How to throw a 400 bad request from a symfony controller?

you can specify the return code like this:

return new JsonResponse($output, 400);

You can simply throw a exception that get automatically transformed to a HTTP 400 response:

throw new BadRequestHttpException('Message');

If you want to be specific about the thrown http error code (maybe you want to throw an obscure error code like 418) you can pass it as the third parameter:

throw new BadRequestHttpException('Message', null, 418);