title: What status code should a REST API return for login requests performed with wrong credentials?
body: <p>I have found a lot of answers and explanations for the meanings of HTTP status codes. My question is specifically about the POST request to a login endpoint, which asks for username and password for example and the scenario where incorrect ones are provided.</p>
  
  <p>Some thoughts:</p>
  
  <p><strong>400 Bad Response</strong>
  I think this code is not appropriate, because it says the request was syntactically incorrect and not understood by the server, which is not the case here. The login data is just semantically not correct.</p>
  
  <p><strong>401 Unauthorized</strong>
  Here is the tricky part for me. 
  If 401 can only occur on requests requiring an authentication header then this is not correct. But if 401 can occur on all requests, which require authentication (either as header or in the body) then 401 is a candidate.</p>
  
  <p><strong>403 Forbidden</strong>
  Usually, 403 is returned if the user already is authenticated and known to the system but requested a resource he/she is not allowed to access.
  The user definitely is not authenticated before the login. I don't know if there is a semantic for 403 for unauthenticated users.</p>
  
  <p>I'm happy to be told the answer or hear your thoughts.</p>