Blog

HTTP Method and Status Code Semantics: Safe, Idempotent, PUT or PATCH, and Choosing 200/201/202/204/409/412/422

Choosing methods and status codes should rest on RFC 9110's definitions of safe and idempotent and on a decision rule the team writes down once: 400 for a malformed request, 422 for a valid request a business rule rejects, 409 for a conflict with the resource's state, 412 for an If-Match mismatch. With real responses from Bookstore we cover 201 and Location with POST, creating with PUT, 415 and Accept-Patch with JSON Merge Patch, and the split between 401, 403, 404 and 405.