HTTP 401 — Unauthorized
HTTP 401 is about identity, not permission: the server does not know who you are. Either no credentials were sent or they are invalid, and the response often includes a WWW-Authenticate header describing how to authenticate.
When 401 shows up
- API calls with a missing, expired or malformed bearer token.
- Session expiry where the client must re-authenticate and retry.
Mocking a 401 response
A response with this status can be faked end to end with a local mock rule — no backend changes needed. The configuration below mirrors the rule fields the ApiSimul editor uses (method, path, status, delay in milliseconds, response body):
{
"method": "GET",
"path": "/api/me",
"status": 401,
"delay": 160,
"enabled": true,
"body": {
"error": "invalid_token",
"message": "The access token is expired."
}
}Dynamic placeholders such as {{random.name}}, {{string.uuid}} or {{number.int 1 100}} can appear inside the body to vary each response, which keeps client-side list rendering and retry logic honest during development.
Frequently asked questions
What does HTTP 401 mean?
Authentication is required and the supplied credentials did not identify the caller. Obtaining fresh credentials and repeating the request may succeed.
How can I test a 401 response without a real backend?
Define a mock rule with the method and path your client requests and set the status to 401. The example configuration above returns this response after the listed delay, so the client exercises its 401 handling exactly as it would against a live server.
Related status codes
Need the response in your own project? Spin up rules for any status with the ApiSimul mock server, or browse every status code page.