404 > 403

This only works if checking the policy takes the same amount of time as checking for existence.

1/2 I think there is something to be said about the DX of such APIs though. As an example, we are using jFrog artifactory which returns 404 if a user does not have permissions to get a package from the npm registry.

As long as the endpoint is not already documented, otherwise it's just silly to not use 403