HTTP Status Codes

401 Unauthorized means the request lacks valid authentication — the client is not identified. 403 Forbidden means the client is identified (authenticated) but does not have permission to access the resource. Think of 401 as 'who are you?' and 403 as 'I know who you are, but you cannot do this.'

Use 400 Bad Request when the request is malformed — invalid JSON syntax, missing required headers, or an unparseable body. Use 422 Unprocessable Entity when the JSON is syntactically valid but fails business validation — for example, a date in the past when a future date is required, or an email that already exists.

Both are temporary redirects. The key difference is method preservation: 302 allows the client to change the method (POST to GET) on redirect, while 307 strictly preserves the original method. Use 307 when you redirect a POST and want the client to re-POST to the new location.

204 is used for successful operations that produce no output — typically DELETE or PATCH when there is nothing meaningful to return. Sending a body with a 204 is technically allowed but ignored by most clients.

A 429 Too Many Requests response should include a Retry-After header indicating when the client can try again. You can specify an absolute date or a number of seconds. Also include rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) so clients can manage their request rate proactively.