Sorry for the very late response.
The response body isn't what's wrong, but the response status.
If the credentials are wrong you typically will return the proper state,
as the request wasn't "OK" (as you gave it the wrong credentials or parameters etc) so the state should reflect that.
403 for bad credentials for example.
Of course responding with a error message in the body is very much appreciated as well.
I don't have access to it right at this moment so i will have to comeback to after checking that the body is informative, i believe it's like yours there.
Sorry once again for being so late will have to make sure i setup notifications correctly.