diff --git a/pkg/web_api/mapfixes.go b/pkg/web_api/mapfixes.go
index 1acdb6c..9ae89d8 100644
--- a/pkg/web_api/mapfixes.go
+++ b/pkg/web_api/mapfixes.go
@@ -2,7 +2,6 @@ package web_api
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"time"
@@ -35,10 +34,10 @@ var(
 )
 
 var (
-	ErrCreationPhaseMapfixesLimit = errors.New("Active mapfixes limited to 20")
-	ErrActiveMapfixSameTargetAssetID = errors.New("There is an active mapfix for this map already")
+	ErrCreationPhaseMapfixesLimit = fmt.Errorf("%w: Active mapfixes limited to 20", ErrPermissionDenied)
+	ErrActiveMapfixSameTargetAssetID = fmt.Errorf("%w: There is an active mapfix for this map already", ErrPermissionDenied)
 	ErrAcceptOwnMapfix = fmt.Errorf("%w: You cannot accept your own mapfix as the submitter", ErrPermissionDenied)
-	ErrCreateMapfixRateLimit = errors.New("You must not create more than 5 mapfixes every 10 minutes")
+	ErrCreateMapfixRateLimit = fmt.Errorf("%w: You must not create more than 5 mapfixes every 10 minutes", ErrTooManyRequests)
 )
 
 // POST /mapfixes
diff --git a/pkg/web_api/security.go b/pkg/web_api/security.go
index 6a2ce11..9c8ac27 100644
--- a/pkg/web_api/security.go
+++ b/pkg/web_api/security.go
@@ -2,7 +2,7 @@ package web_api
 
 import (
 	"context"
-	"errors"
+	"fmt"
 
 	"git.itzana.me/strafesnet/go-grpc/auth"
 	"git.itzana.me/strafesnet/maps-service/pkg/api"
@@ -11,9 +11,9 @@ import (
 
 var (
 	// ErrMissingSessionID there is no session id
-	ErrMissingSessionID = errors.New("SessionID missing")
+	ErrMissingSessionID = fmt.Errorf("%w: SessionID missing", ErrUserInfo)
 	// ErrInvalidSession caller does not have a valid session
-	ErrInvalidSession = errors.New("Session invalid")
+	ErrInvalidSession = fmt.Errorf("%w: Session invalid", ErrUserInfo)
 )
 
 type UserInfoHandle struct {
diff --git a/pkg/web_api/service.go b/pkg/web_api/service.go
index 6049b75..af2352c 100644
--- a/pkg/web_api/service.go
+++ b/pkg/web_api/service.go
@@ -12,6 +12,8 @@ import (
 )
 
 var (
+	ErrBadRequest = errors.New("Bad request")
+	ErrTooManyRequests = errors.New("Too many requests")
 	// ErrPermissionDenied caller does not have the required role
 	ErrPermissionDenied = errors.New("Permission denied")
 	// ErrUserInfo user info is missing for some reason
@@ -26,7 +28,7 @@ var (
 	ErrPermissionDeniedNeedRoleMapDownload = fmt.Errorf("%w: Need Role MapDownload", ErrPermissionDenied)
 	ErrPermissionDeniedNeedRoleScriptWrite = fmt.Errorf("%w: Need Role ScriptWrite", ErrPermissionDenied)
 	ErrPermissionDeniedNeedRoleMaptest = fmt.Errorf("%w: Need Role Maptest", ErrPermissionDenied)
-	ErrNegativeID = errors.New("A negative ID was provided")
+	ErrNegativeID = fmt.Errorf("%w: A negative ID was provided", ErrBadRequest)
 )
 
 type Service struct {
@@ -49,14 +51,20 @@ func NewService(
 // Used for common default response.
 func (svc *Service) NewError(ctx context.Context, err error) *api.ErrorStatusCode {
 	status := 500
-	if errors.Is(err, datastore.ErrNotExist) {
-		status = 404
+	if errors.Is(err, ErrBadRequest) {
+		status = 400
+	}
+	if errors.Is(err, ErrUserInfo) {
+		status = 401
 	}
 	if errors.Is(err, ErrPermissionDenied) {
 		status = 403
 	}
-	if errors.Is(err, ErrUserInfo) {
-		status = 401
+	if errors.Is(err, datastore.ErrNotExist) {
+		status = 404
+	}
+	if errors.Is(err, ErrTooManyRequests) {
+		status = 429
 	}
 	return &api.ErrorStatusCode{
 		StatusCode: status,
diff --git a/pkg/web_api/submissions.go b/pkg/web_api/submissions.go
index 3521638..2778b5c 100644
--- a/pkg/web_api/submissions.go
+++ b/pkg/web_api/submissions.go
@@ -2,7 +2,6 @@ package web_api
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"time"
@@ -26,13 +25,13 @@ var(
 )
 
 var (
-	ErrCreationPhaseSubmissionsLimit = errors.New("Active submissions limited to 20")
-	ErrUploadedAssetIDAlreadyExists = errors.New("The submission UploadedAssetID is already set")
-	ErrReleaseInvalidStatus = errors.New("Only submissions with Uploaded status can be released")
-	ErrReleaseNoUploadedAssetID = errors.New("Only submissions with a UploadedAssetID can be released")
+	ErrCreationPhaseSubmissionsLimit = fmt.Errorf("%w: Active submissions limited to 20", ErrPermissionDenied)
+	ErrUploadedAssetIDAlreadyExists = fmt.Errorf("%w: The submission UploadedAssetID is already set", ErrPermissionDenied)
+	ErrReleaseInvalidStatus = fmt.Errorf("%w: Only submissions with Uploaded status can be released", ErrPermissionDenied)
+	ErrReleaseNoUploadedAssetID = fmt.Errorf("%w: Only submissions with a UploadedAssetID can be released", ErrPermissionDenied)
 	ErrAcceptOwnSubmission = fmt.Errorf("%w: You cannot accept your own submission as the submitter", ErrPermissionDenied)
-	ErrCreateSubmissionRateLimit = errors.New("You must not create more than 5 submissions every 10 minutes")
-	ErrDisplayNameNotUnique = errors.New("Cannot submit: A map exists with the same DisplayName")
+	ErrCreateSubmissionRateLimit = fmt.Errorf("%w: You must not create more than 5 submissions every 10 minutes", ErrTooManyRequests)
+	ErrDisplayNameNotUnique = fmt.Errorf("%w: Cannot submit: A map exists with the same DisplayName", ErrPermissionDenied)
 )
 
 // POST /submissions