But it seems to be outdated (or wrong) at some places.
E.g., if I submit GET {application_url}/api/user/{userid} providing a user id that does not belong to the given application, I do not get any of the listed error responses but HTTP code 422 along with
Well, in the given example the question is: when will I actually get status code 404 for a missing user? 422 seems to be a “multi-purpose” status code and it looks as if it would have priority over other codes which one would expect instead…
User IDs (and App IDs) are hashed using a specific algorithm. If they can’t be decoded (if you substitute a random string) then a 422 will be returned. If you supply a valid (decodeable) user ID, but the user does not exist or has been removed, then a 404 will be returned.