What is 'HTTP 401 vs 403' and why does the distinction matter for API security?

• A.401 and 403 are interchangeable; both indicate the client cannot access the resource
• B.401 Unauthorized means authentication is required or has failed - the client should authenticate. 403 Forbidden means the authenticated client is not authorized to access the resource - reauthenticating won't help. For security: returning 403 for unauthenticated requests reveals the resource exists; returning 401 is more accurate. Some security-sensitive implementations return 404 (Not Found) for unauthorized access to hide resource existence (security through obscurity)
• C.401 is for server errors; 403 is for client permission errors
• D.Both 401 and 403 should trigger the same client behavior: reauthenticate