HTTP Status Codes Cheat Sheet
All 61 HTTP status codes explained — 1xx informational, 2xx success, 3xx redirection, 4xx client errors, and 5xx server errors with practical developer notes.
Continue
The server has received the request headers and the client should proceed to send the request body. Used with large uploads to avoid wasting bandwidth on rejected requests.
Switching Protocols
The server is switching protocols as requested by the client (e.g., upgrading from HTTP/1.1 to WebSocket). The server must send an Upgrade header in the response.
Processing
WebDAV: The server has received and is processing the request, but no response is available yet. Prevents the client from timing out on long operations.
Early Hints
Used to return some response headers before final HTTP message. Allows the client to start preloading resources while the server prepares the full response.
OK
The request succeeded. The meaning depends on the HTTP method: GET returns the resource, POST returns the result, PUT/PATCH returns the updated resource.
Created
A new resource was successfully created. Should include a Location header pointing to the newly created resource URL. Common response for POST requests.
Accepted
The request has been accepted for processing but processing has not been completed. Used for async operations — the client should poll or use a callback URL.
Non-Authoritative Information
The request was successful but the response is from a transforming proxy, not the origin server. The enclosed payload has been modified from the origin's 200 response.
No Content
The request succeeded but there is no content to send in the response body. Common for DELETE requests or PUT updates where no body is needed.
Reset Content
The server fulfilled the request and wants the client to reset the document view (e.g., clear a form). Similar to 204 but instructs the client to refresh the document.
Partial Content
The server is delivering only part of the resource due to a Range header sent by the client. Used for resumable downloads and video streaming.
Multi-Status
WebDAV: The response body contains XML with multiple separate responses for multiple operations. Each response has its own status code.
Already Reported
WebDAV: The members of a DAV binding have already been enumerated in a previous reply and are not being included again to avoid redundancy.
IM Used
The server has fulfilled a GET request for the resource and the response is a representation of the result of one or more instance-manipulations applied to the current instance.
Multiple Choices
The request has more than one possible response. The user agent or user should choose one of them. No standard way to choose automatically.
Moved Permanently
The URL of the requested resource has been changed permanently. The new URL is given in the response. Browsers cache this redirect. Good for SEO migrations.
Found
The URL of the requested resource has been changed temporarily. Unlike 301, it is not cached by default. Use when the redirect may change in the future.
See Other
The response to the request can be found under another URI using a GET method. Used to redirect after a POST/PUT to a confirmation page (Post/Redirect/Get pattern).
Not Modified
The resource has not been modified since the version specified by the request headers (If-Modified-Since or If-None-Match). Client should use its cached version.
Temporary Redirect
The same as 302, but the client must use the same HTTP method for the redirected request. The redirect URL appears in the Location header.
Permanent Redirect
The same as 301, but the client must use the same HTTP method for the redirected request. The permanent redirect URL appears in the Location header.
Bad Request
The server cannot process the request due to malformed syntax, invalid framing, or deceptive request routing. The client should not repeat the request without modifications.
Unauthorized
Authentication is required and has failed or not been provided. The response must include a WWW-Authenticate header. Despite its name, it means "unauthenticated".
Payment Required
Reserved for future use originally, now used by some APIs to indicate payment is required. Used by APIs like Google Developers Console when quota is exceeded.
Forbidden
The client is authenticated but does not have permission to access the resource. Unlike 401, re-authenticating will not make a difference.
Not Found
The server cannot find the requested resource. The URL is not recognized or the resource doesn't exist. Also used to hide existence of forbidden resources.
Method Not Allowed
The HTTP method used is not supported for the resource. The response must include an Allow header with supported methods (e.g., GET, POST).
Not Acceptable
The resource cannot generate content matching the list of acceptable values in the request's Accept headers. The server must send back a list of available representations.
Proxy Authentication Required
Similar to 401 but authentication is needed by a proxy. The client must authenticate with the proxy before sending the request to the origin server.
Request Timeout
The server timed out waiting for the request. The client did not produce a request within the time the server was prepared to wait. Client may repeat the request.
Conflict
The request conflicts with the current state of the resource. Commonly used for duplicate entry attempts or when editing a stale version of a resource (optimistic locking).
