HTTP Status Codes
HTTP status code reference — code, name, and what each means in practice. From 100 Continue to 511 Network Authentication Required.
A reference for common and legacy HTTP status codes, with practical descriptions for the ones you actually see.
No matches.
HTTP status codes are the three-digit numbers a server returns with every response. The first digit identifies the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. The codes below cover the standard set defined by RFC 9110 plus the commonly-deployed extensions you will see in real APIs.
1xx — Informational
The request was received and the process continues. Rarely surfaced to end users.
| Code | Name | Description |
|---|---|---|
100 | Continue | Initial part of the request received; continue with the rest. Used with the Expect: 100-continue header. |
101 | Switching Protocols | Server is switching protocols at the client's request — typically upgrading from HTTP/1.1 to WebSockets. |
102 | Processing | Server has received and is processing the request, but no response is available yet. From WebDAV (RFC 2518); deprecated — rarely sent today. |
103 | Early Hints | Used to return preliminary headers (e.g. Link headers for preload) before the final response is ready. |
2xx — Success
The request was successfully received, understood, and accepted.
| Code | Name | Description |
|---|---|---|
200 | OK | Request succeeded; response content depends on the method. HEAD has no body. |
201 | Created | One or more resources created; the primary resource is identified by Location, or by the target URI if Location is absent. |
202 | Accepted | Request accepted for processing but not yet completed. Used for async work — the response usually includes a status URL. |
203 | Non-Authoritative Information | Returned content is from a transforming proxy, not the origin server. |
204 | No Content | Request succeeded; intentionally no body. Common for DELETE and PUT operations. |
205 | Reset Content | Tells the client to reset the document view (e.g. clear a form). |
206 | Partial Content | Range request was successful — body contains the requested byte range. Used by video players, resumable downloads. |
207 | Multi-Status | Body contains multiple individual response status codes (WebDAV). |
208 | Already Reported | Members of a DAV binding have already been enumerated in a previous part of the multistatus response. |
226 | IM Used | Server has fulfilled a GET request and the response represents the result of one or more instance-manipulations applied to the current instance. |
3xx — Redirection
Further action needs to be taken — usually the client should request a different URL.
| Code | Name | Description |
|---|---|---|
300 | Multiple Choices | Multiple options are available; the client (or user) should choose one. |
301 | Moved Permanently | Resource has permanently moved to the URL in the Location header. Search engines should update their index. |
302 | Found | Resource is temporarily at a different URL. Originally "Moved Temporarily"; semantics tightened in HTTP/1.1. |
303 | See Other | Directs the client to retrieve another resource using GET or HEAD. |
304 | Not Modified | Cached version is still valid. Used with If-Modified-Since / If-None-Match conditional requests. |
305 | Use Proxy | Deprecated. The requested resource must be accessed through the specified proxy. |
307 | Temporary Redirect | Like 302 but the request method MUST NOT change (a POST stays a POST). |
308 | Permanent Redirect | Like 301 but the request method MUST NOT change. |
4xx — Client Error
The request contains bad syntax or cannot be fulfilled by the server.
| Code | Name | Description |
|---|---|---|
400 | Bad Request | Server cannot or will not process the request due to a client error (malformed syntax, invalid framing, etc.). |
401 | Unauthorized | Valid authentication credentials are missing; a WWW-Authenticate challenge is required. |
402 | Payment Required | Reserved for future use. Some APIs use it to indicate quota exhaustion. |
403 | Forbidden | The server understood the request but refuses it. Successful authentication is not a prerequisite. |
404 | Not Found | The requested resource could not be found. May be temporary or permanent. |
405 | Method Not Allowed | Known method unsupported by this resource; an Allow header is required. |
406 | Not Acceptable | Server cannot produce a response matching the list of acceptable values defined in the request's Accept headers. |
407 | Proxy Authentication Required | Like 401, but authentication is needed by the proxy server. |
408 | Request Timeout | Server timed out waiting for the request. |
409 | Conflict | Request conflicts with current state of the server (e.g. an edit conflict). |
410 | Gone | Resource has been permanently removed and will not be available again. Search engines should remove from index. |
411 | Length Required | Request did not specify the length of its content, which is required. |
412 | Precondition Failed | A precondition given in one or more request headers evaluated to false. |
413 | Content Too Large | Request body is larger than the server is willing or able to process. Called "Payload Too Large" before RFC 9110. |
414 | URI Too Long | URI provided was too long for the server to process. Often a sign of GET parameters that should be a POST body. |
415 | Unsupported Media Type | Request entity has a media type the server or resource does not support. |
416 | Range Not Satisfiable | Client has asked for a portion of the file (range request), but the server cannot supply that portion. |
417 | Expectation Failed | Server cannot meet the requirements of the Expect request-header field. |
418 | (Unused) | Reserved as unused in the current IANA registry; historically associated with the teapot joke. |
421 | Misdirected Request | Request was directed at a server that is not able to produce a response. |
422 | Unprocessable Content | Request was well-formed but contained semantic errors. Common for validation failures in REST APIs. |
423 | Locked | Resource being accessed is locked (WebDAV). |
424 | Failed Dependency | Request failed because it depended on another request that failed (WebDAV). |
425 | Too Early | Server is unwilling to risk processing a request that might be replayed. |
426 | Upgrade Required | Server refuses the request over the current protocol; the Upgrade response header names the protocol(s) it requires. |
428 | Precondition Required | Origin server requires the request to be conditional. |
429 | Too Many Requests | User has sent too many requests in a given amount of time. Used for rate limiting. |
431 | Request Header Fields Too Large | Server is unwilling to process the request because either an individual header field, or all the header fields collectively, are too large. |
451 | Unavailable For Legal Reasons | Resource is unavailable due to legal demands (court order, GDPR removal, etc.). |
5xx — Server Error
The server failed to fulfil an apparently valid request.
