1 or 3; maybe 4.
With several assumptions made, ultimately, they're asking for json, and we should still return json, but what that looks like is up to you. It should be static enough that the person on the other end can write:
If json.grtnode(error) == "unauthorized access"
Do stuff
Ifnyour going to be changing the text with some regularity to contain relevant information for the error (eg, an item ID, that is now invalid), then consider a code/text and additional fields.
I've had... thoughts on this lately.
I do social dance (wcs) as one of my several hobbies. And I kind of compare ot to church now. We go once a week, we do the thing, and we have a community around it, with community leaders.
The world might be slowly leaving religion behind, but I have to wonder of we're losing something else in the process.
(Find some WCA classes in your area, we're all weird as fuck, it's a often a community of introverts with a niche interest in common, and set rules of interaction (would you like a dance?))