I am building a service which acts as a proxy to third party data providers for the end-user. My service uses tokens for authorization and if the user does not have a valid token it responds with
401 Unauthorized. If the token is valid but access to the resource is denied my service responds with
The service fetches data from third party data providers. These data providers use the same response codes (401/403). When such a token has expired, the end-user must enter their credentials to that service again so that my service can request new tokens from the third party providers.
If I just forward the 401/403 from the third party data provider to my end-user, they will not be able to know if authorization failed towards my service or the third party. The frameworks I am using does not allow me to change the message nor send a body with the response.
I have been pondering which status code I can use and thought of
511 Network Authentication Required. This code is used by "proxies" and my service does act as a proxy, although perhaps not in the way a "normal" network proxy does.
511 be a reasonable status code to use or is there something better?