| Code | Name | Description |
|---|---|---|
500 | Internal Server Error | Generic catch-all server error. Something blew up; the server doesn't know how to characterize it. |
501 | Not Implemented | Server does not support the functionality required to fulfil the request. |
502 | Bad Gateway | Server, while acting as a gateway or proxy, received an invalid response from an upstream server. |
503 | Service Unavailable | Server is currently unable to handle the request — overloaded or down for maintenance. |
504 | Gateway Timeout | Server, while acting as a gateway or proxy, did not receive a timely response from an upstream server. |
505 | HTTP Version Not Supported | Server does not support the HTTP protocol version that was used in the request. |
506 | Variant Also Negotiates | Transparent content negotiation for the request results in a circular reference. |
507 | Insufficient Storage | Server is unable to store the representation needed to complete the request (WebDAV). |
508 | Loop Detected | Server detected an infinite loop while processing the request (WebDAV). |
510 | Not Extended (OBSOLETED) | Legacy HTTP Extension Framework code; obsolete in the IANA registry. |
511 | Network Authentication Required | Client needs to authenticate to gain network access — typical of captive portals. |
Use the filter above to find a code, then check the request method and response headers before changing client behavior. A status alone does not identify the failing line of code, prove that a payment failed, or tell you whether a retry is safe.
Read the class first
| Class | General meaning | Useful next check |
|---|---|---|
| 1xx | Interim information | Look for the final response |
| 2xx | Successful receipt, understanding, and acceptance | Does this response mean completed or merely accepted? |
| 3xx | Further action needed | Inspect Location or cache validators, depending on the code |
| 4xx | The request cannot be fulfilled as received | Inspect credentials, input, resource state, and API rules |
| 5xx | Server-side failure | Check the origin, gateway, and upstream logs |
A 202 Accepted does not promise successful completion. If an API returns a job identifier, follow its documented status endpoint. A 204 No Content has no response body; do not require JSON parsing on every successful request. A 200 response to HEAD also has no body. See MDN’s response overview.
The distinctions that change implementation
| Codes | Difference |
|---|---|
| 401 / 403 | 401 lacks valid authentication credentials and requires a WWW-Authenticate challenge. 403 means understood but refused; authentication need not have succeeded. |
| 405 / 501 | 405 is a known method unsupported by this resource, with a required Allow header. 501 means the server lacks required functionality, including an unrecognized or unimplemented method. |
| 301 / 302 vs 307 / 308 | 301/302 permit POST to change to GET. 307/308 preserve the method; 301/308 are permanent. |
| 303 / 304 | 303 points to a retrieval using GET or HEAD. 304 answers a conditional GET/HEAD without content, allowing reuse of a stored representation. |
These distinctions follow RFC 9110. A server may use 404 to avoid revealing a forbidden resource. Do not add an “authentication-related” hint if it would defeat that policy.
For a created resource, 201 identifies the primary resource using Location, or the target URI when that header is absent. For 503, Retry-After is optional. The header can be an HTTP date or a delay in seconds; it is not invariably a number.
Before retrying a request
A 429 means too many requests. The response may include Retry-After; RFC 6585 does not require it. Absence of the header is not permission to retry continuously.
Use this debugging sequence:
- Record the method, URL, status, timestamp, and request identifier. Exclude tokens, cookies, and private request data from a shared report.
- Read the response body and relevant headers. A gateway-generated HTML error can explain why a JSON parser failed.
- Check whether the server might already have performed the operation. A timeout after submitting an order is different from a rejected validation request.
- Follow the API’s documented retry and idempotency mechanism. Do not assume resubmitting POST is harmless, or invent a universal retry count from the status class.
- For a recurring error, compare the client request with server or gateway logs using the request identifier.
This separates “what response arrived” from “what the application actually did.” It also avoids treating every 5xx response as proof that no work occurred.
Current names and nonstandard codes
The IANA registry is the authority for registered names. 413 is Content Too Large and 422 is Unprocessable Content. Older documentation may use “Payload Too Large” and “Unprocessable Entity.” 418 is reserved as unused in the current registry; its familiar teapot name comes from an older joke specification. 510 is obsolete. This page’s table covers common and legacy codes, rather than claiming to include every temporary registration.
Software can also record nonstandard codes in logs. Check that software’s documentation before interpreting one as a response the client actually received.
For adjacent tasks, use the JSON formatter. For other references, see Git commands and the regex cheat sheet.
Sources checked September 27, 2026. API-specific error bodies, authentication schemes, and retry contracts still need that API’s documentation.