For the OAuth DPoP, what should the error response for the missing DPoP header be?

For example:

GET /protected-resource HTTP/1.1
Host: resource.example.org
Authorization: DPoP VALID_TOKEN

Should the error code be 400 or 401, and what should be the error and error_description here?