What HTTP status to use for good request with "bad" input?

Question

I'm writing a microservice for validating promo codes. The client sends me a promo code and a product ID (json). There is the 200 OK case where the code is good, I apply a discount for their order. But there is an error-ish case where the promo code doesn't apply for this product. I'm unsure what response code to use.

Should this also be 200 OK (with some sort of message saying the validation of the code fails)?

Should it be 400 Bad Request?

Neither seems entirely appropriate, it's odd to say 200 OK when it wasn't "OK", however 4xx is usually for signifying a problem with the structure of the request / http protocol - and in this case the structure of the request is fine.

Answer 1

I'll second steveax. 422 seems like a good choice.

IMHO, you should never use 200 if the request failed.

Use an error code & if necessary, provide details in the response body:

HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json

{ "reason": 1, "text": "Invalid promo code." }

On second thought, I think 403 is a good fit here:

HTTP/1.1 403 Forbidden
Content-Type: application/json

{ "reason": "bad_promo_code" }

Ultimately, it doesn't matter as long as it's documented.