#jwt

403 or 404, and Other Authorization Calls to Make on Purpose

A 403 tells the caller the thing exists. Which status you return on a denial, where identity comes from, and whether endpoints depend on how roles are issued are all decisions most APIs make by default.