Matching: pick the HTTP status code for each API case Intermediate

A status code is a contract: SDKs, retries, caches and dashboards act on it before anyone reads the body. Drag a code onto each request.

• Each explanation quotes the meaning from RFC 9110, RFC 6585 (429) or the Idempotency-Key Internet-Draft, so the answer is the spec, not a team convention.
• The most commonly confused pairs: 401 vs 403, 403 vs 404, 409 vs 412, 400 vs 422 and 429 vs 503.

Matching

Which HTTP status code should the API return?

Nine requests to an online shop API (/orders, /products, /exports). Drag the status code that best matches what happened. One card is not used.

Tip: first ask whose problem is it (client 4xx or server 5xx), then what exactly the client must change before trying again.

Tap Choose answer on each case. On a computer you can drag a card below onto a case.

403 Forbidden409 Conflict412 Precondition Failed422 Unprocessable Content404 Not Found429 Too Many Requests401 Unauthorized400 Bad Request202 Accepted503 Service Unavailable

Solved 0/9 · 0 mistakes

1The mobile app sends POST /orders and the body is cut off mid-way: the JSON parser fails at position 27.

Content-Type: application/json

{"sku": "SHOE-42", "qty": 

Choose answer ▾

2GET /orders arrives with a bearer access token that expired 2 minutes ago. The refresh token is still valid.

Authorization: Bearer eyJhbGciOi... (exp: 10:02, now: 10:04)

Choose answer ▾

3User 7 is logged in correctly and calls GET /orders/9001. Order 9001 exists but belongs to user 12. Order IDs are sequential, so they are easy to guess.

Choose answer ▾

4An admin edits a product price and sends PUT /products/42 with the ETag read 5 minutes ago. Another admin has saved a change since then; the current ETag is "v8".

PUT /products/42
If-Match: "v7"

Choose answer ▾

5The app retries POST /orders with the same Idempotency-Key as an order already completed, but the body now has qty: 2 instead of qty: 1.

Idempotency-Key: "6f1c2a8e-3d5b-4c7a-9e0f-1a2b3c4d5e6f"
{"sku": "SHOE-42", "qty": 2}

Choose answer ▾

6A retry of POST /orders with the same key and the same body arrives while the first request is still waiting on the payment gateway.

idempotency_keys: (user 7, POST /orders, K2) status = in_progress

Choose answer ▾

7A sync script calls GET /products 3,000 times a minute; the plan allows 600. The token bucket for this API key is empty for the next 20 seconds.

Choose answer ▾

8POST /orders cannot run: the inventory database is in a planned 10-minute maintenance window. The API itself is healthy.

Choose answer ▾

9POST /exports asks for a CSV of 2 million orders. Generating it takes about 3 minutes, so a worker does it in the background.

HTTP/1.1 ???
Location: /exports/77
{"status": "queued"}

Choose answer ▾

For the error body that goes with these codes, read API errors with RFC 9457. For 409 and 422 on retried POSTs, read Idempotency-Key.