Which is why REST APIs should just accept that the only two error codes that matter are 400 Your Fault and 500 My Fault. Too much ambiguity when you try to shoehorn meaning into responses like 401 and 404.