This one's for my nerds out there but it's a useful primer on how to best use HTTP/400 status codes.
Forbidden (403), Unauthorized (401), or What Else?
How to use HTTP status code in the authorization context? When to use "401 Unauthorized" status code? When to use "403 Forbidden"? Let's ...
auth0.com