Various PAP REST APIs (primarily group delete) return 500 when an object (e.g., group, policy) cannot be found.  In those cases, they should return 404 instead.