What is a REST API, and what do HTTP methods and status codes mean?

What are the main HTTP methods?

• GET reads a resource and changes nothing.
• POST creates a resource or triggers an action.
• PUT replaces a resource with the one you send.
• PATCH changes part of a resource.
• DELETE removes a resource.

What does safe and idempotent mean?

A safe method does not change server state, as with GET. An idempotent method gives the same result when repeated, as with PUT and DELETE, so a client can retry it after a timeout without causing duplicates. POST is not idempotent by default, which is why retried payments need extra protection. See what is idempotency.

What do the status code families mean?

• 2xx means success, for example 200 OK, 201 Created or 204 No Content.
• 3xx means redirection.
• 4xx means the client made a mistake, for example 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found or 429 Too Many Requests.
• 5xx means the server failed, for example 500 Internal Server Error or 503 Service Unavailable.

What is the difference between 401 and 403?

A 401 says the request lacks valid credentials, so the caller is not authenticated. A 403 says the caller is known but is not allowed to do this, so they are authenticated but not authorised. Mixing them up confuses clients and hides real access problems.

What makes an API easy to use?

Consistent names, the right status codes, clear error bodies that say which field was wrong and why, and versioning so that changes do not break existing callers. Never return a 200 with an error hidden in the body, and never expose a stack trace to the caller.

Go deeper: CTP™ credential · the TPBOK™ standard · Check your experience

IICTP is an independent technical credentialing body.