Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Use HTTP status codes to communicate the broad outcome of an API request, then return a consistent, machine-readable error body for API-specific detail. On the client, branch on stable error codes—not changeable message text—and retry only when the operation and the API’s contract make repeating it safe.

What a consistent API error contract should communicate

An HTTP status code tells a client the general outcome under HTTP semantics. A structured response body can identify the particular problem and provide details that help a developer diagnose or resolve it. The body supplements the status; it should not redefine what the status means.

The IETF’s RFC 9457, Problem Details for HTTP APIs, defines a common format for this purpose and obsoletes RFC 7807. It is a standards-based option, not a requirement that every API adopt the same schema. An API may instead need to preserve an established service-specific contract.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Keep HTTP status semantics accurate and consistent across endpoints.
  • Give clients stable, machine-readable codes for decisions such as displaying a validation error or stopping a request.
  • Use human-readable messages to help developers understand the failure, not as values for program logic.
  • Return only diagnostic detail that is safe for the caller to see.

Choose a format that fits the API’s contract

RFC 9457 and Microsoft Graph’s documented error object are two approaches, not interchangeable universal requirements. Choose a representation clients can rely on, document its extension rules, and preserve compatibility when adding new error conditions.

#1 Best Overall
API Design Patterns
  • API Design Patterns
  • ABIS BOOK
  • Manning Publications
Approach Documented shape When it fits
RFC 9457 Problem Details A common problem-details representation that adds problem-specific information to the HTTP response. When an API wants an IETF-defined common format rather than inventing a new one.
Microsoft Graph error object A JSON error object with code and message; optional fields include target, details, and innererror. When clients must follow Microsoft Graph’s documented REST API contract.

Microsoft Graph describes its code as language-independent and its message as intended for developers, not end users. It also warns against exposing excessive detail. Those choices describe Microsoft Graph’s contract; they do not make its object a general HTTP standard. See Microsoft Graph error condition responses.

Design the response before clients depend on it

Inventory statuses and existing bodies

Review responses across endpoints before standardizing. Find cases where the same failure has different status codes or incompatible body shapes, and decide which differences are meaningful. Document the expected status, stable error code, safe details, and whether the condition is permanent, transient, or retryable only in certain circumstances.

Separate codes from messages

Clients should branch on stable codes. Message wording can change, be localized, or include context that is unsuitable for a machine decision. Treat a code as part of the API contract: introduce new codes deliberately, and avoid changing an existing code’s meaning in a way that breaks clients.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Preserve useful HTTP semantics

Use the status to represent the broad HTTP outcome and the body to explain the application-specific problem. For example, a malformed request, invalid credentials, missing resource, rate limit, and temporary service failure should not all collapse into one generic status simply because they share a response envelope.

Keep public errors safe

Return enough information to help a developer identify the issue, but do not expose secrets, stack traces, or internal state. Record suitable diagnostic context in server-side logs instead of putting sensitive implementation detail in a public response.

Retry only when the request can safely be repeated

A timeout or gateway error does not prove that the server failed to perform the requested work. Whether to retry depends on the operation’s semantics and any safe-repeat mechanism, not just on the status code.

Google Cloud’s HTTP guidelines describe GET and HEAD as safe retrieval methods, and GET, PUT, and DELETE as idempotent. Idempotence means repeating the request has the same intended server-side effect; it does not guarantee the same response each time. For example, deleting a resource that is already absent may return 404 while the DELETE operation remains idempotent.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

POST and PATCH are not idempotent in that guidance. If a client retries a POST after a timeout, the original request may already have created an order or sent an email. Retry a side-effecting request only if the API documents a safe-repeat mechanism, such as an idempotency mechanism, or the client can establish that the original request was not applied.

Handle transient failures, throttling, and wait instructions

Do not retry every error. A malformed request or invalid credentials generally needs a caller-side correction, not another identical request. Temporary service failures and throttling may be retryable, subject to the API’s rules and the operation’s repeatability.

Microsoft Learn distinguishes several gateway and server errors: 502 means an invalid upstream response, 503 indicates temporary unavailability and may include Retry-After, and 504 means a gateway timed out without certainty about whether upstream work completed. Its guidance is to retry 502, 503, and 504 only for idempotent requests; retry 500 only when the API documents it as safe; and honor Retry-After when present. For suitable transient cases without a wait instruction, it recommends exponential backoff with random jitter, a finite retry limit, and a circuit breaker when failures continue. See Microsoft Learn’s guidance on 500, 502, 503, and 504 API errors.

For HTTP 429 in the context of its Developer Knowledge API, Google for Developers gives this truncated exponential-backoff formula:

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

min(max_delay, initial_delay * (2 ^ attempt) + jitter)

That service’s examples use a 1-second initial delay, a 32-second cap, and random jitter from 0 to 1 second. They are example values for that guidance, not universal constants. See Google for Developers’ error handling, rate limiting, and quota management guidance.

  • Honor a server-provided Retry-After value when the API supplies one.
  • Use bounded backoff with jitter only for documented transient cases that are safe to retry.
  • Set a finite retry limit; continued failures should not trigger endless requests.
  • Do not treat a 5xx status alone as proof that a side effect did not occur.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Build and test the contract end to end

  1. Inventory current error statuses and response bodies across endpoints.
  2. Select a common response format that suits the API’s ecosystem, then define a stable code taxonomy and compatibility rules.
  3. Document which conditions are permanent, transient, or conditionally retryable, and preserve the broad HTTP meaning of each status.
  4. Make side-effecting operations safe to repeat where practical, or document an explicit idempotency mechanism.
  5. Return Retry-After when clients should wait, and specify bounded retry behavior for applicable transient failures.
  6. Test client and server behavior for malformed requests, authorization failures, missing resources, throttling, gateway failures, and repeated side-effecting calls.

The exact sequence is an implementation approach, not a procedure mandated by one standard. The contract is useful only when server responses, client retry behavior, and documentation agree.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.