The Parts of a Request

Four parts. A method, an address, headers, and sometimes a body.

The method says what kind of thing you are doing. GET reads. POST creates. PATCH changes part of something. DELETE removes.

The address names the thing. Everything after a ? is the query string: options, joined by &.

Headers carry information about the request rather than the request itself: what format you accept, who you are, what you are sending.

A body carries data you are sending, which a GET does not have.

GET must be safe. A GET must not change anything, and that is a rule with teeth: browsers prefetch links, crawlers follow them, and link-checkers visit them. An API where GET deletes something will eventually delete something nobody asked it to.

This is the same rule as the one about delete links in the Django course, seen from the other side.

Status codes, by first digit. 2xx worked. 3xx moved. 4xx you got something wrong. 5xx they got something wrong.

The two worth memorizing properly are 401, meaning we do not know who you are, and 403, meaning we do and the answer is still no. Mixing them up sends you looking for a credentials bug when the real answer is that your key lacks permission.