[cameronh90]

Authorization errors can go in the errors array which has a path reference in the standard.

You generally don't want to use HTTP error codes with field level errors in GQL.

[paulryanrogers]

So still a 200? Or a 202, 206, 207?

[troupo]

401 or 403. Why is this a question?

[paulryanrogers]

Because there may be fields requested correctly alongside some requested incorrectly

[troupo]

Outside of very few cases it means the request was incorrect.

And bo one is stopping you from returning a response that contains error details.