HTTP Status Code Reference

Browse HTTP status codes with descriptions.

http-status

Code	Name	Class	Meaning
100	Continue	Informational	The client should continue with its request.
101	Switching Protocols	Informational	The server is switching protocols as requested.
200	OK	Success	The request succeeded.
201	Created	Success	The request succeeded and a new resource was created.
202	Accepted	Success	The request was accepted but not yet processed.
204	No Content	Success	Success, but there is no content to return.
206	Partial Content	Success	The server delivered part of the resource (range request).
301	Moved Permanently	Redirection	The resource has permanently moved to a new URL.
302	Found	Redirection	The resource is temporarily at a different URL.
304	Not Modified	Redirection	The cached version is still valid.
307	Temporary Redirect	Redirection	Temporary redirect that preserves the method.
308	Permanent Redirect	Redirection	Permanent redirect that preserves the method.
400	Bad Request	Client Error	The server could not understand the request.
401	Unauthorized	Client Error	Authentication is required and has failed or not been provided.
403	Forbidden	Client Error	The server understood but refuses to authorize the request.
404	Not Found	Client Error	The requested resource could not be found.
405	Method Not Allowed	Client Error	The HTTP method is not supported for this resource.
408	Request Timeout	Client Error	The server timed out waiting for the request.
409	Conflict	Client Error	The request conflicts with the current state of the resource.
410	Gone	Client Error	The resource is permanently gone.
418	I'm a teapot	Client Error	An April Fools joke from RFC 2324.
422	Unprocessable Entity	Client Error	The request was well-formed but semantically invalid.
429	Too Many Requests	Client Error	The client has sent too many requests (rate limited).
500	Internal Server Error	Server Error	A generic server-side error occurred.
501	Not Implemented	Server Error	The server does not support the requested functionality.
502	Bad Gateway	Server Error	An upstream server returned an invalid response.
503	Service Unavailable	Server Error	The server is temporarily overloaded or down.
504	Gateway Timeout	Server Error	An upstream server did not respond in time.

§01 ABOUT THIS TOOL

Overview

A status code is the server’s one-word summary of what happened, and picking the wrong one has consequences well beyond tidiness: it changes whether clients retry, whether caches store the response, whether crawlers keep the URL, and whether a proxy handles the request again.

This is a searchable reference for the codes you actually meet, with the practical distinction for each rather than a restatement of the specification.

How to use

Type a number (404) or part of a name (gateway) to filter the list. Matching is on both fields, so too many and 429 find the same entry.

The five classes

Class	Meaning	What a client should do
`1xx`	Informational — the request is still in progress	Keep waiting
`2xx`	Success	Use the response
`3xx`	Redirection — the resource is elsewhere, or unchanged	Follow, or use the cache
`4xx`	Client error — the request itself is the problem	Do not retry unchanged
`5xx`	Server error — the request may have been fine	Retry with backoff

The 4xx/5xx split is the one that matters most in practice, because it determines retry behaviour. A server that returns 500 for a malformed request will be sent that same malformed request again, and again, by every well-behaved client with a retry policy. Returning 400 stops the loop.

The distinctions worth getting right

200 with an error in the body. Common in APIs and almost always wrong. Every layer between you and the client — caches, proxies, monitoring, retry logic — reads the status code, not your JSON. An error that returns 200 is invisible to all of them.

201 vs 200 on create. 201 should carry a Location header pointing at the new resource. That is the part clients use; the code alone adds little.

202 Accepted. The right answer for work you queued rather than did. It is a promise, so it needs to tell the client where to check — a status URL, or a job id.

204 No Content. Success with an intentionally empty body, typically for DELETE or a PUT that returns nothing. It must have no body at all, not an empty JSON object.

304 Not Modified. The response to a conditional request whose ETag or Last-Modified still matches. It carries no body, which is the entire point: the client already has the bytes. If you never return 304, every revalidation transfers the whole resource again.

400 vs 422. 400 for a request the server could not parse — malformed JSON, a missing required parameter. 422 for a request that parsed cleanly and failed validation. The distinction tells a client whether to fix its serialisation or its data.

405 Method Not Allowed. Must include an Allow header listing the methods that are accepted. Without it the client has been told no with no way forward.

409 Conflict. For a request that cannot be applied to the current state — an edit against a stale version, a duplicate that violates a uniqueness constraint. Not a generic “something was wrong”.

410 Gone. A stronger 404: this existed and will not come back. Crawlers drop a 410 faster than a 404, which is what you want for content you deliberately removed.

429 Too Many Requests. Needs Retry-After. Without it, clients guess, and they guess badly — usually by retrying immediately.

502 vs 503 vs 504. 502 means an upstream gave an invalid response. 503 means this server is unavailable, typically overloaded or in maintenance. 504 means an upstream did not answer in time. They point at three different places, and using them interchangeably makes an outage harder to locate.

Examples

A crawler keeps requesting a deleted page. Return 410 rather than 404.
A client hammers a failing endpoint. Check whether the failure returns 5xx for what is actually a 4xx condition.
A form submission loses its data behind a redirect. The redirect is probably 301 or 302; switch to 308 or 307.
A CDN will not cache a response. 2xx and 3xx are cacheable by default; most 4xx are not, and 5xx never should be.
An API returns 200 and clients ignore the failure. They are not ignoring it — nothing told them.

Notes

418 I'm a teapot is real, in the sense that it is registered and permanently reserved. It comes from an April Fools’ RFC and exists in the list because people look it up.

Codes outside the registry are legal. A client must treat any unknown code by its class, so a custom 299 is handled as a success and a custom 599 as a server error. Using one is rarely worth the confusion.

The list here covers the codes in real use. The full registry is maintained by IANA and includes codes for WebDAV and other extensions that a typical web service never returns.

To see which codes a live URL actually returns, including its redirect chain, use the HTTP header checker.

FAQ

Does this send anything anywhere?

No. The code list is part of the page. It works offline once loaded, and nothing you type leaves your browser.

What is the difference between 401 and 403?

401 means the request was not authenticated — the server does not know who you are, and a valid credential would change the answer. 403 means it does know and the answer is still no. A 401 must include a WWW-Authenticate header saying how to authenticate; a 403 has nothing to offer.

When should I use 404 instead of 403?

Use 404 when acknowledging the resource exists would itself leak information. Returning 403 for /users/42 tells an attacker that user 42 exists; 404 does not. This is a deliberate lie and it is the right one for authorization-sensitive resources.

Which redirects preserve the request method?

307 and 308. Clients historically converted POST to GET when following 301 and 302, and that behaviour is still widespread, so use 308 for a permanent move and 307 for a temporary one whenever a POST might be involved.

Is 429 the same as 503?

No. 429 means this client sent too many requests and should slow down. 503 means the server as a whole cannot serve anyone right now. Both should carry Retry-After, and confusing them makes client backoff behave wrongly.