Incorrect HTTP status code in 'posts' query.

[demitrimuna]

I am using the WordPress (v4.9.4) JSON API, specifically this URL:

http://.../wp-json/wp/v2/posts

This works great. When I request a 'status':

http://.../wp-json/wp/v2/posts?status=draft

I get this error:

{
    "data": {
        "status": 400,
        "params": {
            "status": "Status is forbidden."
        }
    },
    "code": "rest_invalid_param",
    "message": "Invalid parameter(s): status"
}

It took me a bit to realize that the problem is not that the request (or status keyword) is in valid, but that requesting drafts requires authentication.

I'd like to request that HTTP status 401 (unauthorized) be returned instead of 400 (bad request). The request is not bad, just requires authentication.

[danieltj]

Converting to a bug considering the wrong HTTP status code is being returned here.

From a quick glance it seems as if a few errors are defaulting to a 400 error code.

[dontgo2sleep]

I am on it :)

[davidhernando]

Changes status 400 with 401 for unauthorized requests. keeps status 400 for wrong requests.

[davidhernando]

Some unit tests that had assertions checking returned status code was 400 have been changed to check that returned status code is 401.