What if you need to communicate an error reason with your status code? E.G. distinguishing between Forbidden because you don't have some permission and forbidden because you're not friends with some user.
I like to return a error code property for each particular error case in the JSON body of the response. This allows you to determine exactly where in the code the error is from, and also allows the client to do fine-grained error handling in the UI if required. I've also found it incredibly useful to include a unique error ID with each request that is also logged server side, so that you can pinpoint the request in your logs and look up the context including previous and next requests.
Can you just add the reason in the response? Don't need a super specific error code for this. Could also be a 400 since users should not be asking for information on people they are not friends with, that seems like something is wrong with the request.
