Sending JSON Responses and HTTP Status Codes

Every HTTP response has two essential parts: a status code that tells the client whether the request succeeded and why, and a body that carries the data. In a MERN REST API the body is always JSON. Getting both right — choosing the correct status code and structuring a consistent JSON response shape — is what separates a professional API from one that leaves your React frontend guessing. In this lesson you will master the Express response object, learn which HTTP status codes belong in which situations, and build a consistent response pattern you will use throughout the series.

HTTP Status Code Groups #

The Most Important Status Codes for MERN APIs #

Express Response Methods #

// ── res.json() — send a JSON response ────────────────────────────────────────
res.json({ success: true, data: post });
// Automatically sets Content-Type: application/json
// Accepts objects, arrays, strings, numbers, booleans, null

// ── res.status() — set the HTTP status code ───────────────────────────────────
res.status(201).json({ success: true, data: newPost });
res.status(404).json({ success: false, message: 'Post not found' });
res.status(500).json({ success: false, message: 'Internal server error' });

// ── res.send() — send any response ───────────────────────────────────────────
res.send('Hello World');            // text/html by default
res.send(Buffer.from('binary'));     // binary data
// For APIs: always use res.json() instead of res.send()

// ── res.sendStatus() — send status code only, body is the status text ─────────
res.sendStatus(204);    // 204 No Content — body is "No Content"
// Useful for DELETE responses where you have nothing meaningful to return

// ── res.redirect() — send a redirect response ─────────────────────────────────
res.redirect(301, 'https://newurl.com');
res.redirect('/api/v2/posts');

// ── res.set() — manually set headers ─────────────────────────────────────────
res.set('X-Request-ID', '12345');
res.set('Cache-Control', 'no-store');

// ── res.cookie() — set a cookie ───────────────────────────────────────────────
res.cookie('refreshToken', token, {
  httpOnly: true,    // not accessible via JavaScript
  secure:   true,    // HTTPS only
  sameSite: 'strict',
  maxAge:   7 * 24 * 60 * 60 * 1000, // 7 days in milliseconds
});

Consistent API Response Pattern #

// server/src/utils/apiResponse.js
// A helper to keep all responses consistent across the API

const sendSuccess = (res, data, statusCode = 200, message = '') => {
  const response = { success: true };
  if (message) response.message = message;
  if (Array.isArray(data)) response.count = data.length;
  response.data = data;
  return res.status(statusCode).json(response);
};

const sendError = (res, message, statusCode = 500) => {
  return res.status(statusCode).json({ success: false, message });
};

module.exports = { sendSuccess, sendError };

// ── Using the helpers in route handlers ───────────────────────────────────────
const { sendSuccess, sendError } = require('../utils/apiResponse');

app.get('/api/posts', (req, res) => {
  const posts = getAllPosts();
  sendSuccess(res, posts);
  // Response: { success: true, count: 3, data: [...] }
});

app.get('/api/posts/:id', (req, res) => {
  const post = getPostById(req.params.id);
  if (!post) return sendError(res, 'Post not found', 404);
  sendSuccess(res, post);
});

app.post('/api/posts', (req, res) => {
  const { title, body } = req.body;
  if (!title || !body) return sendError(res, 'Title and body are required', 400);
  const newPost = createPost({ title, body });
  sendSuccess(res, newPost, 201, 'Post created successfully');
});

Response Examples — All Scenarios #

// ── 200 — successful GET ───────────────────────────────────────────────────────
res.status(200).json({ success: true, data: posts });

// ── 201 — resource created ────────────────────────────────────────────────────
res.status(201).json({ success: true, data: newPost, message: 'Post created' });

// ── 204 — deleted, no content ─────────────────────────────────────────────────
res.status(204).end(); // no body — do not call res.json() with 204

// ── 400 — validation failure ──────────────────────────────────────────────────
res.status(400).json({ success: false, message: 'Title is required', field: 'title' });

// ── 401 — not authenticated ───────────────────────────────────────────────────
res.status(401).json({ success: false, message: 'No token provided — please log in' });

// ── 403 — authenticated but not authorised ────────────────────────────────────
res.status(403).json({ success: false, message: 'You do not own this post' });

// ── 404 — resource not found ──────────────────────────────────────────────────
res.status(404).json({ success: false, message: `Post with id ${id} not found` });

// ── 409 — conflict ────────────────────────────────────────────────────────────
res.status(409).json({ success: false, message: 'Email already registered' });

// ── 500 — unexpected error ────────────────────────────────────────────────────
res.status(500).json({ success: false, message: 'An unexpected error occurred' });
// In practice: caught by global error middleware — not returned from route handlers

Common Mistakes #

Mistake 1 — Always returning 200 regardless of outcome #

❌ Wrong — React has no way to know if something failed:

app.post('/api/auth/login', (req, res) => {
  if (!userFound) return res.json({ success: false, message: 'User not found' }); // status 200!
  // Axios treats this as a success → React must check success flag manually
});

✅ Correct — use the appropriate 4xx status code so Axios catches it automatically:

if (!userFound) return res.status(404).json({ success: false, message: 'User not found' });
// Axios throws an error → React .catch() block handles it ✓

Mistake 2 — Sending a body with 204 No Content #

❌ Wrong — 204 responses must have no body:

res.status(204).json({ success: true, message: 'Deleted' });
// The json body is silently discarded by the browser — React receives nothing

✅ Correct — use res.status(204).end() or return 200 with a confirmation body:

res.status(200).json({ success: true, message: 'Post deleted successfully' }); // ✓

Mistake 3 — Leaking internal error details to the client in production #

❌ Wrong — sending raw error objects or stack traces to the client:

res.status(500).json({ error: err }); // may expose DB credentials, file paths, stack traces

✅ Correct — log the full error server-side, send a generic message to the client:

console.error(err);
res.status(500).json({ success: false, message: 'An unexpected error occurred' });

Quick Reference #