title: Should I return a 401 or a 405 response code to a REST API user without sufficient access?
body: <p>I'm developing an API which will also have an authentication/authorization component.</p>
  
  <p>Anybody, regardless of authentication status, will be able to write (POST), but depending on if you are unauthenticated, authenticated as a normal user or authenticated as an admin and what resource you are trying to access I'm going to return different responses for GET, DELETE and PUT.</p>
  
  <p>I'm trying to figure out the most appropriate response code for a user who isn't authenticated and/or authorized.</p>
  
  <p>Keep in mind <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html">http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html</a>:</p>
  
  <blockquote>
    <p>Unauthorized -> 401</p>
    
    <p>Forbidden -> 403</p>
    
    <p>Method Not Allowed -> 405</p>
  </blockquote>
  
  <p>Let's use a specific examples:</p>
  
  <ul>
  <li>John Doe is unauthenticated, on DELETE should he receive a 401 or a 405?</li>
  <li>Amy is authenticated but not authorized, on DELETE should she receive a 403 or a 405?</li>
  </ul>
  
  <p>(Keep in mind that even though John and Amy are forbidden or unauthorized that doesn't mean they arent able to access the same resource with a different HTTP VERB.)</p>
  
  <p>Thanks.</p>