I have the same issue and I’ll let you know if I find a workaround.
So far the docs simply say about the api.access.deny param
userMessageString. A human-readable explanation for rejecting the registration attempt. This may be presented directly in end-user interfaces.
So may be presented, for me it isn’t presented when using lock 11.