<story><title>Some items from my “reliability list”</title><url>http://rachelbythebay.com/w/2019/07/21/reliability/</url></story><parent_chain><item><author>pjungwir</author><text>&amp;gt; Also, if you are literally having HTTP 400s internally, why aren&amp;#x27;t you using some kind of actual RPC mechanism? Do you like pain?&lt;p&gt;I just had a discussion about this yesterday where we have an internal JSON API that auths a credit card, and if the card is declined it returns a status and a message. Another developer wanted it to return a 4xx error, but that made me uneasy. I think you could make a good argument either way, but to me that isn&amp;#x27;t a failure you&amp;#x27;d present at the HTTP layer. 4xx is better than 5xx, but I was still worried how intermediate devices would interfere. (E.g. an AWS ELB will take your node out of service if it gives too many 5xxs, and IIS can do some crazy things if your app returns a 401.) Also I don&amp;#x27;t want declined cards to show up in system-level monitoring. But what do other folks think? I believe smart people can make a case either way.&lt;p&gt;EDIT: Btw based on these Stack Overflow answers I&amp;#x27;m in the minority: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;stackoverflow.com&amp;#x2F;questions&amp;#x2F;9381520&amp;#x2F;what-is-the-appropriate-http-status-code-response-for-a-general-unsuccessful-req&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;stackoverflow.com&amp;#x2F;questions&amp;#x2F;9381520&amp;#x2F;what-is-the-appr...&lt;/a&gt;</text></item></parent_chain><comment><author>citrusx</author><text>In my opinion, a rejection is an expected outcome, and therefore should have a response code of 200.  You&amp;#x27;re not asking, &amp;quot;Does this card exist?&amp;quot;, and sending a 404 if you have no record.  You&amp;#x27;re asking a remote system to do a job for you, and if that job completes successfully, it&amp;#x27;s a &amp;quot;Success&amp;quot; in the HTTP world.&lt;p&gt;At that point, you rely on the body content to tell you what the service correctly determined for you.  A result that the user doesn&amp;#x27;t like is way different than a result that comes about because something was done wrong at the client side (4xx) or a failure on the server side (5xx).</text></comment>
<story><title>Some items from my “reliability list”</title><url>http://rachelbythebay.com/w/2019/07/21/reliability/</url></story><parent_chain><item><author>pjungwir</author><text>&amp;gt; Also, if you are literally having HTTP 400s internally, why aren&amp;#x27;t you using some kind of actual RPC mechanism? Do you like pain?&lt;p&gt;I just had a discussion about this yesterday where we have an internal JSON API that auths a credit card, and if the card is declined it returns a status and a message. Another developer wanted it to return a 4xx error, but that made me uneasy. I think you could make a good argument either way, but to me that isn&amp;#x27;t a failure you&amp;#x27;d present at the HTTP layer. 4xx is better than 5xx, but I was still worried how intermediate devices would interfere. (E.g. an AWS ELB will take your node out of service if it gives too many 5xxs, and IIS can do some crazy things if your app returns a 401.) Also I don&amp;#x27;t want declined cards to show up in system-level monitoring. But what do other folks think? I believe smart people can make a case either way.&lt;p&gt;EDIT: Btw based on these Stack Overflow answers I&amp;#x27;m in the minority: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;stackoverflow.com&amp;#x2F;questions&amp;#x2F;9381520&amp;#x2F;what-is-the-appropriate-http-status-code-response-for-a-general-unsuccessful-req&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;stackoverflow.com&amp;#x2F;questions&amp;#x2F;9381520&amp;#x2F;what-is-the-appr...&lt;/a&gt;</text></item></parent_chain><comment><author>msluyter</author><text>Interesting question. My understanding is that a 400 response indicates that there&amp;#x27;s something malformed about the request itself such that the server can&amp;#x27;t&amp;#x2F;won&amp;#x27;t process it. Given that in order to decline the card the service has to actually process the request, I&amp;#x27;d agree that a 400 is inappropriate.</text></comment>