HTTP Methods & Status Codes

Every request carries a method (what you want to do) and every response carries a status code (how it went). Master these two vocabularies and HTTP APIs stop feeling mysterious.

HTTP Methods

The method is the verb — it states your intent. The common ones map neatly to CRUD operations:

GET    /users        → list users
POST   /users        → create a user
GET    /users/42     → fetch user 42
PATCH  /users/42     → update part of user 42
DELETE /users/42     → delete user 42

Safe and Idempotent

Two properties tell you whether a method is "dangerous" to repeat:

• Safe — doesn't change server state. GET is safe; you can fetch a page a thousand times without side effects.
• Idempotent — repeating it has the same effect as doing it once. PUT and DELETE are idempotent (deleting user 42 twice leaves it deleted). POST is not — submitting a form twice may create two records.

GET     safe + idempotent
PUT     idempotent (not safe)
DELETE  idempotent (not safe)
POST    neither — repeating may duplicate

Status Codes by Category

The first digit tells you the category — learn the ranges before the specifics:

The 4xx vs 5xx distinction is crucial: 4xx is the client's fault (bad request, not logged in), 5xx is the server's fault (it crashed). When debugging, the category tells you which side to look at.

The Codes You'll Actually See

200 OK                  request succeeded
201 Created             POST created a resource
204 No Content          success, nothing to return (e.g. DELETE)
301 Moved Permanently   resource lives at a new URL now
304 Not Modified        use your cached copy
400 Bad Request         malformed request
401 Unauthorized        you're not authenticated
403 Forbidden           authenticated, but not allowed
404 Not Found           no such resource
429 Too Many Requests   you're being rate-limited
500 Internal Server Error  the server threw
503 Service Unavailable    server overloaded or down

Check Your Understanding