We have REST API endpoints that all users are free to use and other endpoints that users can use if they have explicitly enabled and paid for some specific feature.
What should be the correct status code returned from the paid endpoints if it has not been enabled by the user?
I see 2 options:
- 402 Payment required
- 403 Forbidden
402 is described as a nonstandard client error status response code that is reserved for future use, so I do not feel like this is the right status code for this case.
Are there any other status codes that would fit this case better?