A3 · HTTP Response Anatomy: An HTTP response is like a **delivery receipt + package**: at the top a big **stamp** (status code — did it succeed, 200/201/404/500), below it **deli
An HTTP response is like a **delivery receipt + package**: at the top a big **stamp** (status code — did it succeed, 200/201/404/500), below it **delivery notes** (headers — content type, cache, size), and at the very end **the package itself** (body — the actual data). But if the status code already says "success", why also check the body? Because the status only tells you the request REACHED and was PROCESSED by the server, not that the data inside is CORRECT: the server returns 200 but the `severity` field may differ from what was expected — the light is green but the vehicle took the wrong road. In Java the equivalent is a method's `return` value: a method returning without throwing (200) does not mean the returned object's fields are right; you also verify the content with `assertEquals`. In QA this is where the "false PASS" is born: a test that only checks the status code looks green but actually lets wrong data through — it detonates as a silent bug in production.
The Three Parts of a Response
🎬 200 but Wrong: Status Green, Data Red
The server returned 200 OK to `GET /api/v1/bugs/42`. The test looks green — but is everything really fine?
The status code only says "request processed". The actual data is in the body — and there `severity` came back `LOW` instead of the expected `CRITICAL`.
A test that only checks the status DOES NOT see this difference — it passes green. The wrong data slips through the test like a ghost.
A good tester verifies the fields INSIDE the body one by one: is `severity === "CRITICAL"`? Only then is the ghost caught.
The lesson — The status code is necessary but NOT sufficient. The "200 = success" assumption is the mother of false PASSes; the body is always verified separately.
How Is a False PASS Born?
Test only checks the status…
The test only verifies `status === 200` and passes. The body is never read.
Wrong data slips through the body…
Even if `severity` is wrong, since the status is 200 the test passes green — the defect stays invisible.