Day 4 — HTTP Fundamentals#

Goal: Understand how the web works at the protocol level — HTTP methods, status codes, headers, and request/response structure — so you can debug APIs and build web services.

What Is HTTP?#

HTTP (HyperText Transfer Protocol) is the language that browsers and servers speak. Every time you:

• Open a web page
• Submit a form
• Fetch data from an API
• Upload a file

…an HTTP request goes out and an HTTP response comes back.

Client (browser/script)              Server
     │                                 │
     │──── HTTP Request ──────────────▶│
     │     GET /api/users              │
     │     Host: example.com           │
     │                                 │
     │◀─── HTTP Response ─────────────│
     │     200 OK                      │
     │     [{"name": "Alice"}, ...]    │

HTTP Methods — What Action Are You Requesting?#

The CRUD mapping#

Examples#

GET    /api/users           → Get all users
GET    /api/users/42        → Get user with ID 42
POST   /api/users           → Create a new user
PUT    /api/users/42        → Replace user 42's data
PATCH  /api/users/42        → Update user 42's email only
DELETE /api/users/42        → Delete user 42

GET requests should never change data. GET is for reading only. If an API changes data on GET, it’s poorly designed.

🧠 Knowledge Check#

Q1: Which HTTP method is best suited for updating a specific field (like a user’s email) without replacing their entire profile?

• A) GET
• B) POST
• C) PUT
• D) PATCH

HTTP Status Codes — What Happened?#

Status codes are three-digit numbers in the response that tell you the result.

The Ranges#

Codes You Must Know#

Memory aids#

2xx = 😊 Everything is fine
4xx = 😬 You messed up (fix your request)
5xx = 💥 Server messed up (try again later or contact admin)

🧠 Knowledge Check#

Q1: You made a request to /api/users and received a 404 status code. What does this mean?

• A) You are not authorized to view the users
• B) The server crashed while processing your request
• C) The resource /api/users does not exist
• D) You sent the request too fast

Anatomy of an HTTP Request#

POST /api/users HTTP/1.1          ← method, path, version
Host: api.example.com             ← headers start here
Content-Type: application/json
Authorization: Bearer eyJhbGci...
Accept: application/json
                                   ← empty line separates headers from body
{                                  ← request body (for POST/PUT/PATCH)
    "name": "Alice",
    "email": "[email protected]"
}

Key parts#

Anatomy of an HTTP Response#

HTTP/1.1 201 Created              ← status line
Content-Type: application/json
Date: Mon, 15 Jan 2026 10:30:00 GMT
X-Request-Id: abc-123
                                   ← empty line
{                                  ← response body
    "id": 42,
    "name": "Alice",
    "email": "[email protected]",
    "created_at": "2026-01-15T10:30:00Z"
}

Common HTTP Headers#

Request Headers (you send)#

Response Headers (server sends)#

JSON — The Language of APIs#

Most APIs speak JSON (JavaScript Object Notation):

{
    "name": "Alice",
    "age": 25,
    "is_student": true,
    "courses": ["TDS", "PDSA"],
    "address": {
        "city": "Chennai",
        "state": "Tamil Nadu"
    }
}

JSON types#

JSON in Python#

import json

# Python dict → JSON string
data = {"name": "Alice", "age": 25}
json_str = json.dumps(data)
print(json_str)  # '{"name": "Alice", "age": 25}'

# JSON string → Python dict
parsed = json.loads(json_str)
print(parsed["name"])  # Alice

Authentication — How APIs Know Who You Are#

1. API Keys#

A simple token sent in a header or query parameter:

# In header:
curl -H "X-API-Key: abc123" https://api.example.com/data

# In query parameter:
curl "https://api.example.com/data?api_key=abc123"

2. Bearer Tokens (JWT)#

A signed token sent in the Authorization header:

curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9..." https://api.example.com/data

3. Basic Auth#

Username and password encoded in Base64:

curl -u "username:password" https://api.example.com/data
# Equivalent to: Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Q&A#

// PUT /users/42 — must send EVERYTHING:
{"name": "Alice", "email": "[email protected]", "age": 25}

// PATCH /users/42 — send only what changed:
{"email": "[email protected]"}

Exercises#

Exercise 1: Status code identification

For each scenario, what status code would you expect?

1. You request a user profile and get the data back
2. You try to access an admin endpoint without logging in
3. You send a POST request to create a new item, and it’s created
4. You request /api/users/99999 but user 99999 doesn’t exist
5. The server crashes while processing your request

Exercise 2: Method identification

What HTTP method would you use for each action?

1. Viewing a list of all blog posts
2. Publishing a new blog post
3. Changing the title of an existing blog post
4. Deleting a comment
5. Replacing an entire user profile with new data

Exercise 3: Read the response

Given this HTTP response, answer the questions:

HTTP/1.1 403 Forbidden
Content-Type: application/json
X-RateLimit-Remaining: 0

{"error": "Access denied", "message": "Upgrade to premium for this endpoint"}

1. Was the request successful?
2. What does the status code mean?
3. What format is the response body in?
4. Why might you be getting this error?

Exercise 4: MCQ

Q1: A 201 Created response is returned after which type of request?

• A) GET
• B) DELETE
• C) POST
• D) OPTIONS

Q2: You get a 500 Internal Server Error. What should you do?

• A) Check your request headers for typos
• B) Wait and try again — it’s a server-side issue
• C) Change the HTTP method
• D) Delete your API key and create a new one

Q3: Which header tells the server what format you’re sending data in?

• A) Accept
• B) Content-Type
• C) Authorization
• D) User-Agent