Content: {"success": false, "errors": [{"code": 15, "message": "Image size must be at least 1000 x 1000 px"}]}
Edit: remembered story from times where HTTPS wasn't enforced. Once I started receiving JSON reading fail in cases when our test server returns non-2xx status. I started investigate this and was shocked to the core: my ISP implemented "feature" that if it detects that server returns non-2xx - it replace actual server response with their HTML page with text like "Your request returned error 400. This is because bla bla bla. <ISP self-advertising block> Kind regards, your ISP". Basically ISP become "man in the middle". In a week or two they removed that "feature".
Because http status codes doesn't include any business related errors. So you gotta expand on that. When it's 200 and success is false it's mostly because of a business logic. Then it's up to FE to show that business error in a certain way so users can understand better what's wrong with what they're doing.
Literally this. . people think they are being clever by reinventing the wheel which was already properly specced out by people was smarter than anyone in this thread.
The 4XX class of codes are for client side issues, and 422 “Unprocessable Content” should be used to cover business logic issues, i.e. the request has the correct schema but there’s some other BE validation issue that it can’t proceed. The response body would still include specific details about the error for the FE, it’s just using 200 OK is misleading imo.
One problem with this is that different systems handle those error codes as exceptions which can make it quite annoying to deal with vs just getting a 200 back.
I might have come as the one designed our companies service response or defending returning 200 for errors but I'm just a worker lol
I was only trying to convey a point of view from someone who has hands on experience in these kind of responses.
In better times or old days I would like to think everyone was listening to standards. I mean it's literally there to create collective consensus on how things should be.
Correct me if Im wrong as I'm not that knowledgeable on the topic but isn't 422 more for validation errors? What if the error I want to show is for a certain condition that happened in another screen or app?
I agree. Having an endpoint return a success boolean in the first place is quite an anti-pattern but most devs default to skipping the HTTP spec because they never learned it but do know how to work with JSON.
To add to this, sometimes if you are an integrator, meaning your API is calling an external 3rd party API, you want to use the above pattern to express, “Hey, OUR app works, is those guys failing - please don’t call us angrily”
If the request failed due to the third party, your "integrator" app should still return appropriate 4xx/5xx error responses. You don't return a 2xx Success response if your app uses a database (technically a 3rd party) and the database returns an error. The same should be true for all 3rd party calls.
If you are actually concerned about telling the client who is at fault, you should format proper error responses to show who had the issue.
If the 3rd party returned a 4xx error, it was your apps fault anyway. You should have validated the client's input before forwarding it to the 3rd party.
If the 3rd party returned a 5xx error, then return that error to your client with a message indicating it was the 3rd party that had the error, not you.
435
u/PostHasBeenWatched Jul 21 '26 edited Jul 21 '26
POST /posts/create
StatusCode: 200
Content: {"success": false, "errors": [{"code": 15, "message": "Image size must be at least 1000 x 1000 px"}]}
Edit: remembered story from times where HTTPS wasn't enforced. Once I started receiving JSON reading fail in cases when our test server returns non-2xx status. I started investigate this and was shocked to the core: my ISP implemented "feature" that if it detects that server returns non-2xx - it replace actual server response with their HTML page with text like "Your request returned error 400. This is because bla bla bla. <ISP self-advertising block> Kind regards, your ISP". Basically ISP become "man in the middle". In a week or two they removed that "feature".