if the intent is to indicate that this request cannot be completed due to restricted input, a 403 might make the most sense. "You want this resource to resolve, but we're not going to let it. It ist verboten."