News for hackers. Stuff that matters.
Re:I've been abusing HTTP Status Codes in my APIs for years by NoGravitas on Wednesday July 13, 2022 @10:24AM (#32083183)
Yep, there's absolutely no reason an application ought to be guessing URLs, and therefore no reason it should ever be requesting /api/v1/employees/69 where employee 69 doesn't exist. If it does, it's playing silly buggers exactly as much as if it were to request /api/v69/nice/. Any user resources it needs to access will have had URLs provided to the application by another page.
Re:I've been abusing HTTP Status Codes in my APIs for years by Spivak on Wednesday July 13, 2022 @11:13AM (#32083815)
Example Code:

   users = http.client.get("https://yourapi.com/users")

   # Frobulate each user
   for user in users:
      user = http.client.post(user.frobulate_url)
      # While this is running somewhere on the other side of 
      # the world someone deletes one of the users. Oops.

Assuming, users (i.e developers) will just never mistype a URL so you don't have to give useful feedback is just like being a bad netzen.
Re:I've been abusing HTTP Status Codes in my APIs for years by NoGravitas on Wednesday July 13, 2022 @11:27AM (#32084025)
That's a fair example. And returning 404 (Not Found) or 410 (Gone) is the most useful kind of feedback. More explanation in the body of the 404 response is helpful too, of course.