HTTP Status Codes Reference
Search every HTTP status code by number, name or keyword. Each entry explains what the code means and when to use it. Press / to jump to search.
- 100
Continue
The server has received the request headers and the client should proceed to send the body.
When to use: Sent in response to Expect: 100-continue before uploading a large body.
- 101
Switching Protocols
The server is switching to the protocol requested in the Upgrade header.
When to use: Upgrading an HTTP connection to WebSocket.
- 102
Processing
The server has accepted the request but has not finished processing it (WebDAV).
When to use: Long-running WebDAV operations.
- 103
Early Hints
Lets the browser start preloading resources while the server prepares the final response.
When to use: Send Link: rel=preload headers early to speed up page loads.
- 200
OK
The request succeeded. The meaning depends on the method: GET returns the resource, POST returns the result of the action.
When to use: Default success response for GET, PUT, PATCH and most POST requests.
- 201
Created
The request succeeded and a new resource was created.
When to use: Return after a successful POST that creates a record, with a Location header pointing to it.
- 202
Accepted
The request was accepted for processing, but processing is not complete.
When to use: Queued or asynchronous jobs such as report generation or email sending.
- 203
Non-Authoritative Information
The response is from a transforming proxy and may differ from the origin server response.
When to use: Rare. A proxy modified the original 200 response.
- 204
No Content
The request succeeded and there is no body to return.
When to use: Successful DELETE, or a PUT/PATCH that does not return the updated resource.
- 205
Reset Content
The request succeeded and the client should reset the document view, such as clearing a form.
When to use: Rare. Form submissions that should clear the form.
- 206
Partial Content
The server is returning only part of the resource because the client sent a Range header.
When to use: Video streaming, resumable downloads and PDF viewers.
- 207
Multi-Status
The body contains several independent status codes for a batch of operations (WebDAV).
When to use: Batch APIs that report a result per item.
- 208
Already Reported
Members of a WebDAV binding were already listed earlier in the response.
When to use: WebDAV only.
- 226
IM Used
The server fulfilled a GET using one or more instance manipulations (delta encoding).
When to use: Very rare.
- 300
Multiple Choices
The request has more than one possible response and the client should choose one.
When to use: Rare. Content negotiation with several representations.
- 301
Moved Permanently
The resource has permanently moved to the URL in the Location header. Search engines transfer ranking to the new URL.
When to use: Permanent redirects such as http to https or a changed URL slug. Clients may change POST to GET.
- 302
Found
The resource is temporarily at a different URL. Clients keep using the original URL for future requests.
When to use: Temporary redirects such as login redirects. Clients may change POST to GET.
- 303
See Other
The response is at another URL and should be fetched with GET.
When to use: Redirect after a POST so a page refresh does not resubmit the form.
- 304
Not Modified
The cached version is still valid, so no body is sent.
When to use: Response to conditional requests using If-None-Match or If-Modified-Since.
- 305
Use Proxy
The resource must be accessed through a proxy. Deprecated for security reasons.
When to use: Do not use.
- 307
Temporary Redirect
Temporary redirect that keeps the original HTTP method and body.
When to use: Temporary redirects where a POST must stay a POST.
- 308
Permanent Redirect
Permanent redirect that keeps the original HTTP method and body.
When to use: Permanent redirects for APIs where the method must not change.
- 400
Bad Request
The server cannot process the request because of malformed syntax, invalid parameters or an invalid body.
When to use: Failed validation, malformed JSON or missing required fields.
- 401
Unauthorized
The request lacks valid authentication credentials. Despite the name, it means unauthenticated.
When to use: Missing, expired or invalid token. Include a WWW-Authenticate header.
- 402
Payment Required
Reserved for future use, now occasionally used by paid APIs.
When to use: Some APIs return it when a plan limit or payment is required.
- 403
Forbidden
The server understood the request but refuses to authorize it. Authenticating again will not help.
When to use: Logged-in user lacks permission for the resource.
- 404
Not Found
The server cannot find the requested resource.
When to use: Unknown URL or a record that does not exist. Sometimes used to hide a resource from unauthorized users.
- 405
Method Not Allowed
The HTTP method is not supported for this resource.
When to use: POST to a read-only endpoint. Include an Allow header listing valid methods.
- 406
Not Acceptable
The server cannot produce a response matching the Accept headers sent by the client.
When to use: Client asks for a format the API does not support.
- 407
Proxy Authentication Required
The client must authenticate with the proxy first.
When to use: Corporate proxies requiring credentials.
- 408
Request Timeout
The server timed out waiting for the client to finish sending the request.
When to use: Slow or stalled client connections.
- 409
Conflict
The request conflicts with the current state of the resource.
When to use: Duplicate unique value, edit conflicts or version mismatch.
- 410
Gone
The resource existed but has been permanently removed and will not return.
When to use: Deliberately deleted content. Tells search engines to drop the URL faster than 404.
