title: Returning a 403 from a webapi2 controller
body: <p>My API has the following routes</p>
  
  <p>GET: api/departments</p>
  
  <p>GET: api/departments/{departmentID}/employees</p>
  
  <p>The second route maps to the following controller action</p>
  
  <pre><code>public IEnumerable&lt;Employee&gt; Get(int departmentID)
  {
    return GetEmployees(departmentID);
  }
  </code></pre>
  
  <p>This route can potentially be called with a departmentID that does not exist or that the user does not have permission to access. When this happens, what is the proper way to handle it? Currently, I have modified my controller action to return a 403 as shown below</p>
  
  <pre><code>public HttpResponseMessage Get(int departmentID)
  {
    var isDepartmentValid = CheckIfDepartmentIsAccessible(username, departmentID);
    if(!isDepartmentValid)
    {
      return Request.CreateResponse(HttpStatusCode.Forbidden);
    }
  
     Request.CreateResponse(HttpStatusCode.OK, GetEmployees(departmentID));
  }
  </code></pre>
  
  <p>Is this the right way to do it? It seems like the change in method signature makes it harder to understand the content type returned from the controller action. Is there a way to have the method signature remain the same but still return a 403 if needed? </p>