The status code that gets returned should be the status code of the messenger and not the data. If you want to add a status code about the data, then please do.
If something can return null and empty and it’s valid, that is not a 404. That is a 200.
As far as a 403, the messenger is telling you that you shall not pass. There is no data. 403 is appropriate here. The return response can be anything since 403 is pretty self explanatory, but I would probably return json to be consistent. I would also use the field message. Something like the first one for this use case only.
In other cases where i do get data, I would use data, message, status (optional). But status in the json response would be status about the message.
Do YOU love yourself for who you are? Do you accept yourself and all your imperfections? Is there anything you are not happy with about yourself that you can change?
This is all that matters. Stop trying to push things and appreciate what you have. If there is something about yourself that you can change, then change it. Otherwise, stop worrying about what others think and learn to love yourself.
When you figure this out and learn this, everything else will follow. How can others love you, if you don’t even love yourself?