If it were me I would return a 404 or 400 here and not a 401 as it’s not because they aren’t authorized but what they are trying to do doesn’t exist.
Your also sending a bit of mixed message here:
401 is unauthorized, 403 is forbidden:
And you have all these method available to you (it’s where those return ctx.* come from):