13

What is the most appropriate response code to return when using the PUT method to update a resource, and the request contains some data that would invalidate the domain rules?

For example, a customer resource must have a name specified. If an agent tries to issue a PUT without supplying a name I don't want to update the resource, and I want to tell the caller that they need to supply a name.

What HTTP response code?

3 Answers 3

27

How about 422?

"The 422 (Unprocessable Entity) status code means the server understands the content type of the request entity (hence a 415(Unsupported Media Type) status code is inappropriate), and the syntax of the request entity is correct (thus a 400 (Bad Request) status code is inappropriate) but was unable to process the contained instructions. For example, this error condition may occur if an XML request body contains well-formed (i.e., syntactically correct), but semantically erroneous, XML instructions."

RFC 4918, Section 11.2

7
  • Sounds promising. I hadn't seen that code, it doesn't appear in most documentation. Feb 4, 2010 at 1:16
  • 2
    That is part of WebDav, /not/ standard HTTP. Feb 4, 2010 at 6:49
  • 2
    Matthew, that comment doesn't make sense. There's a reason why status codes in HTTP are extensible, and why there's an IANA registry. Feb 4, 2010 at 9:01
  • The registry exists so different extensions don't claim the same numbers for different purposes. That doesn't mean you should just cherry-pick status codes from extensions. Feb 4, 2010 at 10:18
  • 8
    Well, it also doesn't mean you can't. I've had the discussion before with an author of RFC 2616 who agreed that 422 is a good thing and can absolutely be used outside WebDAV. If you disagree I'd recommend that you join the HTTPbis Working Group which, among other things, is chartered to clarify existing extension points when necessary. Feb 4, 2010 at 13:04
4

The response code is not related to the http method in this case. You should return the same status code as if it had been a POST request. I'd say you should use 400 or 409 (Note: See further discussion of the difference between the two in the comments).

7
  • I actually had 409 - Conflict written down. Though, looking at w3.org/Protocols/rfc2616/rfc2616-sec10.html under 400 - Bad Request "The request could not be understood by the server due to malformed syntax.". If you can check the business rules of a request, and know they are invalid, then surely it isn't malformed syntax? I vote 409. Feb 3, 2010 at 9:59
  • While 409 is probably the most correct, the X00 responses can also be seen as the generic response within a category. So 400 is less specific than 409. It's not how they are defined, but de-facto that's often the interpretation.
    – troelskn
    Feb 3, 2010 at 10:13
  • 500 is definitely not the right response in this case as it is the client that made the error, not the server. 409 is used for concurrency conflicts, not rule violations. Feb 3, 2010 at 13:25
  • @darrel Are you sure about the 409? The spec features a concurrency conflict as an example, but I read it as being just one example of a broader category.
    – troelskn
    Feb 3, 2010 at 16:04
  • 1
    IE8 displays 408/409 as "The website is too busy to show the webpage". Feb 4, 2010 at 10:07
4

I would return a 400. Strictly, this is for "malformed syntax" (not invalid data), but in practice the YouTube, Twitter, etc. use it for more generally "bad" requests.

1
  • I believe that this response is now accepted as the correct response for invalid data also. Feb 3, 2010 at 13:22

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.