API will never return 403.

As RFC says in http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4:

403 Forbidden
(...) If the server does not wish to make this information available to the
client, the status code 404 (Not Found) can be used instead.

documentation/source/rest.rst

@@ -86,10 +86,6 @@ For servers using Bearer token authentication::
 
 The request can not be fulfilled because account is locked.
 
-403 Forbidden
-~~~~~~~~~~~~~
-Wrong SSL key used or access to invalid ID.
-
 404 Not Found
 ~~~~~~~~~~~~~
 Request to non existing resource made.