HTTP Status Codes — Complete Reference
Every registered status code with its meaning and defining RFC, plus guidance on choosing between the ones that are easily confused.
| Code | Status | Category | Description | |
|---|---|---|---|---|
| 100 | Continue | 1xx | The server has received the request headers and the client should proceed to send the request body. | |
| 101 | Switching Protocols | 1xx | The requester has asked the server to switch protocols and the server has agreed. | |
| 102 | Processing | 1xx | The server has received and is processing the request, but no response is available yet. | |
| 103 | Early Hints | 1xx | Used to return some response headers before final HTTP message. | |
| 200 | OK | 2xx | Standard success response. The request was successfully received, understood, and accepted. | |
| 201 | Created | 2xx | The request was fulfilled and a new resource was created. Common after POST. | |
| 202 | Accepted | 2xx | The request has been accepted but processing is not yet complete (async operations). | |
| 203 | Non-Authoritative Information | 2xx | The server successfully processed the request but is returning info from another source. | |
| 204 | No Content | 2xx | The server successfully processed the request and is not returning any content. | |
| 205 | Reset Content | 2xx | The server successfully processed the request, asks the requester to reset the document view. | |
| 206 | Partial Content | 2xx | The server is delivering only part of the resource due to a range header sent by the client. | |
| 207 | Multi-Status | 2xx | The message body contains multiple separate response codes (WebDAV). | |
| 208 | Already Reported | 2xx | Members of a DAV binding have already been enumerated in a previous reply. | |
| 226 | IM Used | 2xx | The server has fulfilled a GET request for the resource; response is a representation of the result. | |
| 300 | Multiple Choices | 3xx | Indicates multiple options for the resource from which the client may choose. | |
| 301 | Moved Permanently | 3xx | This and all future requests should be directed to the given URI. | |
| 302 | Found | 3xx | Tells the client to look at (browse to) another URL. Temporary redirect. | |
| 303 | See Other | 3xx | The response to the request can be found under another URI using the GET method. | |
| 304 | Not Modified | 3xx | Indicates that the resource has not been modified since the version specified by request headers. | |
| 305 | Use Proxy | 3xx | The requested resource is available only through a proxy, the address for which is provided. | |
| 307 | Temporary Redirect | 3xx | The request should be repeated with another URI; however, future requests should still use the original URI. | |
| 308 | Permanent Redirect | 3xx | All future requests should use another URI. Similar to 301 but the method must not change. | |
| 400 | Bad Request | 4xx | The server cannot or will not process the request due to an apparent client error. | |
| 401 | Unauthorized | 4xx | Authentication is required and has failed or has not yet been provided. | |
| 402 | Payment Required | 4xx | Reserved for future use, sometimes used for digital payment systems. | |
| 403 | Forbidden | 4xx | The request was valid, but the server is refusing action. Insufficient permissions. | |
| 404 | Not Found | 4xx | The requested resource could not be found. The most well-known HTTP status code. | |
| 405 | Method Not Allowed | 4xx | A request method is not supported for the requested resource (e.g. DELETE on a read-only endpoint). | |
| 406 | Not Acceptable | 4xx | The requested resource is capable of generating only content not acceptable by the Accept headers. | |
| 407 | Proxy Auth Required | 4xx | The client must first authenticate itself with the proxy. | |
| 408 | Request Timeout | 4xx | The server timed out waiting for the request. | |
| 409 | Conflict | 4xx | Indicates that the request could not be processed because of conflict in the current state of the resource. | |
| 410 | Gone | 4xx | Indicates that the resource requested was previously in use but is no longer available. | |
| 411 | Length Required | 4xx | The request did not specify the length of its content, which is required by the requested resource. | |
| 412 | Precondition Failed | 4xx | The server does not meet one of the preconditions specified in the request headers. | |
| 413 | Content Too Large | 4xx | The request is larger than the server is willing or able to process. | |
| 414 | URI Too Long | 4xx | The URI provided was too long for the server to process. | |
| 415 | Unsupported Media Type | 4xx | The request entity has a media type which the server or resource does not support. | |
| 416 | Range Not Satisfiable | 4xx | The client has asked for a portion of the file but the server cannot supply that portion. | |
| 417 | Expectation Failed | 4xx | The server cannot meet the requirements of the Expect request-header field. | |
| 418 | I'm a Teapot | 4xx | The server refuses to brew coffee because it is, permanently, a teapot. (RFC 2324 — April Fools') | |
| 421 | Misdirected Request | 4xx | The request was directed at a server that is not able to produce a response. | |
| 422 | Unprocessable Content | 4xx | The request was well-formed but was unable to be followed due to semantic errors. | |
| 423 | Locked | 4xx | The resource that is being accessed is locked. | |
| 424 | Failed Dependency | 4xx | The request failed because it depended on another request and that request failed. | |
| 425 | Too Early | 4xx | The server is unwilling to risk processing a request that might be replayed. | |
| 426 | Upgrade Required | 4xx | The client should switch to a different protocol such as TLS/1.3. | |
| 428 | Precondition Required | 4xx | The origin server requires the request to be conditional. | |
| 429 | Too Many Requests | 4xx | The user has sent too many requests in a given amount of time (rate limiting). | |
| 431 | Request Header Fields Too Large | 4xx | The server is unwilling to process the request because its header fields are too large. | |
| 451 | Unavailable For Legal Reasons | 4xx | A server operator has received a legal demand to deny access to a resource. | |
| 500 | Internal Server Error | 5xx | A generic error message when an unexpected condition was encountered on the server. | |
