While I'm not sure we need to say when to use all possible http error codes, I think this is a good one to call out and I'm thinking that a "400 Bad Request" is appropriate.
@duglin and that is how I've implemented it in the broker I am currently working on (because that seems the most common sense response), but like you, I do believe the spec should be explicit in this regard.
While I'm not sure we need to say when to use all possible http error codes, I think this is a good one to call out and I'm thinking that a "400 Bad Request" is appropriate.