Theory is fine but in the real world I've never used a REST API that adhered to the stateless standard, but everyone will still call it REST. Regardless of if you want it or not REST is no longer the same as it's original definition, the same way nobody pronounces gif as "jif" unless they're being deliberately transgressive.
403 can be thrown for all of those reasons - I just grabbed that from Wikipedia because I was too lazy to dig into our prod code to actually map out specifics.
Looking at production code I see 13 different variations on 422, 2 different variations of 429...
403 is a category, not a code. Yes I know they're called http codes but REST calls are more complex than they were in 2001. There are hundreds of reasons you might not be authorized.
Is it insufficient permissions? Authentication required? Blocked by security? Too many users concurrently active?
I'd argue the minimum for modern services is:
403 category
Code for front end error displays
Message as default front end code interpretation
As json usually but if you're all using protobuf, go off King.
But if it came from anywhere it would probably be the book he published last year.
Dr Echols invented new technology allowing researchers to see anatomical features such as blood vessels with the use of CT. The Second Edition has all new images of CT based wing and leg anatomy clearly depicting important anatomic features for several avian species.
Fairphone should sell phones outside of Europe
Unfortunately neither of us get what we want