BugForge
All lessons
Core · 02/05 4 min

HTTP status codes that tests check

200 vs 201 vs 204, 400 vs 422, 401 vs 403, 404 vs 409: pick the right one every time.

2xx
3xx
4xx
5xx
201
Created

POST created a resource. Return it (or its id); optionally a Location header.

Tests assert status codes precisely, so a correct body with the wrong code still fails. The voxel board above groups them by class. Click any block for when to use it.

Quick decisions

  • Created something → 201 (plus the new resource). Deleted with nothing to return → 204.
  • Client sent garbage (bad JSON, bad id, failed validation) → 400.
  • No/invalid credentials → 401. Valid credentials, not allowed → 403.
  • Resource doesn't exist → 404. Unique constraint / state conflict → 409.
  • Rate limited → 429 with Retry-After.
  • Your code threw unexpectedly → 500. That should be rare; most "500s" in debugging labs are really 400s or 404s.
Next in Core
Concurrency, retries & idempotency