REST API: HTTP Status code for auth violation

Question

I'm implementing a REST API and the auth module is based on JWT. Here below are the HTTP status codes I've defined for it:

• Request without auth token: 401 UNAUTHORIZED
• Auth token expired: 410 UNAUTHORIZED
• Auth token does not contain required claims: 403 FORBIDDEN
• Auth violated (i.e. token was tampered): ???

In case of token tampering, what HTTP status code should I use? 401 (UNAUTHORIZED or 417 (EXPECTATION_FAILED)?

Answer 1

How can you tell if the token was tampered with? It seems to me that you can only know if it's correct or incorrect. Somebody trying to use an invalid token would seem to me to be UNAUTHORIZED. EXPECTATION_FAILED refers specifically to the Expect header, which doesn't seem appropriate here.