Every HTTP response carries a three-digit status code that tells you, at a glance, how the request went. Grouping them by their first digit makes them easy to remember.
5xx — Server errorthe server failed
4xx — Client erroryour request was wrong
3xx — Redirectiongo somewhere else
2xx — Successit worked
The codes you will test most
| Code | Meaning |
|---|---|
| 200 OK | Request succeeded |
| 201 Created | Resource created (after POST) |
| 400 Bad Request | Invalid input from the client |
| 401 Unauthorized | Authentication missing or invalid |
| 403 Forbidden | Authenticated but not allowed |
| 404 Not Found | Resource does not exist |
| 500 Server Error | Something broke on the server |
Test both sides: good API testing checks not just the happy-path 200s, but also that errors return the correct code — a bad input should give 400, not 500, and missing auth should give 401.
Conclusion
Status codes are the server's verdict on each request, grouped logically by category. Asserting on the right code — for both success and failure — is one of the most important checks in any API test.