Chris is right, but HTTP 401 unauthorized would be the correct exception for permission based errors. 
-Mike 

> On Nov 2, 2013, at 6:16 PM, Chris Casola <notifications@github.com> wrote:
> 
> In Core/WPISuite/src/edu/wpi/cs/wpisuitetng/modules/core/entitymanagers/UserManager.java:
> 
> > @@ -268,6 +263,11 @@ public User update(Session s, User toUpdate, String changeSet) throws WPISuiteEx
> >  			{
> >  				if(s.getUser().getRole().equals(Role.ADMIN))
> >  				{
> > +					if (toUpdate.getRole().equals(Role.ADMIN) &&
> > +							changes.getRole().equals(Role.USER) &&
> > +							getAdminCount(s) <= 1) {
> > +						throw new ForbiddenException("There must be at least one admin account");
> Actually, I take back what I said in the previous comment. Based on the HTTP spec, I think this Forbidden is the most appropriate code.
> 
> From http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html:
> 
> 10.4.4 403 Forbidden
> The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated.
> 
> —
> Reply to this email directly or view it on GitHub.