Architecture Quizzes & Practical Challenges

Returning 200 OK signals that the request has completed, which misleads automated client retry engines. 202 Accepted explicitly tells the client that the batch job was enqueued. Best practice is to provide a Location: /v1/jobs/export_991 header or status link in the body.

POST is inherently non-idempotent by RFC standard. To make mutative operations safely retryable, modern APIs require an Idempotency-Key header. The server records the key atomically in Redis/database and returns the exact cached original response if a retried request with the same key arrives.

PUT represents a full replacement of the target resource; omitting properties in a PUT request technically implies deleting or resetting them. PATCH is specifically defined for partial modifications of a resource.

401 Unauthorized strictly means unauthenticated (missing or invalid credentials; the client can retry by authenticating). 403 Forbidden means the identity is known and valid, but the user does not possess sufficient privileges to perform the requested action. Re-authenticating with the same credentials will not change the outcome.

422 is for semantic validation errors (e.g. invalid email format). 409 Conflict is specifically reserved for requests that cannot be completed due to a conflict with the current state of the target resource, such as unique database constraint collisions or version edit conflicts.

Offset pagination (OFFSET 100000) forces PostgreSQL/MySQL to traverse 100,000 index entries before returning 20 rows. Furthermore, if new rows are inserted while users paginate, items shift pages, causing duplicates. Cursor pagination uses index seeks (WHERE id > last_seen LIMIT 20) with O(log N) constant time.

Status 429 Too Many Requests accompanied by Retry-After: 30 (or standard IETF RateLimit-Reset headers) provides a machine-readable signal that client libraries and exponential backoff mechanisms can use to pause and schedule retries automatically.

Browsers issue a preflight OPTIONS request before non-simple requests (like JSON POST with Authorization headers). By returning Access-Control-Max-Age: 86400 (or up to browser limits, typically 2 hours to 24 hours), the browser caches the permission and sends subsequent requests directly without the preflight delay.