HTTP Status Codes
Every HTTP status code a web app realistically returns, with what it actually means in practice.
Continue
The client should keep sending the request body.
Switching Protocols
The server agreed to switch protocol, typically to WebSocket.
OK
The request succeeded and the response carries the result.
Created
A new resource was created; its URL is usually in the Location header.
Accepted
The request was queued for processing but is not finished yet.
No Content
Success, but there is deliberately no response body.
Partial Content
A range of the resource is returned, used for resumable downloads and video seeking.
Moved Permanently
The resource has a new permanent URL; search engines transfer ranking to it.
Found
A temporary redirect; the original URL should keep being used.
See Other
Fetch the result of the request from a different URL using GET.
Not Modified
The cached copy is still fresh, so no body is sent.
Temporary Redirect
Like 302 but the method and body must not change.
Permanent Redirect
Like 301 but the method and body must not change.
Bad Request
The server could not understand the request, usually malformed JSON or a missing field.
Unauthorized
Authentication is missing or invalid. Really means "unauthenticated".
Payment Required
Reserved for payment flows; used by some APIs for billing limits.
Forbidden
The caller is authenticated but not allowed to do this.
Not Found
No resource matches this URL. Also used to hide existence of private resources.
Method Not Allowed
The URL exists but not for this HTTP method.
Not Acceptable
No representation matches the Accept headers the client sent.
Request Timeout
The client took too long to send the request.
Conflict
The request clashes with the current state, such as a duplicate or stale version.
Gone
The resource existed but was intentionally removed for good.
Payload Too Large
The request body exceeds the server limit: common on file uploads.
Unsupported Media Type
The Content-Type of the body is not supported by this endpoint.
I'm a teapot
An April Fools code from RFC 2324, still returned as a joke by some APIs.
Unprocessable Content
The syntax is fine but the data fails validation rules.
Too Many Requests
Rate limit hit. Check the Retry-After header before retrying.
Unavailable For Legal Reasons
Blocked because of a legal demand, such as a takedown or geo restriction.
Internal Server Error
An unhandled error on the server. The catch-all failure code.
Not Implemented
The server does not support the functionality required.
Bad Gateway
A proxy got an invalid response from the upstream server.
Service Unavailable
The server is overloaded or down for maintenance, usually temporary.
Gateway Timeout
A proxy waited too long for the upstream server to answer.
Insufficient Storage
The server ran out of room to store the representation.
- Choosing the correct status code while designing a REST API
- Debugging a failing integration by understanding the code the server returned
- Explaining an error class to a non-backend teammate
- Checking whether a code is safe to retry before writing retry logic
Free and private. Everything runs on your own device, with no account and no uploads.
HTTP status codes are the fastest way to describe what went wrong with a request, and also the easiest thing to get slightly wrong: 401 versus 403, 302 versus 307, 400 versus 422. This searchable reference lists every status code a real web application is likely to return, each with a short explanation of what it means in practice rather than a quote from the specification, filtered by class so you can scan just the 4xx or 5xx range when you are debugging.
401 Unauthorized really means unauthenticated: the caller has not proved who they are, or the token is invalid or expired. 403 Forbidden means identity is established but this caller is not allowed to perform this action, so re-authenticating will not help.
Use 400 when the request itself is malformed: broken JSON, a missing required parameter. Use 422 when the syntax is fine but the data fails business validation, such as an email that is already registered.
301 for a permanent move where changing the method is acceptable, or 308 when the method and body must be preserved. Search engines transfer ranking signals for both.
Yes, but only after the delay the server asks for. Read the Retry-After header and back off exponentially rather than retrying immediately, or you will extend the rate limit window.
A 502 Bad Gateway means the proxy received an invalid response from the upstream service: it answered, but badly. A 504 Gateway Timeout means the upstream never answered in time.
- 1
Search by code or keyword
Type 404, "rate limit" or "redirect" to narrow the list.
- 2
Filter by class
Use the 1xx to 5xx filters to see one family at a time.
- 3
Read the practical meaning
Each entry explains what the code signals in a real API.
- ·If you are unsure between two codes, pick the one that tells the client what to do next: that is the whole point of the status line.
- ·Never return 200 with an error object in the body; monitoring, caching and client libraries all key off the status code.
- ·Reserve 5xx for genuine server faults, so your error rate dashboards stay meaningful.