The correct HTTP status code for a request with an incorrect password applied to a REST API session is 401 Unauthorized. This status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. If the request included authentication credentials, then the 401 response indicates that authorization has been refused for those credentials. The server generating a 401 response must send a WWW-Authenticate header field containing at least one challenge applicable to the target resource. References := HTTP Status Codes - REST API Tutorial, Stack Overflow discussion on HTTP status code for incorrect login