What status code should be sent when a user tries to sign up with a username that already exists?

Question

I was thinking 403. From http://www.restapitutorial.com/httpstatuscodes.html:

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

Edit: Endpoint - POST /users.

Answer 1

The normal HTTP error code for situations like this is 409 Conflict:

The request could not be completed due to a conflict with the current state of the resource. This code is only allowed in situations where it is expected that the user might be able to resolve the conflict and resubmit the request. The response body SHOULD include enough information for the user to recognize the source of the conflict. Ideally, the response entity would include enough information for the user or user agent to fix the problem; however, that might not be possible and is not required.

This should be issued in response to a POST or PUT, typically as part of some sort of RESTful API. It should include a useful error message in addition to the status, and the error should be appropriately encoded (e.g. with XML or JSON).

Obscure HTTP errors are less useful in front-end web services. If you are developing a user-facing website, it's preferable to simply deliver an HTML page explaining the problem with a standard 200 OK.

Answer 2

If you are creating a REST API to create accounts, I would expect the request to be something like:

POST /accounts HTTP/1.1 

{userid: "[email protected]", password: "passw0rd!"}

In this case, I guess an appropriate response code would be 409 Conflict with an error description in the body

HTTP/1.1 409 Conflict

{ error: "Account already exists"}