HTTP status codes
Every common status code in plain English. Search by number or name, or filter by class.
The server received the request headers; the client should send the body.
The server is switching protocols as requested, for example to WebSocket.
The server is still processing the request (WebDAV).
Lets the browser start preloading resources while the server prepares the response.
The request succeeded.
The request succeeded and a new resource was created, usually after a POST.
The request was accepted for processing but is not finished yet.
The response came from a proxy and may differ from the origin server.
The request succeeded and there is nothing to return. Common for DELETE and PUT.
Tells the client to reset the document view, for example clear a form.
Only part of the resource is returned, in response to a Range request.
The resource has a new permanent URL. Search engines transfer ranking to it.
Temporary redirect. The client should keep using the original URL in future.
Redirects to another URL, which should be fetched with GET.
The cached version is still valid, so no body is sent.
Temporary redirect that keeps the same HTTP method.
Permanent redirect that keeps the same HTTP method.
The server cannot process the request because of a client error, such as malformed JSON.
Authentication is required or has failed. Despite the name, it means unauthenticated.
Reserved for future use; some APIs use it for billing limits.
The server understood the request but refuses it. The identity is known, but not allowed.
The resource does not exist at this URL.
The HTTP method is not supported for this resource. The Allow header lists valid ones.
The server cannot produce a response matching the Accept headers.
The server timed out waiting for the request.
The request conflicts with the current state, for example a duplicate or an edit conflict.
The resource used to exist and was deliberately removed, permanently.
The request needs a Content-Length header.
A condition in the request headers, such as If-Match, was not met.
The request body is larger than the server allows.
The URL is longer than the server will process.
The Content-Type of the request body is not supported.
An April Fools joke from RFC 2324. Some servers use it to reject bots.
The request is well-formed but fails validation. Common for APIs.
The resource is locked (WebDAV).
The server will not process a request that might be replayed.
The client must switch to a different protocol.
The server requires the request to be conditional.
Rate limit exceeded. Look for a Retry-After header.
The request headers are too large.
The resource is blocked for legal reasons.
A generic server error. Something went wrong that the server cannot describe more precisely.
The server does not support the functionality required for this request.
A gateway or proxy received an invalid response from the upstream server.
The server is temporarily unable to handle the request, for example overloaded or down for maintenance.
A gateway or proxy did not get a timely response from the upstream server.
The HTTP version in the request is not supported.
The server cannot store the representation needed to complete the request (WebDAV).
The client must authenticate to gain network access, as on a captive portal.
Status codes by class
- 1xx informational: the request is in progress.
- 2xx success: it worked.
- 3xx redirection: look somewhere else.
- 4xx client error: the request is the problem.
- 5xx server error: the server is the problem.
Picking the precise code makes APIs easier to debug and lets clients react correctly: retry on 503, re-authenticate on 401, fix the input on 422.
Frequently asked questions
What is the difference between 401 and 403?
401 Unauthorized really means unauthenticated: the server does not know who you are. 403 Forbidden means it knows who you are and you are not allowed.
When should an API return 400, 422 or 409?
400 for a request that cannot be parsed, 422 for well-formed data that fails validation, and 409 for a conflict with the current state such as a duplicate.
What is the difference between 301 and 302?
301 is a permanent redirect (search engines move ranking to the new URL). 302 is temporary. 307 and 308 are the same as 302 and 301 but never change the HTTP method.
What do 502, 503 and 504 mean?
502: a proxy got a bad answer from the app behind it. 503: the service is temporarily unavailable or overloaded. 504: the proxy waited too long for the app.