| 501 | Not Implemented | 5xx | The server either does not recognize the request method, or lacks the ability to fulfill the request. | |
| 502 | Bad Gateway | 5xx | The server was acting as a gateway or proxy and received an invalid response from the upstream server. | |
| 503 | Service Unavailable | 5xx | The server cannot handle the request (overloaded or down for maintenance). | |
| 504 | Gateway Timeout | 5xx | The server was acting as a gateway or proxy and did not receive a timely response from the upstream server. | |
| 505 | HTTP Version Not Supported | 5xx | The server does not support the HTTP version used in the request. | |
| 506 | Variant Also Negotiates | 5xx | Transparent content negotiation for the request results in a circular reference. | |
| 507 | Insufficient Storage | 5xx | The server is unable to store the representation needed to complete the request. | |
| 508 | Loop Detected | 5xx | The server detected an infinite loop while processing a request. | |
| 510 | Not Extended | 5xx | Further extensions to the request are required for the server to fulfil it. | |
| 511 | Network Auth Required | 5xx | The client needs to authenticate to gain network access (captive portals). |
The pairs that get confused
Most status-code mistakes are a choice between two plausible codes. These are the ones worth getting right:
| Situation | Use | Not | Why |
|---|---|---|---|
| User is not logged in | 401 Unauthorized | 403 | 401 means "unauthenticated" despite its name. It must include a WWW-Authenticate header |
| Logged in but lacks permission | 403 Forbidden | 401 | Authentication succeeded; authorisation failed. Repeating the request will not help |
| Hiding a resource’s existence from an unauthorised user | 404 Not Found | 403 | 403 confirms the resource exists. For private resources that is an information leak |
| Request body fails validation | 422 Unprocessable Content | 400 | 400 means malformed syntax; 422 means well-formed but semantically wrong |
| Malformed JSON in the body | 400 Bad Request | 422 | The request could not be parsed at all — that is a syntax failure |
| Resource created | 201 Created | 200 | 201 should carry a Location header pointing at the new resource |
| Accepted for async processing | 202 Accepted | 201 | 202 means "queued, outcome unknown" — the correct answer for a job that has not run yet |
| Successful DELETE with no body | 204 No Content | 200 | 204 explicitly signals there is no body, so clients do not try to parse one |
| Permanent URL change | 301 Moved Permanently | 302 | 301 transfers ranking signals and is cached. 302 tells search engines to keep the old URL |
| Temporary redirect that must keep the method | 307 Temporary Redirect | 302 | 302 historically caused clients to convert POST to GET. 307 and 308 forbid that |
| Rate limit exceeded | 429 Too Many Requests | 403 | 429 is retryable and should carry Retry-After. 403 tells the client to give up |
| Dependency is down | 503 Service Unavailable | 500 | 503 means "try again later" and is retryable; 500 signals an unexpected bug |
What each class means to a client
Clients, caches and crawlers behave differently per class, which is why the first digit matters more than the specific code:
- 1xx Informational —The request was received and processing continues. Rarely seen directly; 101 drives WebSocket upgrades and 103 Early Hints is increasingly used for preloading.
- 2xx Success —Understood and accepted. The distinction between 200, 201, 202 and 204 tells the client what to expect in the body.
- 3xx Redirection —Further action needed. 301 and 308 are permanent and cached indefinitely by browsers — deploying one by mistake is very hard to undo.
- 4xx Client error —The request was wrong. Retrying unchanged will fail again, with 408, 425 and 429 as the deliberate exceptions.
- 5xx Server error —The server failed. The request may be valid, so retrying is often appropriate — with backoff.
About
The HTTP Status Code Reference covers all standard codes defined in RFC 7231 and related RFCs — from 100 Continue to 511 Network Authentication Required. Each entry includes the code, official name, a plain-English description, and common use cases in REST API design. Filter by category (1xx–5xx) to quickly find what you need.
How to use
- 1 Browse the full list or use the search bar to find a specific code.
- 2 Click a category chip (1xx, 2xx, 3xx, 4xx, 5xx) to filter by class.
- 3 Click any row to copy the status code to your clipboard.
- What is the difference between 401 Unauthorized and 403 Forbidden?
- 401 Unauthorized means the client is not authenticated — no valid credentials were provided, and the client should log in and try again. 403 Forbidden means the client is authenticated but does not have permission to access the resource — logging in again will not help. This distinction matters for REST API design: return 401 when credentials are missing, 403 when they are insufficient.
- When should I use 301 vs 302 redirect?
- 301 Moved Permanently tells browsers and search engines that the URL has changed forever — they should update bookmarks and transfer SEO ranking to the new URL. 302 Found is a temporary redirect — the original URL is still valid and should be retained. Use 301 for permanent site restructuring and 302 for temporary redirects like A/B tests or maintenance pages.
- What does HTTP 429 Too Many Requests mean?
- 429 Too Many Requests means the client has sent too many requests in a given time window and the server is rate-limiting it. The response often includes a Retry-After header indicating how many seconds to wait before retrying. If you see this in your browser, the API or website is throttling your IP or account.
More in Reference & Data
MIME Types Media types mapped to file extensions in both directions, covering the full IANA registry.HTML Entities Named and numeric character references with a live preview of each rendered glyph.Port Numbers Well-known and registered TCP/UDP ports with the service on each and its transport protocol.Unicode Explorer Search by code point, name or character, with the UTF-8, UTF-16 and HTML encodings of each shown.ASCII Table All 128 ASCII characters in decimal, hex, octal and binary, including the control characters.Regex Cheat Sheet Every metacharacter, quantifier, class and assertion with a worked example for each.
See all reference & data.