The five families
The status code is the one part of your response that machines act on without human help: browsers decide whether to show or redirect, caches decide whether to store, client code decides whether to retry, and monitoring dashboards decide whether to page someone at night. Pick a wrong code and that machinery misbehaves, a cache stores your error page, or an uptime monitor sleeps through an outage.
Status codes group by their first digit:
| Family | Meaning | You will mostly use |
|---|---|---|
| 1xx | informational | (rare) |
| 2xx | success | 200 OK, 201 created, 204 done, no body |
| 3xx | redirect | 301 moved permanently |
| 4xx | the client did something wrong | 400, 401, 403, 404, 409, 429 |
| 5xx | the server broke | 500 internal error, 503 unavailable |
The 4xx codes worth memorizing:
400bad request: the input is malformed or invalid.401unauthorized: we do not know who you are (not logged in). Badly named, it really means unauthenticated.403forbidden: we know who you are, and you are not allowed.404not found: no such resource.409conflict: the request clashes with current state (email already taken).429too many requests: slow down (rate limiting, unit 8).
A correct status code is not cosmetic. Clients, caches, browsers, and monitoring tools all change behavior based on it.
Quiz
A request to POST /signup has a syntactically valid body, but the email is already registered. Best status code?
Quiz
DELETE /notes/7 succeeds, and the server has nothing useful to put in a body. The response should be:
Code exercise · javascript
Your turn. Complete statusFor so each situation maps to the right code: "not logged in" -> 401, "logged in but not allowed" -> 403, "invalid input" -> 400. Use the table from above.
Problem
A logged-in user sends DELETE /posts/9. The post exists, the request is well-formed, and authentication succeeded, but the post belongs to a different user. Which status code should the API return? Answer with just the number.