What are common HTTP status codes in an API?
HTTP status codes tell the client what happened with a request. They are grouped by the first digit: 2xx means success, 3xx means redirect, 4xx means the client made a mistake, and 5xx means the server failed. Common ones are 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 404 Not Found, and 500 Internal Server Error.
- 2xx means success, 3xx redirection, 4xx client error, and 5xx server error.
- Common codes are 200 OK, 201 Created, 400 Bad Request, 404 Not Found, and 500 Server Error.
- Returning the right code makes an API predictable for clients.
The groups
- 2xx success: 200 OK, 201 Created, 204 No Content.
- 3xx redirect: 301 Moved Permanently, 304 Not Modified.
- 4xx client error: 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests.
- 5xx server error: 500 Internal Server Error, 503 Service Unavailable.
The key distinction is 4xx versus 5xx. A 4xx means the client sent something wrong, like a bad body or missing token. A 5xx means the request was fine but the server broke while handling it.
Know the difference between 401 and 403. 401 means you are not authenticated, so you need to log in, while 403 means you are logged in but not allowed. Mixing these up is a common mistake interviewers watch for.
Frequently asked questions
What is the difference between 401 and 403?
401 Unauthorized means you are not authenticated, so the server does not know who you are. 403 Forbidden means you are known but not allowed.
When should you return 201?
Return 201 Created after successfully creating a resource, typically with a Location header pointing to the new resource's URL.
Common follow up questions
Related interview questions
Want the full API Design guide?
Read every API Design concept with notes, diagrams, and code in one place. Track your progress as you go.
Open the API Design guide All API Design questions