I am assuming account-specific endpoints, which on reflection isn’t guaranteed, but is I think reasonable to expect. On a shared endpoint, 401 would be reasonab

I am assuming account-specific endpoints, which on reflection isn’t guaranteed, but is I think reasonable to expect. On a shared endpoint, 401 would be reasonable, but on a dedicated endpoint I maintain it’s unreasonable and incorrect. 401 is only permitted if an Authorization header is missing or insufficient, and the server “MUST send a WWW-Authenticate header field containing at least one challenge applicable to the target resource” (https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized). Presuming an account-specific status page endpoint, this cannot be satisfied; nothing the client can send will work, therefore it’s far more reasonably treated as a server error than a client error: the server has been instructed not to service these requests. “Service Unavailable” is clearly suitable. (Refusing the connection would also be reasonable, and have certain technical advantages for machine use.)