HTTP Status Codes Reference Free

Search by code or keyword, or filter by class. Each entry explains what the code means and, where it matters, how to use it correctly in an API or when redirecting.

🌐 HTTP status codes

43 codes

  • 100
    Continue
    The server has received the request headers; the client should send the body.
  • 101
    Switching Protocols
    The server is switching protocols as requested, e.g. to WebSocket.
  • 103
    Early Hints
    Lets the browser start preloading resources while the server prepares the response.
  • 200
    OK
    The request succeeded. The meaning depends on the method: GET returns the resource, POST returns the result.
    💡 Default success response.
  • 201
    Created
    A new resource was created. Send a Location header pointing to it.
    💡 Use after a successful POST that creates something.
  • 202
    Accepted
    The request was accepted for processing but isn't finished yet.
    💡 Good for queued or asynchronous jobs.
  • 204
    No Content
    Success, and there is nothing to send back.
    💡 Typical for DELETE and for PUT/PATCH that return no body.
  • 206
    Partial Content
    Only part of the resource is returned, in response to a Range request.
  • 301
    Moved Permanently
    The resource has a new permanent URL. Search engines transfer ranking to it.
    💡 Use for permanent redirects; method may change to GET.
  • 302
    Found
    Temporary redirect. Keep using the original URL in future.
  • 303
    See Other
    Redirect to another URL using GET — used after a POST to avoid resubmission.
  • 304
    Not Modified
    The cached copy is still valid; no body is sent.
    💡 Triggered by If-None-Match / If-Modified-Since.
  • 307
    Temporary Redirect
    Temporary redirect that keeps the same method and body.
  • 308
    Permanent Redirect
    Permanent redirect that keeps the same method and body.
  • 400
    Bad Request
    The server can't process the request because of a client error — malformed syntax, invalid JSON, missing fields.
    💡 Return details about what was wrong.
  • 401
    Unauthorized
    Authentication is missing or invalid. Despite the name, it means 'unauthenticated'.
    💡 Send WWW-Authenticate; the client can retry with credentials.
  • 403
    Forbidden
    The server understood the request but refuses it. Authenticating again won't help — the user lacks permission.
  • 404
    Not Found
    No resource exists at this URL (or the server hides that it exists).
    💡 Also used to avoid revealing private resources.
  • 405
    Method Not Allowed
    The method isn't supported for this URL. Include an Allow header listing valid ones.
  • 406
    Not Acceptable
    The server can't produce a response matching the Accept headers.
  • 408
    Request Timeout
    The server timed out waiting for the request.
  • 409
    Conflict
    The request conflicts with the current state — e.g. an edit conflict or a duplicate unique value.
  • 410
    Gone
    The resource used to exist and was removed on purpose. Search engines drop it faster than a 404.
  • 411
    Length Required
    The server requires a Content-Length header.
  • 412
    Precondition Failed
    A condition in the request headers (like If-Match) evaluated to false.
  • 413
    Content Too Large
    The request body is larger than the server will accept.
  • 414
    URI Too Long
    The URL is longer than the server will interpret.
  • 415
    Unsupported Media Type
    The Content-Type of the body isn't supported.
  • 418
    I'm a teapot
    An April Fools' joke from RFC 2324; occasionally used as an easter egg.
  • 422
    Unprocessable Content
    The syntax is fine but the content fails validation.
    💡 Popular for field-level validation errors in APIs.
  • 425
    Too Early
    The server won't risk processing a request that might be replayed.
  • 428
    Precondition Required
    The server requires the request to be conditional, to prevent lost updates.
  • 429
    Too Many Requests
    The client is being rate-limited.
    💡 Include Retry-After.
  • 431
    Request Header Fields Too Large
    The headers (or one header) are too large.
  • 451
    Unavailable For Legal Reasons
    Access is denied for legal reasons, such as a court order.
  • 500
    Internal Server Error
    A generic server-side failure. Something went wrong that the server can't describe more specifically.
  • 501
    Not Implemented
    The server doesn't support the functionality required to fulfil the request.
  • 502
    Bad Gateway
    A gateway or proxy got an invalid response from the upstream server.
    💡 Common with reverse proxies when the app is down.
  • 503
    Service Unavailable
    The server is temporarily unable to handle the request — overloaded or in maintenance.
    💡 Send Retry-After; search engines treat it as temporary.
  • 504
    Gateway Timeout
    A gateway or proxy timed out waiting for the upstream server.
  • 505
    HTTP Version Not Supported
    The server doesn't support the HTTP version used in the request.
  • 507
    Insufficient Storage
    The server can't store the representation needed to complete the request (WebDAV).
  • 511
    Network Authentication Required
    The client must authenticate to gain network access, e.g. captive portals.
Built by Pyalm

Pyalm builds custom software, APIs and integrations for businesses in India and the UAE. We made these developer tools for our own team — use them free, and talk to us when you need something built.

Pyalm serviceCustom softwareInternal tools, portals and business systems built around how your team actually works — not the other way round.See custom software Pyalm serviceBusiness automationConnect your apps and remove copy-paste work — approvals, reports, document flows and notifications on autopilot.See business automation

The five classes

1xx codes are informational, 2xx mean success, 3xx tell the client to look elsewhere, 4xx mean the client made a mistake, and 5xx mean the server failed. A client can act on the class even when it doesn't know the exact code, which is why choosing the right class matters more than choosing the perfect code.

Getting API responses right

Use 201 with a Location header after creating a resource, 204 when there is nothing to return, 400 for malformed requests, 401 when authentication is missing, 403 when it is present but insufficient, 404 for a missing resource, 409 for conflicts, 422 for validation errors and 429 with Retry-After for rate limits. For permanent URL moves use 301 or 308; for temporary ones 302 or 307.

📖 Read the full guide: HTTP Status Codes for API Developers

Related

More free tools you might need

🛰️

API Tester (REST Client)Free

Send GET, POST, PUT, PATCH and DELETE requests from your browser and inspect the response.

🧾

JSON Formatter & ValidatorFree

Format, validate, minify and syntax-highlight JSON — with exact error line and column.

🧭

DNS LookupFree

Look up A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records — with SPF and DMARC checks.

🤖

Robots.txt Generator & TesterFree

Build a robots.txt with crawler rules, AI-bot blocking and sitemap — then test any URL against it.

Browse all free tools

FAQ

Frequently asked questions

What is the difference between 401 and 403?

401 means the request lacks valid authentication — the client should log in or send credentials. 403 means the server knows who you are and still refuses; logging in again will not help.

301 or 302 for redirects?

Use 301 (or 308) when the move is permanent so search engines transfer ranking to the new URL. Use 302 (or 307) when it is temporary. 307 and 308 guarantee the method and body are preserved.

Should validation errors be 400 or 422?

Either is used. 400 suits syntactically malformed requests; 422 suits well-formed requests whose content fails validation. Pick one convention and document it.

Need a tool built for your own workflow?

Pyalm builds custom software, APIs and integrations for businesses in India and the UAE. We made these developer tools for our own team — use them free, and talk to us when you need something built.

See custom software