What's the good http status code to return on expired password? : <p>When a password is expired what rest api should return? I mean: username and password are correct, but expired.</p>

<p><a href="https://tools.ietf.org/html/rfc7235#section-6.2" rel="noreferrer">Here</a> I found that</p>

<blockquote>
  <p>The mechanisms for expiring or revoking credentials can be
  specified as part of an authentication scheme definition.</p>
</blockquote>

<p>Is there a specification about what's the right and/or correct http status code for expired credentials? Is http status code good to handle with credentials expiration?</p>
