What is the concern about bad request(400) or forbidden(403)? : <p>I am implementing an endpoint which offer some secret data and I want to make a simple verify mechanism. Which status should I response when user does not have the correct crediential?</p>

<p>400? 403? Or something else?</p>

<p>thanks.</p>
