HTTP Status Codes — Decision Guide for REST APIs
Fast recall
Quick revision
Core answer
Correct usage of 401 vs 403, 400 vs 422, 200 vs 204
Using 200 for everything including errors, or returning 400 for all validation errors instead of 422
Explain the semantic distinction between 401 (not authenticated) and 403 (authenticated but not authorized)
Interview-ready guide
Interview answer
HTTP status codes are a contract with API clients. Returning 200 for everything or 400 for all errors forces clients to parse the response body to understand what happened — defeating the purpose of the protocol.
The decision tree
200 OK— successful GET, successful PATCH/PUT with response body201 Created— successful POST that created a resource; must includeLocation: /resource/idheader204 No Content— successful DELETE or PUT with no body to return400 Bad Request— malformed request syntax, invalid JSON, missing required field that prevents parsing401 Unauthorized— no credentials provided or credentials invalid; client should authenticate403 Forbidden— credentials valid, but insufficient permission for this resource or operation404 Not Found— resource does not exist; also used intentionally to hide existence of restricted resources409 Conflict— optimistic lock conflict, duplicate key, state machine violation422 Unprocessable Entity— syntactically valid request, but violates business rules (transfer amount exceeds balance)429 Too Many Requests— rate limit exceeded; includeRetry-Afterheader
The 401 vs 403 distinction is the most common interview checkpoint: 401 = 'I don't know who you are'; 403 = 'I know who you are, but no'.
HTTP Status Codes — Decision Guide for REST APIs
Direct Answer
Use 2xx for success (200 OK, 201 Created, 204 No Content), 4xx for client errors (400 validation, 401 unauthenticated, 403 unauthorized, 404 not found, 409 conflict, 422 unprocessable), 5xx for server errors (500 internal, 503 unavailable).
Common Mistakes & Pitfalls
Using 200 for everything including errors, or returning 400 for all validation errors instead of 422
Check your understanding
Answer these without looking back at the article.
- Should you return 404 or 403 when an authenticated user tries to access another user's resource?
- What should a 429 response include to help clients retry?
- How do you implement consistent error response bodies in Spring Boot?
Related interview prep categories
1Want a guided curriculum order?
These modules are also sequenced in our flagship backend interview track — open it when you prefer an ordered path instead of browsing by topic.