Input and resource controls
Return safe errors
Use consistent status codes and problem details without exposing stack traces, queries, secrets, internal hosts, or authorization-sensitive existence.
8 minute lesson
API errors are part of the contract. They should guide the client without teaching an attacker about internals.
Return a stable type, title, status, safe detail, and request ID. Keep private diagnostics in protected logs. Decide deliberately when authorization failures should be indistinguishable from missing resources.
Returning invoice 193 belongs to another account confirms the record exists. Returning the same public result for missing and forbidden records hides that fact, but protected logs still need the real cause.
Keep error identifiers stable enough for clients, but do not expose internal exception classes. A request ID connects the safe response to detailed evidence without copying sensitive diagnostics outside.
Capture public and internal errors for missing, forbidden, invalid, limited, and failed requests. Prove public responses contain stable codes and request IDs while stack traces and object existence stay private.
Lesson completed