Stop 08 · API TestingTopics · 2/9

HTTP Methods & Status Codes

In short

The method says what you want done. The status code says what actually happened. Get fluent in both and API responses start reading like plain sentences.

GET, POST, PUT, PATCH, DELETE — the verbs indicating what kind of operation a request represents — paired with status codes (200, 400, 404, 500) telling you what happened, both essential for API test verification.

The purple blob as a bank clerk stamps a slip handed over by a customer with a token.

Think of it like this

The bank counter stamp

At the bank you deposit, check balance, update your address or close an account. The clerk stamps each slip: done, created, rejected for missing signature, or 'server down, come later'. Methods are your slips. Status codes are the stamps.

Watch it happen

Status codes you'll see every week

200

201

204

400

401

403

404

409

500

503

1/5The first digit tells the family. 2xx good, 4xx your request's fault, 5xx the server's fault.

The big ideas

What you need to know

GET reads

GET fetches data and should never change anything. Calling it twice gives the same result.

POST creates

POST sends a body to create something new. Usually returns 201 and the new item.

PUT vs PATCH

PUT replaces the whole resource. PATCH changes only the fields you send.

DELETE removes

DELETE removes a resource. A second GET on it should then return 404.

See it in code

Walk through the code

python

1import requests2 3BASE = "https://jsonplaceholder.typicode.com"4 5print(requests.get(f"{BASE}/posts/1").status_code)            # 2006print(requests.post(f"{BASE}/posts", json={"title": "Hi"}).status_code)  # 2017print(requests.put(f"{BASE}/posts/1", json={"title": "New"}).status_code)  # 2008print(requests.patch(f"{BASE}/posts/1", json={"title": "Edit"}).status_code)  # 2009print(requests.delete(f"{BASE}/posts/1").status_code)         # 20010print(requests.get(f"{BASE}/posts/99999").status_code)        # 404

1/3A read returns 200 with the post in the body.

All five methods against a practice API. JSONPlaceholder fakes writes, so nothing is really saved.

Save yourself the pain

Common mistakes

Oops

Accepting 200 OK with an error message hidden in the body.

Do this instead

Errors should use proper 4xx or 5xx codes. Flag APIs that hide failures behind 200.

Oops

Treating 401 and 403 as the same thing.

Do this instead

401 means not logged in or bad token. 403 means logged in but not allowed.

Your mission

Collect all the stamps

~25 min

Quick check

A user is logged in but tries to open another user's invoice. What should the API return?

Go deeper

1Send requests using each major HTTP method against a sample API and note the responses.
2Memorize the 5 status code classes (1xx-5xx) and what each range signals.
3Practice writing a test asserting the correct status code for both valid and invalid requests.