From my experience, every company decides the format for itself. Sometimes it's just enough to rely on REST error codes and return an empty body. Sometimes the team chooses to use their own error codes (and in that case error details can be found in API docs), in my current company we use "message" and "description" json fields in all our APIs but I can't say there is really some standard or best practice.