We have a simple POST / PUT that requires that some of the body data matches an organization id that is contained in the JWT.

If the data doesn't match, that is clearly a 401 but wondering about an appropriate response if the data is simply missing? 400 or 401?

Fundamentally, is missing data needed to validate security a 401 or 400? If it falls into the 400 bucket, then we are assuming that security is valid and exposing the missing org id message as part of the general data validation messages. Or we perform 3 sets of validation: required security info (401 on failure), passes security (401 on failure) and then general model requirements etc. (400 on failure).

If we combine the first and second checks, we only have two sets of validation.

  • Probably opinion based. If the request itself is authenticated with the JWT token but the data in the body does not match the organization’s id, I would not return 401 but 403. If the body is malformed or missing data, 400 is fine.
    – Rik D
    Commented Dec 1, 2021 at 17:52

1 Answer 1


First, 401 should be used for authentication errors, not authorization errors. For the latter, use 403. See https://stackoverflow.com/questions/3297048/403-forbidden-vs-401-unauthorized-http-responses for more details.

The scenario you describe is one in which the body of the request is malformed (i.e., a required field is missing). For that scenario, 400 is the canonical response.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.