HTTP Status Codes: The Complete Reference

Every HTTP response starts with a three-digit status code that tells the client, in one number, what happened: did the request work, was something redirected, did the client make a mistake, did the server fail? The first digit sets the class:

Class	Meaning
1xx	Informational — the request is still being processed
2xx	Success — the request worked
3xx	Redirection — the client needs to look elsewhere
4xx	Client error — the request itself was the problem
5xx	Server error — the server failed to fulfil a valid request

The rest of this article is a lookup table for every code you're likely to run into, plus the distinctions that actually trip people up in practice.

1xx — Informational

Code	Name	What it means
100	Continue	The initial part of the request has been received; the client should continue with the body.
101	Switching Protocols	The server agrees to switch protocols, as requested by an Upgrade header (e.g. to WebSocket).
103	Early Hints	Lets the client start preloading resources while the server is still preparing the final response.

2xx — Success

Code	Name	What it means
200	OK	The request succeeded. The precise meaning depends on the method: GET returns a resource, POST returns the result of an action.
201	Created	The request succeeded and a new resource was created, usually in response to a POST or PUT.
202	Accepted	The request was accepted for processing, but that processing isn't finished yet.
204	No Content	The request succeeded but there's no body to return — common after a successful DELETE.
206	Partial Content	Only part of the resource is being returned, in response to a Range header — used for resumable downloads and video streaming.

3xx — Redirection

Code	Name	What it means
300	Multiple Choices	The request has more than one possible response; the client (or user) must pick one.
301	Moved Permanently	The resource has permanently moved to a new URL, given in the Location header. Search engines transfer ranking to the new URL.
302	Found	The resource temporarily lives at a different URL. Unlike 301, this should not be cached as permanent.
303	See Other	The response can be found at another URL using a GET, regardless of the original method — the classic post-redirect-get pattern.
304	Not Modified	The cached version the client already has is still valid; no body is sent.
307	Temporary Redirect	Like 302, but guarantees the method and body are repeated exactly on the new request.
308	Permanent Redirect	Like 301, but guarantees the method and body are repeated exactly on the new request.

4xx — Client Error

Code	Name	What it means
400	Bad Request	The server can't process the request due to a client error — malformed syntax, invalid JSON, bad parameters.
401	Unauthorized	Authentication is required or has failed. Despite the name, this is about who you are, not what you're allowed to do.
402	Payment Required	Reserved for future use; some APIs repurpose it for billing or quota-exceeded errors.
403	Forbidden	The server understood the request but refuses to authorize it — re-authenticating won't help.
404	Not Found	The server can't find the requested resource. The most recognizable status code on the web.
405	Method Not Allowed	The resource exists but doesn't support the HTTP method used (e.g. DELETE on a read-only endpoint).
406	Not Acceptable	The server has no representation matching what the Accept headers requested.
408	Request Timeout	The server timed out waiting for the request; the client may simply retry.
409	Conflict	The request conflicts with the current state of the resource — a common response to concurrent edits.
410	Gone	The resource used to exist but has been permanently removed, with no forwarding address.
411	Length Required	The server refuses the request because Content-Length wasn't specified.
412	Precondition Failed	A condition in a header such as If-Match or If-Unmodified-Since wasn't met.
413	Payload Too Large	The request body exceeds a limit the server is willing to accept.
414	URI Too Long	The requested URL is longer than the server is willing to interpret.
415	Unsupported Media Type	The request body's format isn't supported, usually a wrong Content-Type header.
416	Range Not Satisfiable	The Range header requests a byte range the resource doesn't have.
417	Expectation Failed	The server can't meet the requirements of the Expect request header.
418	I'm a Teapot	An April Fools' joke from RFC 2324 — some servers use it deliberately as an Easter egg.
422	Unprocessable Content	The request is well-formed but semantically invalid — the classic response to failed validation rules.
425	Too Early	The server is unwilling to risk processing a request that might be replayed.
429	Too Many Requests	The client has sent too many requests in a given time — rate limiting. A Retry-After header often follows.
431	Request Header Fields Too Large	The request's header fields are too large for the server to process.
451	Unavailable For Legal Reasons	The resource is withheld due to a legal demand, such as a government-mandated content block.

5xx — Server Error

Code	Name	What it means
500	Internal Server Error	A generic catch-all: something went wrong on the server and no more specific code applies.
501	Not Implemented	The server doesn't support the functionality required to fulfil the request.
502	Bad Gateway	Acting as a gateway or proxy, the server got an invalid response from the upstream server.
503	Service Unavailable	The server is temporarily unable to handle the request — overloaded or down for maintenance.
504	Gateway Timeout	Acting as a gateway, the server didn't get a timely response from the upstream server.
505	HTTP Version Not Supported	The server doesn't support the HTTP protocol version used in the request.
507	Insufficient Storage	The server can't store the representation needed to complete the request (WebDAV).
511	Network Authentication Required	The client needs to authenticate to gain network access — typical of captive portals on public Wi-Fi.

The distinctions that actually matter

401 vs 403. 401 means you haven't proven who you are yet — no or invalid credentials. 403 means the server knows exactly who you are and has decided you're not allowed. Logging in again fixes a 401; it does nothing for a 403.

404 vs 403 vs 400. If your API returns 404 for a request you think should work, check for a typo in the path, a trailing-slash mismatch, or a route that isn't registered — not a permissions problem, which would be 403. If the URL is right but a parameter is malformed, that's 400, not 404.

Which redirect to use. 301 for a permanent move that search engines should follow and re-index under the new URL. 302 or 307 for a temporary one. 303 specifically to turn a POST into a GET on the next request — the pattern behind post-redirect-get, which stops a form resubmission on refresh.

409 vs 422. 409 is about a conflict with the resource's current state — someone else edited the same row first. 422 is about the request being invalid on its own terms — a required field is missing, a value fails a validation rule — independent of anything else happening concurrently.

Looking a status code up while you work

If you're inspecting a URL that's returning an unexpected redirect chain or want to break a request apart into its components before you go hunting for the failing status code, the URL Parser splits any URL into its protocol, host, path and query parameters. If the code you're chasing came from a regular expression a router or middleware used to match (or fail to match) a route, the Regex Tester lets you check that pattern against real paths before you go digging through server logs.