What’s an appropriate HTTP status code to return by a REST API service for a validation failure?

by

If “validation failure” means that there is some client error in the request, then use HTTP 400 (Bad Request). For instance if the URI is supposed to have an ISO-8601 date and you find that it’s in the wrong format or refers to February 31st, then you would return an HTTP 400. Ditto if you expect well-formed XML in an entity body and it fails to parse.

(1/2016): Over the last five years WebDAV‘s more specific HTTP 422 (Unprocessable Entity) has become a very reasonable alternative to HTTP 400. See for instance its use in JSON API. But do note that HTTP 422 has not made it into HTTP 1.1, RFC-7231.

Richardson and Ruby’s RESTful Web Services contains a very helpful appendix on when to use the various HTTP response codes. They say:

400 (“Bad Request”)
Importance: High.
This is the generic client-side error status, used when no other 4xx error code is appropriate. It’s commonly used when the client submits a representation along with a
PUT or POST request, and the representation is in the right format, but it doesn’t make
any sense. (p. 381)

and:

401 (“Unauthorized”)
Importance: High.
The client tried to operate on a protected resource without providing the proper authentication credentials. It may have provided the wrong credentials, or none at all.
The credentials may be a username and password, an API key, or an authentication
token—whatever the service in question is expecting. It’s common for a client to make
a request for a URI and accept a 401 just so it knows what kind of credentials to send
and in what format. […]

More Related Contents:

  1. What’s the appropriate HTTP status code to return if a user tries logging in with an incorrect username / password, but correct format?
  2. JSF doesn’t support cross-field validation, is there a workaround?
  3. Do I really need to encode ‘&’ as ‘&’?
  4. What is the maximum length of a valid email address?
  5. Disable validation of HTML5 form elements
  6. Why is client-side validation not enough?
  7. Validation Error: Value is not valid
  8. How to let validation depend on the pressed button?
  9. Which status code should I use for failed validations or invalid duplicates?
  10. How to perform validation in JSF, how to create a custom validator in JSF
  11. Min / Max Validator in Angular 2 Final
  12. HTTP response code for POST when resource already exists
  13. Is JSF validation client-side or server-side?
  14. How can I manually set an Angular form field as invalid?
  15. How to check whether a file is valid UTF-8?
  16. How to force MVC to Validate IValidatableObject
  17. Found an unexpected Mach-O header code: 0x72613c21 in Xcode 7
  18. How to skip validation when a specific button is clicked?
  19. Change the default message “Validation Error: Value is required” to just “Value is required”
  20. What characters should be restricted from a Unix file name?
  21. How do I validate incoming JSON data inside a REST service?
  22. How to display dialog only on complete of a successful form submit
  23. Using validator with a variable attribute in ui:repeat
  24. Disable validation of HTML form elements
  25. Is it correct to return 404 when a REST resource is not found?
  26. When is it appropriate to respond with a HTTP 412 error?
  27. How to handle set based consistency validation in CQRS?
  28. How to customize JSF validation error message
  29. Why does allow blank spaces?
  30. How do you perform address validation? [closed]

Leave a Comment