HTTP Status 200 when a mutation fails

I’m using graphene.contrib.django

If I raise an exception inside a mutation’s mutate_and_get_payload() (e.g. because of a failed data validation), the resulting http response’s code is 200 (OK). I’d expect 400 (Bad request).

[mjtamlyn]

As far as I can tell from the GraphQL spec there is no discussion of http response codes at all. The status codes of HTTP are strongly tied to rest principles. It’s not clear to me whether GraphQL APIs should distinguish between 2XX and 4XX status codes.

Most notably, you can batch multiple mutations into the same request to the server. If one successfully creates a resource (201), one mutates a resource (200), one fails validation (400) and another the target object does not exists (404), what should the return value from the API be?

At the moment, GraphQL APIs seem to err on the side of 200 unless the server blows up, in which case 500.

[helpse]

@mjtamlyn I agree with you. However, sometimes you want to send a 401 Unauthorized or a 403 Forbidden. Under these circumstances, graphene should send a 401/403 HTTP status.