Which status code is a lie
A request is well-formed and authenticated, but the user is not allowed to see the resource, and revealing that it exists would itself leak information.
What should the API return?
A request is well-formed and authenticated, but the user is not allowed to see the resource, and revealing that it exists would itself leak information.
What should the API return?