Edit: This comment comes off as overly critical. I really do love these diagrams, I&#x27;ve just had this argument so many times with people I find it frustrating.<p>I completely disagree with this part of the diagram:<p><a href="https:&#x2F;&#x2F;imgur.com&#x2F;HZS3cVy" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;HZS3cVy</a><p>If the resource is secret then the entire guessable path should return a 401 or a 403, not a 404. Knowing whether something exists is a <i>privilege</i> that a user needs to authenticate in order to gain. This isn&#x27;t just an academic distinction. Github does 404s for unauthenticated requests and python&#x27;s default http client (at least for python 2) doesn&#x27;t send credentials unless it hits a 403 or a 401. Since github sends a 404 you have to hack around the language.<p>404 means Not Found. But that isn&#x27;t true. The real status code is Forbidden and it should be used on all possible urls that follow a guessable pattern.