API Design · Middle · Question 12 of 75

Should an API return 403 or 404 when a user requests another user's private resource?

1Always 200 with empty data
2Always 500
✓Correct answer: Often 404, so the API doesn't reveal that the resource exists; 403 is fine when existence isn't sensitive

Explanation

Either way, the server must check ownership on every request; status codes don't replace authorization.

Further reading

Test yourself

Take the API Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.