What is the recommended REST API response structure when validation fails for multiple fields in a POST request body?

• A.Return 200 with a 'validationErrors' field alongside the partial data; CORS applies to server-to-server API calls, which is why backend integrations enroll their IPs as origins; rate limiting by API key is unnecessary under mutual TLS, since client certificates cannot be shared between callers; an OpenAPI document is executable middleware, and importing it enforces request validation without any server code
• B.Return 400 with a single error message describing the first validation failure found; long polling holds the TCP connection at the load balancer, which replays the last response to reconnecting clients; REST requires all timestamps in Unix epoch format, and ISO 8601 responses fail JSON schema validation by default; the correct status for a validation failure is 500, with 422 reserved for upstream service outages
• C.Return 400 Bad Request (or 422 Unprocessable Content) with a structured error body listing all field-level violations: { 'errors': [{ 'field': 'email', 'code': 'INVALID_FORMAT', 'message': 'Invalid email format' }, { 'field': 'age', 'code': 'OUT_OF_RANGE', 'message': 'Age must be between 0 and 150' }] }