What is the appropriate REST response code for invalid data?

Question

I have REST method to update a user profile. Which status code should the system return if the some of the parameters are not valid? Or, for example, to change password, if old password and password in DB are not equals. 400 Bad request?

Answer 1

What you describe can and should be handled using two different response codes as described in the Book RESTful webservices from Richardson and Ruby:

400 Bad Request

This is commonly used when the client submits a representation along with a PUT or POST request, and the representation is in the right format, but it doesn’t make any sense. So it's totally okay to use it for missing or invalid parameters.

However 400 is the generic client side error code and you should definitely provide some further infos to the client in the response body.

409 Conflict

Any request that can't be performed by the server because it would leave one or more resources in an inconsistent state. So I would use this response code when a user tries to change his password and the comparison with the old password fails as you described it.

You can also take a look at this discussion REST HTTP status codes for failed validation or invalid duplicate.