Answer with the right status code

How to do it

Use 200 for a read, 201 with a Location header for a create, and 204 when there is no body. Use 400 for a malformed request and 401 when credentials are missing or wrong. Use 403 when they are valid but not allowed, 404 for an unknown resource and 409 for a conflict with current state. Use 422 for well-formed input that fails a rule, and 429 for too many requests. Use 5xx only for faults on your side.

Example

POST /orders HTTP/1.1
Content-Type: application/json

{"items":[{"sku":"TEA-01","quantity":2}]}

HTTP/1.1 201 Created
Location: /orders/ord_8f2k

How to check

A contract test sends a bad body, a missing token, an unknown ID and a valid create. It gets 400, 401, 404 and 201 with Location.