The request does not contain an access token. The service implementation should return "400 Bad Request" to the client application.

The access token does not cover the required scopes. The service implementation should return "403 Forbidden" to the client application.

The request from the service implementation was wrong or an error occurred in Authlete. The service implementation should return "500 Internal Server Error" to the client application.

The access token is valid. The service implementation should return the protected resource to the client application.

The access token does not exist or has expired. The service implementation should return "401 Unauthorized" to the client application.