Understanding and Using APIs · Topic 2 of 7

HTTP Responses and Status Codes

Learn the three parts of an HTTP response, the five status code classes and the common REST codes such as 200, 201, 204, 400, 401, 403, 404, 429 and 500.

  • 4 min
In a nutshell
  • A response has a status line, headers and an optional body.
  • 2xx is success, 3xx is redirection, 4xx is a client error and 5xx is a server error.
  • 200 is OK, 201 is Created, and 204 means success with no body.

What it is

An HTTP response is the answer a server sends back after it processes a request.

It has three parts: a status line with a response code, a set of headers, and an optional body. Reading all three tells you whether the request worked and what happened.

The status code is a three digit number, and its first digit tells you the class of result.

Requestfrom clientprocessed byServerruns the operationreturnsResponsestatus, headers, bodyread byClientchecks the code first

How it works

You read a response from the top down, starting with the status code.

An example response

HTTP/1.1 201 Created
Content-Type: application/json
Content-Length: 55
Location: /v1/devices/77

{"id": 77, "name": "edge-sw1", "status": "provisioned"}

The first line gives the HTTP version, the status code and a short reason phrase. The headers follow, then a blank line, then the body.

Status code classes

ClassRangeMeaning
Informational1xxThe request was received and work continues
Success2xxThe request worked
Redirection3xxThe client must take another step, such as follow a new address
Client error4xxThe request was wrong
Server error5xxThe server failed to handle a valid request

Common success codes

CodeNameTypical meaning
200OKThe request worked and the body holds the result
201CreatedA new resource was created, often after a POST
202AcceptedThe request was accepted for processing that is not yet finished
204No ContentThe request worked and there is no body, often after a DELETE

Common redirection and client error codes

CodeNameTypical meaning
301Moved PermanentlyThe resource has a new address
400Bad RequestThe request is malformed or has invalid data
401UnauthorizedCredentials are missing or invalid
403ForbiddenThe credentials are valid but do not allow this action
404Not FoundThe resource or path does not exist
405Method Not AllowedThe method is not supported for this path
409ConflictThe request clashes with the current state of the resource
415Unsupported Media TypeThe server cannot read the body format that you sent
429Too Many RequestsYou have hit a rate limit

Server error codes

CodeNameTypical meaning
500Internal Server ErrorAn unexpected failure on the server
502Bad GatewayA gateway received a bad answer from an upstream server
503Service UnavailableThe server is overloaded or down for maintenance
504Gateway TimeoutA gateway did not get an answer from an upstream server in time

Response headers

Headers add detail about the answer.

  • Content-Type tells you the format of the body, for example application/json.
  • Content-Length gives the body size in bytes.
  • Location often gives the address of a newly created resource.
  • Retry-After can tell a client how long to wait after a rate limit or an outage.
  • Set-Cookie sets a cookie, which some APIs use for sessions.

Each API decides which headers it returns, so check its documentation.

The response body

The body holds the data, usually as JSON. A good API also puts error details in the body of a 4xx or 5xx response. That message often names the field that failed.

Reading a response in Python

response = requests.get(BASE_URL + "/v1/devices/77", headers=headers)

print(response.status_code)
print(response.headers["Content-Type"])
print(response.json())

response.ok is True for any status below 400. The method response.raise_for_status() raises an exception for a 4xx or 5xx code.

Exam tip

Remember the first digits. 2 is success, 4 is your mistake, and 5 is the server's problem.

What to remember for the exam

Seven facts cover this topic.

  • A response has a status line, headers and an optional body.
  • 2xx is success, 3xx is redirection, 4xx is a client error and 5xx is a server error.
  • 200 is OK, 201 is Created, and 204 means success with no body.
  • 400 is a bad request, 401 is an authentication problem, and 403 is an authorisation problem.
  • 404 means not found and 429 means too many requests.
  • 500 and 503 are server side problems.
  • Content-Type in the response says how to read the body.

Common mistakes

Four mistakes are common.

Confusing 401 and 403. With 401, the server does not know who you are. With 403, it knows you and refuses the action.

Treating 404 as always a missing device. It can also mean a wrong path or a typing mistake in the URL.

Expecting a body with 204. The code means success with no content, so parsing JSON from it fails.

Retrying a 400 again and again. A 400 means the request itself is wrong, so repeating it will not help.

Watch out

A 200 status does not always mean the task is complete. A 202 means the work was accepted but may not be finished.

Check yourself

Work through these three questions.

  • What are the three parts of an HTTP response?

    A status line with the code, headers, and an optional body.

  • What is the difference between 401 and 403?

    401 means the credentials are missing or invalid. 403 means the credentials are valid but the action is not allowed.

  • Which code range means the server failed on a valid request?

    The 5xx range, for example 500 or 503.

Topic 2 of 7 in Understanding and Using APIs

Test yourself on Understanding and Using APIs

The full Cisco CCNA 200-901 DEVASC question bank has 808 questions, with timed practice exams and an explanation for every answer.

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.