According to https://developer.atlassian.com/display/CROWDDEV/Crowd+REST+Resources#CrowdRESTResources-GroupResource, Crowd should return a 404 status code if any of the following two request are made:

/rest/usermanagement/1/user/group/direct?username=invalid
/rest/usermanagement/1/group/user/direct?groupname=invalid

given that invalid is not a valid group or user name

However, currently an empty list of groups/users is returned along with a 200 status.