In addition to @Dherik's answer.
URIs are identifiers, so we have to keep in mind that (/a/{id}/b
is an identifier). The URI is meaningless for the WWW, and so is for the HTTP client.
404 is the right answer. In essence, the server is answering
I didn't find any resource with such id. Resource not found
1
Whether the missing resource is parent or child doesn't matter.
We, developers, see hierarchies and paths but HTTP clients don't. In other words, we read and see infirmation in these identifiers but HTTP clients don't. These treat URIs as meaningless strings.
In case of doubts, don't ask what code makes sense for you (human). Do ask, what code makes sense for the HTTP client. How do I want the HTTP client to behave?
Why? Because status codes make the client to behave in different ways. For example, 302. This code usually makes web browsers to redirect to a specific location (URI) informed in the response headers.
This might not be your case, but it's important to know about this. Ultimately, HTTP status codes are addressed to HTTP clients. Not to our applications. Not to persons.
1: 409 is rarely implemented as navigation error. It usually involves the execution of remote operations (delete, update, new, etc). But the URI should exist. Otherwise, 404 will prevail