Use 404 Not found.
The 404 status code can also be used in 403 scenarios, when the server
does not want to send back the reason why it is refusing to serve the
request. A good example is when the server senses some kind of an
attack, which might be a brute force attack. In this case, the
server responds with a 404 Not found instead of a 403 Forbidden and an
explanation.
Source: Pro ASP.NET Web API Security