Quiz
Warm-up spanning the course. A request hits POST /login with a wrong password for a real account. Combining lessons 3-3 and 7-4: status code and message?
The spec
Time to design a complete service: a personal notes API. Requirements: users sign up, log in, and manage only their own notes.
Applying unit 4's grid, the whole surface is six endpoints:
| Endpoint | Purpose | Auth? | Success |
|---|---|---|---|
POST /signup | create account (hash the password, lesson 7-1) | no | 201 |
POST /login | verify password, start a session (lesson 7-2) | no | 200 |
GET /notes | list my notes, paginated (lesson 4-2) | yes | 200 |
POST /notes | create a note (validated, lesson 5-3) | yes | 201 |
PUT /notes/:id | update my note | yes | 200 |
DELETE /notes/:id | delete my note | yes | 204 |
Failures reuse the lesson 4-3 shape everywhere: 401 unauthorized when not logged in, 403 for someone else's note, 404 for a missing id, 400 invalid_input from validation, 429 from the limiter on /login.
Quiz
A logged-in user requests PUT /notes/17. Note 17 exists but belongs to another user. Walking the pipeline: which stage rejects it, and with what?
Problem
Design check: POST /notes succeeds and the new note is returned to the client. Which status code does the response carry? Answer with the number.