Having a more specific error code/description in the body of the response is fine, it's using yours instead of HTTP's that's a problem. In the Posterous example

Having a more specific error code/description in the body of the response is fine, it's using yours instead of HTTP's that's a problem. In the Posterous example that was linked, "Invalid site id" sounds a lot like 404, "User does not have access to this site" sounds a lot like 401 or 403, etc.