400 is "bad request".  Surely if the client has sent a request but with no items, then that is a bad request?
I don't think it's a 404 or 410 because that would imply that a request for a resource has been made (in fact, it the case that we're not requesting a resource at all that is the problem).