What Do the HTTP Status Code Families Mean?
Understand the five HTTP status code families — 1xx to 5xx — and when to use 200, 201, 401, 403, 404, and 500 in a REST API.
Expected Interview Answer
HTTP status codes are grouped into five families by their leading digit — 1xx informational, 2xx success, 3xx redirection, 4xx client error, and 5xx server error — and choosing the right specific code within the right family is what makes an API predictable for clients.
A 1xx response like 100 Continue is an interim signal sent before the final response, rarely handled directly by application code. 2xx codes confirm the request succeeded, with 200 OK for a general success, 201 Created after a resource is made, and 204 No Content when there is no response body to return. 3xx codes tell the client to look elsewhere, such as 301 for a permanent move or 304 Not Modified for cache revalidation. 4xx codes mean the client sent something wrong — 400 for a malformed request, 401 when authentication is missing or invalid, 403 when the authenticated user lacks permission, 404 when the resource does not exist, and 409 for a conflicting state. 5xx codes mean the server itself failed to fulfill an otherwise valid request, with 500 as the generic failure and 503 signaling temporary unavailability; picking 4xx versus 5xx correctly is critical because it tells the client and monitoring systems whether the problem is fixable by changing the request or is entirely on the server side.
- Lets clients programmatically branch on outcome without parsing response bodies
- Distinguishes client-fixable errors (4xx) from server-side failures (5xx) for correct retry logic
- Enables HTTP-aware infrastructure like caches and load balancers to act on standard codes
- Improves API observability since monitoring tools can alert on status code families directly
AI Mentor Explanation
Status code families are like a match umpire\u2019s signal system. A raised hand meaning “over in progress” is like a 1xx interim signal — the play is not finished yet. A clean boundary signal is like a 2xx success — the ball was legally hit for four, no issues. A signal sending the ball to a review screen is like a 3xx redirect — go check somewhere else before the final call. A no-ball called against the bowler is like a 4xx client error — the fielding side did something wrong. A floodlight failure halting play entirely is like a 5xx server error — the fault lies with the venue, not either team.
Step-by-Step Explanation
Step 1
Check the leading digit
Identify the family first: 1xx info, 2xx success, 3xx redirect, 4xx client error, 5xx server error.
Step 2
Pick the specific code within the family
Choose the precise code that matches the outcome, e.g. 201 vs 200, or 401 vs 403.
Step 3
Distinguish 4xx from 5xx carefully
Ask whether the client could fix the problem by changing the request (4xx) or the fault is entirely server-side (5xx).
Step 4
Pair with a meaningful response body
Return an error payload with detail/code fields so clients can act on the status programmatically.
What Interviewer Expects
- Fluency across all five status code families and their meaning
- Correct distinction between 401 (unauthenticated) and 403 (unauthorized)
- Correct distinction between 4xx (client fault) and 5xx (server fault)
- Awareness of specific common codes: 200, 201, 204, 301, 304, 400, 404, 409, 500, 503
Common Mistakes
- Using 401 when the real problem is a lack of permission (should be 403)
- Returning 200 for an error response with an error message in the body
- Confusing 404 (resource not found) with 400 (malformed request)
- Defaulting everything to 500 instead of using the right 4xx for client mistakes
Best Answer (HR Friendly)
“HTTP status codes are grouped by their first digit: 1xx means the request is still in progress, 2xx means it succeeded, 3xx means the client should look somewhere else, 4xx means the client made a mistake like sending bad data, and 5xx means the server itself failed. Using the right specific code in the right family helps client applications react correctly without guessing.”
Code Example
app.get('/orders/:id', async (req, res) => {
const order = await db.orders.findById(req.params.id)
if (!order) {
return res.status(404).json({ error: 'Order not found' })
}
if (order.ownerId !== req.user.id) {
return res.status(403).json({ error: 'Not authorized to view this order' })
}
res.status(200).json(order)
})
app.post('/orders', async (req, res) => {
if (!req.body.items?.length) {
return res.status(400).json({ error: 'Order must include at least one item' })
}
const order = await db.orders.create(req.body)
res.status(201).json(order) // resource created
})Follow-up Questions
- What is the difference between 401 Unauthorized and 403 Forbidden?
- When should an API return 409 Conflict instead of 400 Bad Request?
- What does 304 Not Modified mean, and when does a server return it?
- Why might returning 200 with an “error: true” field in the body be considered an anti-pattern?
MCQ Practice
1. What does a 4xx status code family generally indicate?
4xx codes signal that the problem originates from the client\u2019s request, such as bad input or missing auth.
2. Which status code should a server return when a resource is successfully created?
201 Created specifically indicates a new resource was successfully created as a result of the request.
3. A user is correctly authenticated but tries to access a resource they do not own. What status code fits best?
403 means the server understood who the user is but denies access based on permissions, unlike 401 which means authentication itself failed.
Flash Cards
What does the 4xx family mean? — The client made an error — bad input, missing auth, or a forbidden action.
What does the 5xx family mean? — The server failed to fulfill an otherwise valid request.
401 vs 403? — 401 means authentication failed or is missing; 403 means the authenticated user lacks permission.
What does 204 mean? — Success, but there is no response body to return.