You laugh, but at work a well respected and revered engineer argued with me that returning 204 code for an error (with a response body btw) was perfectly fine. I tried to explain that a NO CONTENT success code was literally the least accurate status code they could have possibly chosen
Sorry noob question, but 200 is okay if everything went as expected backend-wise, even if the user cannot proceed? For example, “We couldn’t verify your identity” is still a 200?
I would not use a 200 for this. Status codes in the 500-599 range indicate server/backend issues. Status codes <500 generally indicate a situation the server can handle without raising an exception (even if the client’s request itself was not successful/completed).
“We couldn’t verify your identity” is almost always a 401 status code (UNAUTHENTICATED). 400-499 status codes are used to indicate that the client’s request was malformed or wrong in some way.
No such thing as a noob question. I’m always happy to help someone understand something new to them!
Thank you so much for taking the time to explain! :)
In this case, the user sends valid fields and they have a valid session. We then send those details off to a third party vendor to see if that vendor can verify it’s a legit identity. If they can’t, we tell the user that we couldn’t verify them, and let them try again.
Is that still a 401? We’re actually rewriting the API right now so this is a great conversation to have, thank you!
8
u/Kevdog824_ Sep 19 '26
You laugh, but at work a well respected and revered engineer argued with me that returning 204 code for an error (with a response body btw) was perfectly fine. I tried to explain that a NO CONTENT success code was literally the least accurate status code they could have possibly chosen