api: use bad request (400) instead of precondition failed (412)

Invalid data is a bad request, not a precondition failure.