400 would be more correct, i.e. the request contained invalid data. 403 would imply some kind of permisions error, i.e. the request was well formed and correct but the action was not allowed.

400 would be more correct, i.e. the request contained invalid data. 403 would imply some kind of permisions error, i.e. the request was well formed and correct but the action was not allowed. If i was writing code to consume a web service and i got a 403 error it would never occur to me that it was because i was sending invalid data, it would be very confusing indeed.