api: change to StatusBadRequest