you could just raise an HTTPForbidden here since this is still the api layer