It's a bit awkward to express this error in HTTP status codes, but I believe 401 is generally used in the context of the user having either the wrong credentials or they lack the correct privileges to perform the operation.

In this case it's one of the parameters that is causing the issue, so I think 400 would be more appropriate?