- 411
Length Required
The server requires a Content-Length header.
When to use: Uploads without a declared body length.
- 412
Precondition Failed
A condition in the request headers, such as If-Match, evaluated to false.
When to use: Optimistic locking with ETags.
- 413
Content Too Large
The request body is larger than the server is willing to process.
When to use: File upload exceeds the size limit. Also known as Payload Too Large.
- 414
URI Too Long
The request URL is longer than the server will interpret.
When to use: Huge query strings. Move the data into a POST body.
- 415
Unsupported Media Type
The server does not support the media type of the request body.
When to use: Sending form data to an endpoint that only accepts application/json.
- 416
Range Not Satisfiable
The Range header cannot be fulfilled because it lies outside the resource size.
When to use: Resumable download starting past the end of the file.
- 417
Expectation Failed
The server cannot meet the requirements of the Expect header.
When to use: Rare. Failed Expect: 100-continue.
- 418
I'm a teapot
An April Fools joke from RFC 2324. The server refuses to brew coffee because it is a teapot.
When to use: Easter eggs, and occasionally used to block bots.
- 421
Misdirected Request
The request was sent to a server that cannot produce a response for it.
When to use: HTTP/2 connection reuse across hosts.
- 422
Unprocessable Content
The request is well formed but contains semantic errors the server cannot process.
When to use: Validation errors in REST and GraphQL APIs, common in Rails and FastAPI.
- 423
Locked
The resource being accessed is locked (WebDAV).
When to use: WebDAV file locks.
- 424
Failed Dependency
The request failed because a previous request it depended on failed (WebDAV).
When to use: WebDAV batch operations.
- 425
Too Early
The server is unwilling to process a request that might be replayed.
When to use: TLS early data (0-RTT) replay protection.
- 426
Upgrade Required
The client should switch to a different protocol, given in the Upgrade header.
When to use: Server requires TLS or a newer HTTP version.
- 428
Precondition Required
The server requires the request to be conditional.
When to use: Force clients to send If-Match to prevent lost updates.
- 429
Too Many Requests
The client has sent too many requests in a given time (rate limiting).
When to use: Rate-limited APIs. Include a Retry-After header.
- 431
Request Header Fields Too Large
The headers, individually or together, are too large.
When to use: Oversized cookies or tokens.
- 451
Unavailable For Legal Reasons
The resource is blocked because of a legal demand, such as censorship or a court order.
When to use: Geo or legal blocking. The number references the novel Fahrenheit 451.
- 500
Internal Server Error
The server hit an unexpected condition and could not complete the request.
When to use: Unhandled exceptions. Check server logs.
- 501
Not Implemented
The server does not support the functionality required to fulfil the request.
When to use: Unrecognized method or an endpoint that is not built yet.
- 502
Bad Gateway
A gateway or proxy received an invalid response from the upstream server.
When to use: Nginx cannot reach or got garbage from the app server, often a crashed Node process.
- 503
Service Unavailable
The server is temporarily unable to handle the request, often due to overload or maintenance.
When to use: Deployments and maintenance. Send a Retry-After header.
- 504
Gateway Timeout
A gateway or proxy did not receive a timely response from the upstream server.
When to use: Slow upstream queries or timeouts behind a load balancer.
- 505
HTTP Version Not Supported
The server does not support the HTTP version used in the request.
When to use: Rare.
- 506
Variant Also Negotiates
A configuration error in transparent content negotiation.
When to use: Rare server misconfiguration.
- 507
Insufficient Storage
The server cannot store the representation needed to complete the request (WebDAV).
When to use: Disk quota full.
- 508
Loop Detected
The server detected an infinite loop while processing the request (WebDAV).
When to use: Circular WebDAV bindings.
- 510
Not Extended
Further extensions to the request are required for the server to fulfil it.
When to use: Very rare.
- 511
Network Authentication Required
The client must authenticate to gain network access.
When to use: Captive portals on public Wi-Fi.
Frequently Asked Questions
HTTP status codes are three-digit numbers a server returns with every response to tell the client what happened. They are grouped by first digit: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error.
401 Unauthorized means the request has no valid authentication, so the user should log in or send a valid token. 403 Forbidden means the server knows who you are but you are not allowed to access the resource.
301 is a permanent redirect and search engines pass ranking to the new URL. 302 is temporary, so the original URL stays indexed. Use 308 and 307 when the HTTP method must be preserved.
Use 400 for malformed requests, 404 when the resource does not exist, and 422 when the request is well formed but fails validation rules. Many APIs use 400 for both of the first and last cases, so stay consistent.
502 Bad Gateway means a proxy or gateway got an invalid response from the upstream server, often because the app crashed. 504 Gateway Timeout means the upstream server did not answer in time.
Other Tools
Need a custom tool or website built?
I build custom web applications and business websites. See all services.
Can't find the tool you need?
Tell me what to build next. Every suggestion gets read.