I\'m creating a RESTful API that will process a number of user interactions, including placing orders using stored credit cards.
In the case of a successful order, I
I do'nt think 400 can be used for all the business scenario. It can be used for basic data input validation. Beyond that we might have hard to time fit other business logic into this error code. The error handled by this are mostly design time errors which developer will encounter possibly during the coding of the client.
Let's say all parameters are correct and let's say we are passing user account number into the request.
So request is now no longer a bad request, the server is able to accept the request. But now it is refusing to fulling the request based on new information available which is - account does not have sufficient balance.
I would suggest we should use 403 with appropriate error message in those scenarios.
Other possible error code could be 409 conflict. But that is used in scenarios where the resource is in in consistent state.