HTTP Status Code Reference
Search or filter every common HTTP status code to see what it means and when it’s used.
Continue
The server has received the request headers and the client should proceed to send the request body.
Switching Protocols
The requester has asked the server to switch protocols, and the server agreed.
Processing
The server has received and is processing the request, but no response is available yet.
Early Hints
Used to return some response headers before the final HTTP message, e.g. for preloading resources.
OK
The request succeeded. The meaning depends on the HTTP method used.
Created
The request succeeded and a new resource was created as a result.
Accepted
The request has been received but not yet acted upon.
Non-Authoritative Information
The returned metadata isn’t from the origin server but from a local or third-party copy.
No Content
There is no content to send, but the headers may be useful. The client may reuse its current view.
Reset Content
Tells the client to reset the document that sent this request.
Partial Content
Used when the Range header is sent to request only part of a resource.
Multiple Choices
The request has more than one possible response — the client should choose one.
Moved Permanently
The requested resource has been permanently moved to a new URL.
Found
The resource temporarily resides at a different URL; future requests should still use the original.
See Other
The response can be found at another URL, retrievable with a GET request.
Not Modified
The resource hasn’t changed since the last request — the client can use its cached version.
Temporary Redirect
Like 302, but the request method and body must not change when reissued.
Permanent Redirect
Like 301, but the request method and body must not change when reissued.
Bad Request
The server can’t process the request due to a client error, such as malformed syntax.
Unauthorized
Authentication is required and has either failed or not been provided.
Payment Required
Reserved for future use — originally intended for digital payment systems.
Forbidden
The client’s identity is known, but it doesn’t have permission to access the resource.
Not Found
The server can’t find the requested resource.
Method Not Allowed
The request method is known but not supported by the target resource. The response must include an Allow header listing the methods that are.
Not Acceptable
No content matching the criteria in the request’s Accept headers is available.
Proxy Authentication Required
Authentication with a proxy server is required before the request can proceed.
Request Timeout
The server timed out waiting for the request.
Conflict
The request conflicts with the current state of the target resource.
Gone
The resource is permanently gone and no forwarding address is known.
Length Required
The server refuses the request because Content-Length wasn’t specified.
Precondition Failed
One or more conditions in the request headers evaluated to false.
Content Too Large (formerly Payload Too Large)
The request body is larger than the server is willing or able to process.
URI Too Long
The requested URI is longer than the server is willing to interpret.
Unsupported Media Type
The media format of the request body isn’t supported by the server.
Range Not Satisfiable
The requested Range header value can’t be satisfied for the resource.
Expectation Failed
The expectation in the request’s Expect header couldn’t be met.
I'm a Teapot
An April Fools’ joke from RFC 2324 — the server refuses to brew coffee because it’s a teapot.
Unprocessable Content (formerly Unprocessable Entity)
The request was well-formed but contains semantic errors and couldn’t be processed.
Too Early
The server is unwilling to process a request that might be replayed.
Upgrade Required
The client should switch to a different protocol, given in the Upgrade header.
Precondition Required
The origin server requires the request to be conditional, to prevent lost updates.
Too Many Requests
The client has sent too many requests in a given time — rate limiting.
Request Header Fields Too Large
The server won’t process the request because its header fields are too large.
Unavailable For Legal Reasons
The resource is unavailable due to a legal demand, such as government-mandated censorship.
Internal Server Error
The server encountered a situation it doesn’t know how to handle.
Not Implemented
The request method isn’t supported by the server and can’t be handled.
Bad Gateway
The server, acting as a gateway, got an invalid response from an upstream server.
Service Unavailable
The server isn’t ready to handle the request — often due to maintenance or overload.
Gateway Timeout
The server, acting as a gateway, didn’t get a response in time from an upstream server.
HTTP Version Not Supported
The HTTP version used in the request isn’t supported by the server.
Insufficient Storage
The server can’t store the representation needed to complete the request.
Loop Detected
The server detected an infinite loop while processing the request.
Not Extended
Further extensions to the request are required for the server to fulfill it.
Network Authentication Required
The client needs to authenticate to gain network access, e.g. a captive portal.
How to use this tool
Type a number such as 429 or part of a name such as "gateway", or filter by class. The list covers 53 codes: those defined in RFC 9110, plus the ones you are likely to meet from WebDAV servers, rate limiters and proxies. Names follow RFC 9110, which renamed two: 413 is now Content Too Large and 422 is Unprocessable Content; the old names still find them.
Which code should my API return?
| Situation | Code |
|---|---|
| Created a new record | 201, with a Location header pointing to it |
| Request body isn't valid JSON | 400 |
| Valid JSON, but a field fails validation (email missing, date in the past) | 422, or 400 if you use one code for all bad input |
| No token, or an expired one | 401 |
| Signed in, but not allowed to do this | 403 |
| Would create a duplicate, or edits an outdated version | 409 |
| Too many requests | 429, ideally with Retry-After |
| Your own code failed | 500 |
| A service you call returned garbage, or didn't answer in time | 502 or 504 |
| Down for maintenance or overloaded | 503, with Retry-After if you know when |
Clients often decide whether to retry from the class alone: a 5xx may succeed next time, a 4xx won't until the request changes. Returning 500 for bad input therefore invites pointless retries. The status codes guide covers redirects, caching and the empty-body traps of 204 and 304.
Frequently Asked Questions
What is the difference between 401 and 403?
401 Unauthorized means authentication is missing or failed — the server doesn't know who you are (despite the confusing name, it's really about authentication, not authorization). 403 Forbidden means the server knows exactly who you are, but you don't have permission to access that specific resource. An API request with no valid token should get 401; one with a valid token for a user who lacks admin rights should get 403. A website may instead redirect a logged-out visitor to its login page, so the browser sees a 3xx redirect, not a 401.
Is 418 "I'm a Teapot" a real status code?
It began as an April Fools' joke in RFC 2324. RFC 9110 lists 418 as unused and reserves it, so that no real meaning is ever assigned to a number some software already returns for fun. Don't use it for anything a client has to act on.
What are 520, 521, 522 and 524? They aren't in the list.
They come from Cloudflare, not from the HTTP standard, and appear when Cloudflare sits in front of a site. Cloudflare describes them as: 520, the web server returns an unknown error; 521, the web server is down; 522, connection timed out; 524, a timeout occurred. All four point at the origin server behind Cloudflare, so its logs are the place to look.
Related Tools
Related Blog Posts
HTTP Status Codes You Will Actually See, From One Real Site
Every status code this site and the two APIs it uses returned in one afternoon of curl requests (301, 308, 304, 204, 400, 404 and 405), what each means, and the redirect that broke a CORS request.
Read moreHow to Use QR Codes for Marketing, Docs, and Events
How much a QR code can hold, why a shorter or uppercase link gives a code that scans more easily, what error correction actually protects against, and how to size one for print.
Read moreHEX, RGB and HSL: How the Conversions Work and Where They Round
#4F46E5 converted to RGB and HSL step by step, why 89.4% of all colours change when copied as whole-number HSL, why HSL lightness is not brightness (yellow and blue at 50% differ eightfold in contrast), and the alpha that hex can't write exactly.
Read more