Skip to content

Which status code is a lie

A request is well-formed and authenticated, but the user is not allowed to see the resource, and revealing that it exists would itself leak information.

What should the API return?