you work around the flaky humans.
I'm going to change all error messages to:
"Please click this link and type the following GUID into the web page."
That way, based on history, I'll at least get an email with the error copied in. They'll never click the link, but if they do one or the other, I'll have the info I need.
Now if I could just stop people from submitting bug reports for 404 errors...
"If you ignore that link and instead email this to us, we'll try to get back to you within 5 business days."
I get such bug reports for my open source project. People get offended when I point out that the message says what they need to do.
I did fib a bit though. There is one error we get emailed to us regularly. It's a 403:
THAT error reliably gets copy/pasted in an email to us with the questions "Why am I getting this error?" or "How do I get access to this?"EDIT: I'm also talking about the JSON output of an internal API whose target audience is developers and people writing scripts. This means that we are all the problem. If the target customer were average Joe user I'd completely understand.