A 400 means that the request was malformed. In other words, the data stream sent by the client to the server didn't follow the rules. In the case of a REST API with a JSON payload, 400's are typically, and correctly I would say, used to indicate that the JSON is invalid in some way according to the API specification for the service. By that logic, both the scenarios you provided should be 400's. Imagine instead this were XML rather than JSON. In both cases, the XML would never pass schema validation--either because of an undefined element or an improper element value. That would be a bad request. Same deal here.
... View more