Gone
The resource has been permanently deleted and no forwarding address exists. Unlike 404, it communicates intentional permanent removal. Search engines should deindex it.
Length Required
The server rejects the request because the Content-Length header is not defined. The client must send this header with the request body.
Precondition Failed
The server does not meet one of the preconditions specified in the request headers (If-Match, If-None-Match, If-Unmodified-Since). Used for conditional requests.
Content Too Large
The request entity is larger than limits defined by the server. The server may close the connection or return a Retry-After header if the condition is temporary.
URI Too Long
The URI requested by the client is longer than the server is willing to interpret. Can happen if a client encodes too much data into a GET query string.
Unsupported Media Type
The media format of the request data is not supported by the server. The client should check the Content-Type and Content-Encoding headers they are sending.
Range Not Satisfiable
The range specified in the Range header cannot be fulfilled. The requested range may be outside the size of the resource.
Expectation Failed
The expectation given in the Expect request header could not be met by at least one inbound server.
I'm a Teapot
An April Fools' joke from RFC 2324. A teapot cannot brew coffee. Some services use this to indicate they refuse to process a request for humorous or policy reasons.
Misdirected Request
The request was directed at a server that is not able to produce a response. This can be sent by a server that is not configured to produce responses for the combination of scheme and authority in the request URI.
Unprocessable Content
The request is well-formed but contains semantic errors. Common in REST APIs for validation failures — the request syntax is correct but the data is logically invalid.
Locked
WebDAV: The source or destination resource of a method is locked. The response should include the Lock-Token header.
Failed Dependency
WebDAV: The method could not be performed on the resource because the requested action depended on another action and that action failed.
Too Early
The server is unwilling to risk processing a request that might be replayed. Used with TLS early data (0-RTT) to avoid replay attacks.
Upgrade Required
The server refuses to perform the request using the current protocol but will be willing to do so after the client upgrades to a different protocol.
Precondition Required
The origin server requires the request to be conditional. This prevents the "lost update" problem where a client GETs a resource, modifies it, and PUTs it back while another client modified it.
Too Many Requests
The user has sent too many requests in a given amount of time (rate limiting). The response should include a Retry-After header indicating when to retry.
Request Header Fields Too Large
The server is unwilling to process the request because its header fields are too large. The request may be resubmitted after reducing the size of the request headers.
Unavailable For Legal Reasons
The user requests an illegal resource, such as a web page censored by a government. Named after Ray Bradbury's "Fahrenheit 451".
Internal Server Error
A generic error message when the server encounters an unexpected condition. The server is giving an unhelpful message because it lacks a more specific 5xx status code to give.
Not Implemented
The server does not support the functionality required to fulfill the request. Common when the server does not recognize the request method or lacks the ability to fulfill it.
Bad Gateway
The server, while acting as a gateway or proxy, received an invalid response from an inbound server. The upstream server is returning an invalid response.
Service Unavailable
The server is not ready to handle the request. Common causes are a server down for maintenance or overloaded. Should send Retry-After header when condition is temporary.
Gateway Timeout
The server, while acting as a gateway or proxy, did not receive a timely response from an upstream server. The upstream server timed out.
HTTP Version Not Supported
The HTTP version used in the request is not supported by the server. The response should contain a description of why that version is not supported.
Variant Also Negotiates
The server has an internal configuration error: the chosen variant resource is configured to engage in transparent content negotiation itself, creating a circular reference.
Insufficient Storage
WebDAV: The method could not be performed because the server is unable to store the representation needed to successfully complete the request.
Loop Detected
WebDAV: The server detected an infinite loop while processing the request. This status indicates that the entire operation failed.
Not Extended
Further extensions to the request are required for the server to fulfill it. The server must send back the required extension(s) in the response.
Network Authentication Required
The client needs to authenticate to gain network access. Used by intercepting proxies that control access to a network (e.g., captive portal on Wi-Fi).
About HTTP Status Codes
HTTP status codes are three-digit numbers returned by a server in response to a client's request. They communicate whether a specific request was successfully completed and, if not, what went wrong. Every HTTP response includes a status code, and understanding them is fundamental to building and debugging web applications and APIs.
