HTTP status codes are three-digit numbers a server returns with every response to show what happened to a request. Codes in the 200s mean success, 300s redirection, 400s a problem with the request, and 500s a server error.
Why it matters: API consumers rely on status codes to decide what to do next, such as retry, show an error or carry on. A wrong code can make an application behave in strange ways, even when the response body looks fine.
In practice: Checking status codes is one of the simplest and most valuable assertions in API testing. Testers check the success case and the failure cases: missing fields, invalid values, unauthorised requests and resources that don't exist.
Examples:
- Asserting that a request with a missing field returns 400 rather than 500.
- Checking that a deleted resource returns 404 on the next request.
Common pitfalls:
- Returning 200 with an error message in the body, which hides failures from consumers.
- Returning 500 for bad input that should be a 400, which makes server problems look worse than they are.
What's the difference between a 4xx and a 5xx error? A 4xx error means the problem is with the request, such as missing data or no permission. A 5xx error means something went wrong on the server.
