I have the same issue and I’ll let you know if I find a workaround.
So far the docs simply say about the api.access.deny
param
userMessage
String. A human-readable explanation for rejecting the registration attempt. This may be presented directly in end-user interfaces.
So may
be presented, for me it isn’t presented when using lock 11.