diff --git a/changes/17157-translate-api-error b/changes/17157-translate-api-error
new file mode 100644
index 0000000000..f9c9573e15
--- /dev/null
+++ b/changes/17157-translate-api-error
@@ -0,0 +1,3 @@
+- Fix a bug where the translate API returned "forbidden" instead of "bad request" for an empty JSON body.
+- Fixed an uncaught bug where "forbidden" would be returned for invalid payload type, which should
+  also be a bad request.
diff --git a/server/service/integration_core_test.go b/server/service/integration_core_test.go
index 41b8f74a54..33e07a0465 100644
--- a/server/service/integration_core_test.go
+++ b/server/service/integration_core_test.go
@@ -690,6 +690,11 @@ func (s *integrationTestSuite) TestTranslator() {
 	require.Len(t, payload.List, 1)
 
 	assert.Equal(t, s.users[payload.List[0].Payload.Identifier].ID, payload.List[0].Payload.ID)
+
+	// empty body
+	s.DoJSON("POST", "/api/latest/fleet/translate", &translatorRequest{}, http.StatusBadRequest, &payload)
+
+	s.DoJSON("POST", "/api/latest/fleet/translate", &translatorRequest{List: []fleet.TranslatePayload{{Type: "notavalidtype", Payload: fleet.StringIdentifierToIDPayload{}}}}, http.StatusBadRequest, &payload)
 }
 
 func (s *integrationTestSuite) TestVulnerableSoftware() {
diff --git a/server/service/translator.go b/server/service/translator.go
index 078fbf09d9..f81177e6b4 100644
--- a/server/service/translator.go
+++ b/server/service/translator.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
 )
@@ -61,6 +62,12 @@ func translateHostToID(ctx context.Context, ds fleet.Datastore, identifier strin
 }
 
 func (svc *Service) Translate(ctx context.Context, payloads []fleet.TranslatePayload) ([]fleet.TranslatePayload, error) {
+	if len(payloads) == 0 {
+		// skip auth since there is no case in which this request will make sense with no payloads
+		svc.authz.SkipAuthorization(ctx)
+		return nil, badRequest("payloads must not be empty")
+	}
+
 	var finalPayload []fleet.TranslatePayload
 
 	for _, payload := range payloads {
@@ -88,7 +95,15 @@ func (svc *Service) Translate(ctx context.Context, payloads []fleet.TranslatePay
 			}
 			translateFunc = translateHostToID
 		default:
-			return nil, fleet.NewErrorf(fleet.ErrNoUnknownTranslate, "Type %s is unknown.", payload.Type)
+			// if no supported payload type, this is bad regardless of authorization
+			svc.authz.SkipAuthorization(ctx)
+			return nil, badRequestErr(
+				fmt.Sprintf("Type %s is unknown. ", payload.Type),
+				fleet.NewErrorf(
+					fleet.ErrNoUnknownTranslate,
+					"Type %s is unknown.",
+					payload.Type),
+			)
 		}
 
 		id, err := translateFunc(ctx, svc.ds, payload.Payload.Identifier)