Writing tests for working code

I have to write unit tests for an API backend server. These will be pretty standard tests: assert the response is 200 OK under certain circumstances and 403 Forbidden under other circumstances, etc.

The thing is, this is working code that has served its purpose for a while now. Therefore, everything I know about unit testing falls apart. I can't follow the traditional workflow where I write a failing test first and then work on a piece of code until the test passes. My fear here is to end up writing "condescendent" tests.

Of course tests are most valuable when written since the very beginning, but they're welcome at any point in time, specially when the time to make changes to the codebase comes.

Any suggested approach or guidelines on this matter?

Thanks a lot.