What is the concern about bad request(400) or forbidden(403)?

Question

I am implementing an endpoint which offer some secret data and I want to make a simple verify mechanism. Which status should I response when user does not have the correct crediential?

400? 403? Or something else?

thanks.

Answer 1

You should use 403, HTTP status code 403 responses are the result of the web server being configured to deny access to the requested resource by the client.

See HTTP 403