Stop 01 · Internet & Backend BasicsTopics · 7/15

HTTP Status Codes

In short

A status code is the first thing a client reads. Return 200 for an error and the app shows 'Success!' while nothing actually worked. Three digits, big consequences.

Three-digit codes (200, 201, 400, 401, 404, 500...) that tell the client what happened with their request — precise status codes make an API self-documenting.

The mascot clerk stamps a pile of forms with green, yellow and red stamps.

Think of it like this

The college office stamps

Hand in a form and the clerk stamps it: approved, go to another room, filled in wrong, not allowed, or 'system down, come tomorrow'. You know what to do next without reading a letter. Status codes are those stamps on every response.

Watch it happen

The codes you'll actually use

200

201

204

301

400

401

403

404

429

500

1/62xx means it worked. 200 OK for reads, 201 Created after a POST, 204 No Content when there's nothing to send back.

The big ideas

What you need to know

The first digit is the family

2xx success, 3xx redirect, 4xx the client made a mistake, 5xx the server made one.

4xx vs 5xx decides blame

Monitoring tools usually alert you on 5xx, because those are your bugs. A spike of 4xx often means a client is misusing the API.

Codes plus a message

Pair an error code with a short JSON body like { "error": "email is required" } so clients can show something useful.

Clients act on codes

Apps retry on 503, ask the user to log in on 401, and stop retrying on 400. Wrong codes cause wrong behaviour.

See it in code

Walk through the code

1app.post("/signup", async (req, res) => {2  const { email } = req.body ?? {};3  if (!email) return res.status(400).json({ error: "email is required" });4 5  if (await users.exists(email)) {6    return res.status(409).json({ error: "email already registered" });7  }8 9  try {10    const user = await users.create(email);11    res.status(201).location(`/users/${user.id}`).json(user);12  } catch (err) {13    console.error(err);14    res.status(500).json({ error: "Something went wrong, please try again" });15  }16});

1/4Missing input is the client's fault, so reply 400 with a clear message.

users is a stand-in for your database layer. 409 Conflict means the request clashes with existing data, here a duplicate email.

Save yourself the pain

Common mistakes

Oops

Returning 200 with { "success": false } for errors.

Do this instead

Use the real code, like 400, 404 or 500. Clients, proxies and monitoring tools read the status before the body.

Oops

Sending the full error stack trace in a 500 response.

Do this instead

Log the stack on the server and send a short message. Stack traces leak file paths and library versions to attackers.

Your mission

Status code audit

~20 min

Quick check

A logged-in student calls the admin dashboard API. Their token is valid, but they aren't an admin. Which code fits?

Go deeper

1Memorize the 5 status code classes (1xx-5xx) and what each range signals.
2Practice returning the correct status code for common scenarios (created, not found, validation error).
3Learn the difference between 401 (unauthenticated) and 403 (unauthorized).