HTTP status codes
52 results
1xx — Informational
| Code | Name | What it means | Copy |
|---|---|---|---|
| 100 | Continue | The client should carry on with the request body. Sent when the client asked with Expect: 100-continue. | |
| 101 | Switching Protocols | The server is changing protocol as asked — this is how a WebSocket handshake completes. | |
| 102 | Processing | WebDAV: the request is in progress and has not timed out. | |
| 103 | Early Hints | Preload hints sent before the real response, so the browser can start fetching assets. |
2xx — Success
| Code | Name | What it means | Copy |
|---|---|---|---|
| 200 | OK | The request succeeded. For GET the body is the resource; for POST it is the result. | |
| 201 | Created | A new resource exists. The Location header should say where. | |
| 202 | Accepted | Taken for processing, not finished. Nothing here promises it will succeed. | |
| 203 | Non-Authoritative Information | A proxy modified the response it got from the origin. | |
| 204 | No Content | Success, and deliberately no body. The usual answer to a DELETE. | |
| 205 | Reset Content | Success — and the client should clear the form it submitted. | |
| 206 | Partial Content | A range request succeeded. This is what makes resumable downloads and video seeking work. | |
| 207 | Multi-Status | WebDAV: several results in one XML body. |
3xx — Redirection
| Code | Name | What it means | Copy |
|---|---|---|---|
| 300 | Multiple Choices | More than one representation exists and the client should pick. Almost never used. | |
| 301 | Moved Permanently | The resource has a new URL and always will. Search engines transfer ranking to it. | |
| 302 | Found | A temporary redirect. Search engines keep the old URL indexed. | |
| 303 | See Other | Go and GET this other URL — the pattern that stops a refresh resubmitting a form. | |
| 304 | Not Modified | Your cached copy is current. Sent in reply to If-None-Match or If-Modified-Since. | |
| 307 | Temporary Redirect | Like 302, but the method must not change. A POST stays a POST. | |
| 308 | Permanent Redirect | Like 301, but the method must not change. |
4xx — Client error
| Code | Name | What it means | Copy |
|---|---|---|---|
| 400 | Bad Request | The server could not parse it. Malformed JSON and bad syntax land here. | |
| 401 | Unauthorized | You are not authenticated. Despite the name it means unauthenticated, not unauthorised. | |
| 402 | Payment Required | Reserved. Some APIs use it for a quota or billing problem. | |
| 403 | Forbidden | You are authenticated and still not allowed. Re-authenticating will not help. | |
| 404 | Not Found | Nothing at this URL. The server is not saying whether it ever existed. | |
| 405 | Method Not Allowed | The URL exists but not for this verb. The Allow header should list what works. | |
| 406 | Not Acceptable | Nothing the server can produce matches the Accept header. | |
| 407 | Proxy Authentication Required | Like 401, but it is the proxy asking. | |
| 408 | Request Timeout | The client took too long to send the request. | |
| 409 | Conflict | The request clashes with the current state — an edit against a stale version, a duplicate key. | |
| 410 | Gone | Deliberately removed and not coming back. Stronger than 404, and search engines drop it faster. | |
| 411 | Length Required | The server wants a Content-Length header. | |
| 412 | Precondition Failed | An If-Match or If-Unmodified-Since condition did not hold. | |
| 413 | Content Too Large | The body is bigger than the server accepts. Often a proxy limit rather than the app. | |
| 414 | URI Too Long | The URL exceeds what the server will parse. Usually a GET that should be a POST. | |
| 415 | Unsupported Media Type | The Content-Type is not one the endpoint handles. | |
| 418 | I'm a teapot | An April Fools joke from 1998 that browsers and servers still implement. | |
| 422 | Unprocessable Content | The syntax is fine but the content fails validation. The usual choice for form errors in an API. | |
| 425 | Too Early | The server will not risk replaying an early-data request. | |
| 426 | Upgrade Required | The client must switch protocol, typically to TLS. | |
| 428 | Precondition Required | The server requires a conditional request, to stop lost updates. | |
| 429 | Too Many Requests | Rate limited. Retry-After says how long to wait. | |
| 431 | Request Header Fields Too Large | The headers, often a cookie, are too big. | |
| 451 | Unavailable For Legal Reasons | Blocked by a legal demand. The number is a nod to Fahrenheit 451. |
5xx — Server error
| Code | Name | What it means | Copy |
|---|---|---|---|
| 500 | Internal Server Error | The server broke and has nothing more specific to say. Check the logs. | |
| 501 | Not Implemented | The server does not support the method at all. | |
| 502 | Bad Gateway | A proxy got an invalid response from upstream. Usually the app behind it is down. | |
| 503 | Service Unavailable | Temporarily unable to handle the request — overloaded, or in maintenance. | |
| 504 | Gateway Timeout | A proxy waited for upstream and gave up. | |
| 505 | HTTP Version Not Supported | The server refuses that HTTP version. | |
| 507 | Insufficient Storage | WebDAV: no room to store the representation. | |
| 508 | Loop Detected | WebDAV: an infinite loop while processing. | |
| 511 | Network Authentication Required | A captive portal — sign in to the wifi before continuing. |
A static table · nothing is uploaded
Every HTTP status code with a sentence on what it actually tells you, grouped by class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. Search by number or by name.
How to look up a status code
The first digit is the part that matters most: 4xx means the request was wrong and repeating it unchanged will not help, 5xx means the server failed and the same request might work later. That distinction decides whether a client should retry, and getting it wrong in an API is how you end up with clients hammering an endpoint that will never succeed. Three pairs are worth knowing properly. **401 versus 403**: 401 means you have not authenticated and a credential would help; 403 means you have and it does not — despite the name being "Unauthorized", 401 is the unauthenticated one. **301 versus 302**: 301 is permanent and search engines move ranking to the new URL, 302 is temporary and they keep the old one indexed, so choosing 302 for a site migration quietly costs you the migration. **307/308 versus 302/301**: the newer pair guarantee the method does not change, which matters because browsers historically turned a redirected POST into a GET. 422 deserves a mention because it is the one people reach for and then doubt. If the request parsed fine as JSON but a field failed validation, 400 is technically defensible and 422 is more precise — the syntax was right and the content was not. Either is fine; being consistent across your API matters more than which you pick.
Questions
401 means not authenticated — a credential would help. 403 means authenticated and still not allowed, so re-authenticating will not help.