What's the difference between 401 and 403, and when is 404 the right answer?

The 404-instead-of-403 case deserves detail: if /orders/123 returns 403 to someone who doesn't own it, an attacker scans ids and learns which orders exist — resource enumeration. Returning 404 in both cases makes the two indistinguishable. The trade is that your logs must still distinguish them, or support loses the ability to diagnose.

The 4xx/5xx split assigns responsibility, not severity: 4xx says "this request is wrong and resending it identically will be wrong again", 5xx says "my side failed, retrying may work". That split matters because clients and infrastructure use it to decide whether to retry — returning 500 for a malformed body makes clients retry forever a request that can never succeed.

A few underused codes worth using: 409 Conflict for state conflicts (a failed optimistic lock), 422 when the syntax is fine but the business rule isn't, 429 with Retry-After for rate limits, and 503 with Retry-After when you're overloaded. The last three tell the client WHAT TO DO, not merely that something failed.