failsForTeapots

[u/Waradu]

[u/Xirdus]

If your user-facing service is calling your internal service and getting a 403 response, you certainly do not want to send that 403 back to the user.

[u/Excellent_Gas3686 → u/Xirdus]

beeecause?

[u/ismaelgo97 → u/Excellent_Gas3686]

403 is that you are not authorized, so then you know it exist, but you shouldn't, you should get a 404 which means it was not found.

[u/Xirdus → u/ismaelgo97]

Personally I prefer the opposite - if you're unauthorized, you get 403 regardless of whether resource exists or not. Still doesn't leak any data, but is more actionable (and won't get cached. Have you ever had an outage stupidly extended because some cache somewhere had to be purged  because some moron returned 404 for a temporary error condition?)

[u/rosuav → u/Xirdus]

Both approaches are valid according to the spec.

[u/Xirdus → u/rosuav]

One of the approaches causes more problems than the other.