an example: user authenticated with token, some property in contract must be witihin the set user is allowed to send, like order type 1, 2, or 3. User sends 4 which is also possible, but not for him, should he get 403 forbidden in response or 400 bad request? if authorization relays on order type, should it be in header instead of contract? What if contract is malformed and couldnt be deserialized to contract object, then we send out 400 bad request instead of 403 forbidden cause we cannot preform a part of authorization process. Should authorization be first then contract validation? What are the best approaches here?

Thank you fo suggestions!