title: Which HTTP status code to use when REST API user is trying to acces an object and there is an error?
body: <p>I am trying to find the proper status code to return, here's what I have in mind so far:</p>
  
  <ol>
  <li><code>GET /api/documents/1</code> - document exists, user has access - 200 OK</li>
  <li><code>GET /api/documents/2</code> - document exists, user does not have access - 403 Forbidden</li>
  <li><code>GET /api/documents/3</code> - document does not exist (cannot check if has access or not) - 404 Not Found? 403 Forbidden?</li>
  <li><code>GET /api/documents/a</code> - id is invalid (should be a number) - 400 Bad Request? 404 Not Found? 403 Forbidden?</li>
  </ol>
  
  <p>The problem with my backend (using MongoDB) at the moment is that the first thing I do is check if the user has access to a document by checking it against a list of document IDs he has access to. 
  If the document_id is not found in the list, 403 Forbidden is automatically returned. This helps me to avoid fetching the document from the db first to see if the user can access it.</p>
  
  <p>I am not sure what would be the best practise here - should I pursue better HTTP status codes (and thus creating extra db requests) or would 403 Forbidden work for the last 2 cases (3 and 4) as well?</p>