What should be REST response for GET call with identifiers as the query parameter if user does not have access to some of the requested resources?

Question

I am designing a REST API, where the user can place a GET call and fetch a list of items.

One of the query parameters that this API is allowing is also ids , a comma-separated list of identifiers that should be fetched.

This is an ability to filter items based on the known ids of resources.

GET /entities?ids=1,2,3

Now, there is also an authorization framework in this mix that provides an answer of what resources the user actually has access to.

So, say from the list of requested ids: 1,2,3 the user has access only to 1 and 3 . They are not allowed to access a resource with id 2 .

What should be the REST response in this case?

Should I ignore the fact the user is asking for the forbidden resource and return 200 with the body containing items with ids 1 and 3 ?

Or, maybe, return 403 in this case... Opinions?

Answer 1

This request should fail

The client is explicitly requesting a specific resource that it doesn't have access to. That should not be part of the normal flow of your application, and I'd say it warrants an outright rejection.

The client may need to process the returned data, so a successful response that doesn't include the requested data should not be allowed to happen. If you do it, your client needs to write more code to account for this outcome, raising the likelihood of bugs and breaking trust with the client. Just return an error instead. Your client needs to handle these in any case.

My choice would be a 403 response with a message that informs the client why the request failed and includes steps to correct the issue.