HTTP Status Codes: Complete List with API Testing Examples

The status code is the first thing every client reads in an API response, and the first thing a tester should assert. A login API that answers 200 OK with “invalid password” in the body, or a typo in a search that crashes with 500, are real bugs that ship to production every day. This lesson is your complete HTTP status codes reference for API testing: every code you will meet, what it means in real life, and how to test it on live endpoints.

The 5 Classes of HTTP Status Codes

Try Any Status Code Live

The practice API has a helper endpoint that returns whatever status you ask for: GET /status/{code}. Use it to check how your client, Postman tests or Playwright framework handle each code. Here is a 503 with a Retry-After header:

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/status/503"

Edit the URL to /status/201, /status/204, /status/409 and more. An invalid code such as /status/700 returns 400.

2xx Success Codes

200 vs 201 vs 204

• Create an order → 201 Created (not 200). The practice API’s POST /objects follows this rule.
• Fetch an order → 200 OK.
• Delete an order → 204 No Content.

3xx Redirection Codes

Practice: GET /redirect returns 302; POST /redirect?status=307 keeps the POST; POST /redirect?status=303 switches to GET. Conditional GET: request /products/101 with If-None-Match set to its ETag and you get 304. Details in HTTP headers and caching.

4xx Client Error Codes

The Confusing Pairs (Interview Favourites)

401 Unauthorized vs 403 Forbidden

A 401 should include a WWW-Authenticate header. Try it on the Basic auth endpoint with no credentials:

curl -i \
  "https://sqatools.in/wp-json/sqa-api/v1/basic/profile"

On the practice API, a missing API key gives 401, a wrong API key gives 403, and a viewer token trying to create gives 403.

400 Bad Request vs 422 Unprocessable Content

• 400: the server can’t even read it. Broken JSON, empty body, a JSON array instead of an object, text where a number is required in the URL.
• 422: the JSON is valid, but the values break business rules: invalid email, age out of range, unknown enum value.

curl -i \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"name":"A","email":"not-an-email","age":17}' \
  "https://sqatools.in/wp-json/sqa-api/v1/validate/user"

The response lists every failing field at once, which is the behaviour you want from a well-designed API.

404 Not Found vs 403 for Hidden Resources

For security, many APIs return 404 instead of 403 when you request another user’s private resource, so attackers can’t even learn that it exists. Both are acceptable; returning the data is not.

409 Conflict vs 412 Precondition Failed

409 is a business conflict (duplicate email). 412 is a technical version conflict when you send If-Match with an old ETag (optimistic locking). The practice API’s /objects supports both scenarios.

5xx Server Error Codes

Status Codes for Each HTTP Method

Automating Status Code Checks with Playwright

A data-driven test checks many codes in a few lines. Use maxRedirects: 0 to assert a redirect itself instead of following it.

import { test, expect } from '@playwright/test';

const BASE = 'https://sqatools.in/wp-json/sqa-api/v1';

const cases = [
  { name: 'existing user',      path: '/users/1',     expected: 200 },
  { name: 'missing user',       path: '/users/999',   expected: 404 },
  { name: 'non-numeric id',     path: '/users/abc',   expected: 400 },
  { name: 'page size too big',  path: '/users?per_page=51', expected: 400 },
  { name: 'no credentials',     path: '/basic/profile',     expected: 401 },
  { name: 'service down',       path: '/status/503',  expected: 503 },
];

for (const c of cases) {
  test(`GET ${c.path} -> ${c.expected} (${c.name})`, async ({ request }) => {
    const res = await request.get(`${BASE}${c.path}`);
    expect(res.status()).toBe(c.expected);
  });
}

test('redirect is 302 when not followed', async ({ request }) => {
  const res = await request.get(`${BASE}/redirect`, { maxRedirects: 0 });
  expect(res.status()).toBe(302);
  expect(res.headers()['location']).toBeTruthy();
});

test('503 tells the client when to retry', async ({ request }) => {
  const res = await request.get(`${BASE}/status/503`);
  expect(res.headers()['retry-after']).toBe('10');
});

Note: res.ok() is true only for 200-299. Playwright does not throw on 4xx/5xx by default, which is what you want for negative tests.

How to Report a Wrong Status Code

A good bug title: “POST /orders returns 500 instead of 422 when quantity is negative”. Include the full request (cURL), the actual and expected status, the response body, the trace or request id header and the environment. Developers fix these fast when they can replay the request.

Interview Questions: HTTP Status Codes