API: Return 404 if user does not have access to group

Closes #15185 

After !3587 is merged, I'll update this one to also fix the return code of the tests in !3587.

See merge request !3683