Methods, status codes, and headers

The protocol already made these decisions

GET reads and must not change anything. PUT replaces and is idempotent. POST creates and is not. DELETE removes and should be safe to repeat. Following that is what lets caches, proxies, and retry logic behave correctly without knowing anything about your domain.

Status codes are part of your API contract. A 200 with an error message in the body defeats every client library, every monitor, and every retry policy in the path.

Idempotency matters most for retries. A client that times out will retry, and if your create endpoint is not idempotent you will produce duplicates — an idempotency key is the standard remedy.