What are the best practices for choosing HTTP Status Codes in a RESTful API?

Short answer

Use semantic codes precisely: 200 for success, 201 for creation, 204 for successful deletion, 400 for malformed input, 401 when unauthenticated, 403 when unauthorized, and 422 for validation failures.

Explanation

A serious API design mistake is always returning 200 OK and putting an error message in the JSON. Standard design requires the appropriate status: 401 means the client is unauthenticated, 403 means it is authenticated but lacks permission, 404 means the resource is missing, 409 means the state conflicts (such as a duplicate unique value), 422 means validation failed, and unexpected database failures return 5xx. This lets clients handle errors reliably in code.

Code example

return response()->json(['data' => $user], 201); // After creation
return response()->noContent(); // 204 After deletion

Common mistakes

• Returning 200 OK with { status: 'error', code: 404 } instead of sending the real status code in the response header.

Follow-up questions

• What are API Resources in Laravel, and why are they better than returning Eloquent models directly as JSON?

Sources

• Laravel docs — Responses and Status Codes