Security experts gave me the hint to avoid returning internal structures in case of any errors. If for example an invalid date format is given, only the 400 error should be sent back to the caller but no detailed message: