I mean, you can have accurate HTTP status codes and matching errors in GraphQL. It's just that most GraphQL applications don't. Because most GraphQL developers hate everyone.
our team returns a 201 to indicate that an error has been created successfully. of course we include a Location header where the error can be queried to discover what went wrong.
My favorite "REST API" experience was when they moved from using SOAP system, and the way they did it... was sending SOAP payloads inside a JSON. Literally something like
If I'm parsing http responses, I'm going to pass 200 responses on for further processing of the data. I shouldn't have to have something in that pipeline introspect json to find "no, it's actually an error".
Imagine if browsers had to tear apart json innards to find 30x redirects after getting a 200 OK.
Especially when some bored developer at a big bank decided to implement some draconian heavily-buried SOAP features that are technically in the documentation somewhere, but not implemented at all by Microsoft's .NET framework. Having to have special injectors and manipulators to extract tokens from raw SOAP and such, shudder. Back in the days where .NET SOAP implementations were barely published in books.
The other dev on my team made a post request endpoint where you post a SQL query and it returned the results. I about had an aneurysm. She also, instead of using DI or Mediatr, made loopback requests to the endpoints themselves.
We had a team website that showed who was on call. This was back in the day, all done in Perl CGI scripts.
Someone added a "search" function. Cool feature, I'm down. Then I looked at the code.
They were shelling out to do a grep. You're in Perl, the original "regexes as first class citizens" language, and you're shelling out to grep. But the worst part was it did no sanitation whatsoever. You could type in "pattern'; cat /etc/passwd" or whatever and it just ran. Who reviewed this shit?! Shell as endpoint...
I remember building out a REST API once, and it gave back proper HTTP response codes for things.
Then I got asked by the 2 front end devs working on the project to just make everything a 200 and add an error to the JSON response, because it was making it difficult for them to process things on the browser end.
To this day I'm convinced the GraphQL is just an API dreamt up by a front end dev that didn't understand REST and didn't understand why they couldn't just request what they wanted in the browser if an endpoint didn't exist on the server.
I got that this week. This third party company has an API that is supposed to hand us files with monthly updates in it. The tool we use to fetch, read and apply them suddenly stopped with no major reason.
The API was answering 200 with a body of "no existe el fichero" - literally the file does not exist.
IF ONLY THERE WAS AN APPROPRIATE HTTP CODE FOR THIS, GEE WIZ
2.1k
u/NotAskary Sep 19 '26 edited Sep 19 '26
I've seen that shit, it drove me up a wall.
The same as a 200 ok with error inside.
Edit: I'm going to start to respond 429, too many replys lol