A 401 is useful evidence when the scenario intentionally omits credentials. It is not proof that the protected feature works. I prefer a coverage report that separates successful workflows, expected rejections, and paths that could not be exercised.

Checking a 201 response proves less than it seems. I want to read the returned record through the normal detail endpoint, find it in the relevant list, and inspect its visible author and fields. For important journeys, the browser is another independent check.