What you need to know
Clients often make decisions based on the response status. Using a consistent code and body makes it easier to display the right message, retry a request, or send a user to sign in.
How to apply it
Use 2xx for success, 400-series codes for client-side issues such as invalid input or missing access, and 5xx for unexpected server failures. Document the response body for common errors.
Common mistake to avoid
Do not return 200 with an error hidden in a message field. Do not expose sensitive diagnostic details in an error response.