Choose 412 when If-Match or If-Unmodified-Since checks fail; choose 409 for state conflicts without failed precondition headers during concurrent updates.
Last reviewed: February 20, 2026|Editorial standard: source-backed comparison guidance
HTTP/1.1 409 Conflict
Content-Type: application/json
{
"error": "conflict",
"message": "Order is already in terminal state and cannot be cancelled."
}HTTP/1.1 412 Precondition Failed
Content-Type: application/json
{
"error": "precondition_failed",
"message": "If-Match precondition did not match current ETag.",
"current_etag": "\"v8\""
}Return 412 because HTTP defines failed preconditions with that status. This lets clients detect stale validators and retry with fresh state.
Yes. 409 is appropriate for state conflicts that are not represented as explicit precondition failures in request headers.
For 412, refresh representation and validators (such as ETag) before retrying. For 409, resolve domain conflict logic first, then retry only if operation is still valid.
Use 403 for explicit access denial, or 404 to conceal resource existence when security policy requires reducing endpoint and object enumeration risk.
Fix 401 Unauthorized vs 403 Forbidden by separating authentication failures from authorization denials, then apply the right login or permission fix fast.