title: REST API how to handle incomplete answers
body: <p>I am currently developing a REST API with a MongoDB backend and due to access rights clients may look for data where some are accessible and others are forbidden.</p>
  
  <p>For example let's say I wish to have in a single request objects A, B and X from database, but I do not have enough rights to access object X.</p>
  
  <p>I would like my API to answer A, B, and a forbidden status for object X. Any <strong>best-practices</strong> to do it ? What's the resulting request <strong>status code</strong> ?</p>