fix more permission typos

[ci skip]
define error responses

includes HTTP 400 for all existing POST/PATCH endpoints

[ci skip]