Http Code

https://stackoverflow.com/questions/36874263/expected-http-status-code-for-an-action-on-a-disabled-resource
Expected HTTP status code for an action on a disabled resource

409

This code is used in situations where the user might be able to resolve the conflict and resubmit the request. Source

This is then followed up

Conflicts are most likely to occur in response to a PUT request. For example, if versioning were being used and the representation being PUT included changes to a resource that conflict with those made by an earlier (third-party) request

That seems more like the entity shifted underneath the client while the client constructed a call, perhaps the assumption is the client asks for the allowed actions, before making the call(s). If you implemented that, I would say 409 is perfectly valid for your API since you provide the ability for clients to make only valid requests, unless someone else changes the entity.

http://www.dirv.me/blog/2011/07/18/understanding-403-forbidden/index.html

Receiving a 403 response is the server telling you, “I’m sorry. I know who you are--I believe who you say you are--but you just don’t have permission to access this resource. Maybe if you ask the system administrator nicely, you’ll get permission. But please don’t bother me again until your predicament changes.”

In summary, a 401 Unauthorized response should be used for missing or bad authentication, and a 403 Forbiddenresponse should be used afterwards, when the user is authenticated but isn’t authorized to perform the requested operation on the given resource.

https://leastprivilege.com/2014/10/02/401-vs-403/

But there is definitely the need to distinguish between the situation where no or invalid credentials were supplied with a request and the situation where a valid credential was supplied, but the “entity” belonging to that credential is not authorized for the operation it is trying to do.

The 401 (Unauthorized) status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. The server generating a 401 response MUST send a WWW-Authenticate header field (Section 4.1) containing at least one challenge applicable to the target resource.

A server that receives valid credentials that are not adequate to gain access ought to respond with the 403 (Forbidden) status code.