Hacker News new | ask | show | jobs
by marcosdumay 748 days ago
Because it's not an authorization error.

You do not throw 403 if the client is authorized to access whatever resource it's trying to.

The 426 on the sibling comment is great, though. But if you don't find an error code for your case, you don't go and redefined a well defined one. You use 400 (or 500).