Should this be a `NotFound` instead of a `BadRequest` ?