Understanding and Using APIs · Topic 3 of 7
Troubleshooting API Calls from the Response
Work out why a REST API call failed by reading the status code, comparing the request with the documentation and checking method, path, headers and body.
- 5 min
- Compare the request with the documentation part by part: method, URL, headers, body and credentials.
- 400 points to the body or query, 401 to credentials, 403 to permissions and 404 to the path.
- 405 means the wrong method for that path, and 415 means a wrong or missing
Content-Type.
What it is
Troubleshooting an API call means using the response, the request you sent and the documentation to find what went wrong.
The method is to compare what you sent with what the documentation requires, one part at a time. The status code tells you where to start.
Most failures are small: a wrong path, a missing header, a bad body or the wrong credentials.
How it works
Start from the status code, then check each part of the request in a fixed order.
A step by step method
- Read the status code and the error message in the body.
- Check the method against the documentation.
- Check the URL, including the path, path parameters and query string.
- Check the headers, especially
Authorization,Content-TypeandAccept. - Check the body for valid JSON, correct field names and correct value types.
- Check the credentials, their scope and whether they have expired.
What each code usually points to
| Code | Look at first |
|---|---|
| 400 | The body or query. It may be malformed JSON, a missing required field or a wrong type |
| 401 | The credentials. The token may be missing, wrong or expired |
| 403 | The permissions. The account or token lacks the right for this action |
| 404 | The path and the resource ID. Check typing and the API version in the path |
| 405 | The method. The path exists but does not accept this method |
| 409 | The state of the resource, for example a duplicate name |
| 415 | The Content-Type header, which may be missing or wrong |
| 429 | The rate limit. Slow down and honour Retry-After if present |
| 500 | The server. Retry later and report it if it persists |
| 503 | The server is busy or down. Retry later with a delay |
Worked example 1
The request:
POST /v1/rooms HTTP/1.1
Host: api.example.test
Authorization: Bearer ACCESS_TOKEN
{"title": "Network Ops"}
The response is 415 Unsupported Media Type. The documentation says the body must be JSON with Content-Type: application/json.
The request has no Content-Type header, so the server cannot read the body. Adding the header fixes it.
Worked example 2
The request is GET /v1/devices/9999. The response is 404 with the body {"message": "Device not found"}. The path is valid, and the error message names the cause.
Device 9999 does not exist, so the fix is to list the devices and use a real ID.
Worked example 3
A call returns 401 with the message token expired. The request itself is correct, so the fix is to get a new token and send it in the Authorization header. This is common with APIs whose tokens last for a fixed time.
Worked example 4
A script sends a body in a POST and receives 400. The error text says that the field name is required. The script sent title instead.
The documentation lists name as the correct field, so the field name is the bug.
Telling client faults from server faults
A 4xx code says that the fault is in the request. Repeating the same request gives the same error until you change it.
A 5xx code says the server failed. The same request may work later, so a retry with a growing delay is reasonable. You can still report it if the error persists.
Useful tools
- A command line client or API tool lets you send a request by hand and see the raw response.
- Printing
response.status_code,response.headersandresponse.textin Python shows what came back. - The API documentation's own try it out feature shows a request that is known to work.
response = requests.post(url, headers=headers, json=payload)
if not response.ok:
print(response.status_code)
print(response.text)
Read the response body first. Many APIs state the exact problem in an error message.
What to remember for the exam
Six facts cover this topic.
- Compare the request with the documentation part by part: method, URL, headers, body and credentials.
- 400 points to the body or query, 401 to credentials, 403 to permissions and 404 to the path.
- 405 means the wrong method for that path, and 415 means a wrong or missing
Content-Type. - 429 means you are sending too many requests.
- A 4xx error needs a changed request. A 5xx error can be retried later.
- The error message in the body usually names the problem.
Common mistakes
Four mistakes cost time.
Blaming the server for a 4xx. A 4xx code points to the request, so check your own side first.
Changing many things at once. Change one part at a time so you know which fix worked.
Ignoring the API version in the path. A call to the wrong version can return 404 even though the resource exists.
Retrying a 401 without new credentials. The same bad token fails again.
Do not paste a real token into a forum or a ticket when you ask for help. Replace it with a placeholder first.
Check yourself
Work through these three questions.
A POST with a JSON body returns 415. What is the most likely cause?
The
Content-Typeheader is missing or wrong, so the server cannot read the body.A call returns 403 although the token is valid. What does that suggest?
The account or token lacks permission for that action.
Why is retrying a 400 response without changes unhelpful?
A 400 means the request itself is wrong, so the same request gives the same error.
Topic 3 of 7 in Understanding and Using APIs
Test yourself on Understanding and Using APIs
The full Cisco CCNA 200-901 DEVASC question bank has 808 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.