400 as far as I understand it is about the request syntax itself. If the error is in semantics (i.e. POSTing a phone number where you expected a date of birth)

400 as far as I understand it is about the request syntax itself. If the error is in semantics (i.e. POSTing a phone number where you expected a date of birth) then the request itself isn't malformed. 403 might be appropriate, but generally concerns authorization more than the ability to process the request -- i.e. trying to POST something the user doesn't have authority to modify would return a 403. If the user is authorized for the specific request, and the request is valid syntactically, but the semantics of the request body makes no sense, then the entity of the request can't be processed and 422 is what you should return.