code and status:
Status codes
Showing messages to your users
data.shouldDisplay marks a message as written for a person to read. When it is true, the
message explains something the caller can fix and is safe to surface as-is.
When it is absent, the message is diagnostic — log it, and show your own wording instead.
A note on 403
A403 is returned before the operation runs, so nothing changed and no record was touched.
It also means a key cannot use error codes to discover which records exist: deleting a record
you lack the scope for returns 403, not 404, whether or not that record is real.
Absent records
Fetching a single record that does not exist returns200 with a body of null, not a 404.
Updating or deleting one returns 404, because acting on a record that is not there is a
different situation from looking for one that might not be.