Defined in RFC 7231 and extended by subsequent standards, status codes are grouped into five classes based on their first digit. The category tells you at a glance whether the response is informational, a success, a redirect, a client error, or a server error.
Status Code Categories
- 1xx Informational — Request received, continuing process
- 2xx Success — Request was successfully received, understood, and accepted
- 3xx Redirection — Further action needed to complete the request
- 4xx Client Error — The request contains bad syntax or cannot be fulfilled
- 5xx Server Error — The server failed to fulfill an apparently valid request
Most Common Status Codes
- 200 OK — standard success response
- 201 Created — resource created (POST)
- 204 No Content — success, no body (DELETE)
- 301 Moved Permanently — SEO-safe redirect
- 304 Not Modified — use cached version
- 400 Bad Request — malformed request
- 401 Unauthorized — not authenticated
- 403 Forbidden — no permission
- 404 Not Found — resource missing
- 429 Too Many Requests — rate limited
- 500 Internal Server Error — server bug
- 503 Service Unavailable — server down
4xx vs 5xx: Quick Rule
4xx — Client is to blame
The request itself is the problem. The client sent bad data, is not authenticated, doesn't have permission, or asked for something that doesn't exist. Fix the request, not the server.
5xx — Server is to blame
The request was valid but the server failed to handle it. The client can retry or report the issue. The server team needs to investigate the root cause.
How to Use This HTTP Status Codes Cheat Sheet
Search by Code or Keyword
Type a code number (e.g. "404"), a status name (e.g. "timeout"), or a keyword (e.g. "redirect", "auth") to instantly filter results.
Browse by Category
Use the category cards at the top to jump directly to 1xx, 2xx, 3xx, 4xx, or 5xx sections. Click the section header to collapse or expand it.
Copy Status Codes
Click the Copy button next to any status code to copy the number to your clipboard — useful when writing API documentation or code comments.
Choosing the Right Status Code for Your API
| Scenario | Recommended Code |
|---|---|
| GET request returns data | 200 OK |
| POST creates a new resource | 201 Created |
| DELETE or action with no response body | 204 No Content |
| Invalid input / validation failed | 422 Unprocessable Content |
| Missing auth token | 401 Unauthorized |
| Authenticated but no permission | 403 Forbidden |
| Resource does not exist | 404 Not Found |
| Duplicate resource / edit conflict | 409 Conflict |
| Client hitting rate limits | 429 Too Many Requests |
| Unhandled server exception | 500 Internal Server Error |
| Server temporarily down / maintenance | 503 Service Unavailable |
Frequently Asked Questions
What is the difference between 401 and 403?
401 Unauthorized means the client has not authenticated — no credentials were provided, or the credentials are invalid. Despite the name, it actually means "unauthenticated". The client should log in and try again.
403 Forbidden means the client is authenticated but does not have permission to access the resource. Re-authenticating will not help. The server understood the request but refuses to authorize it.
What is the difference between 301 and 302?
301 Moved Permanently tells clients and search engines that the resource has permanently moved to a new URL. Browsers cache this redirect indefinitely. Use it for permanent URL changes and SEO migrations.
302 Found indicates a temporary redirect. Browsers do not cache it by default. Use it when the redirect might change, such as during A/B testing or temporary maintenance redirects.
What does 422 mean versus 400?
400 Bad Request is for requests that are syntactically malformed — invalid JSON, missing required headers, or broken structure. The request cannot be parsed at all.
422 Unprocessable Content means the request is syntactically valid and well-formed, but the data fails business logic validation — for example, an email field that is not a valid email address, or a date range where the end is before the start. Most REST APIs prefer 422 for validation errors.
When should I use 204 No Content?
Use 204 when an operation succeeds but there is nothing meaningful to return in the response body. Common use cases include successful DELETE requests, PATCH or PUT updates where you do not want to return the full updated resource, and confirmation endpoints that just acknowledge receipt.
What is the difference between 502 and 503?
502 Bad Gateway means an upstream server (e.g., an app server behind a load balancer or proxy) returned an invalid response. The gateway received a bad answer from the backend.
503 Service Unavailable means the server is temporarily unable to handle requests — typically because it is overloaded or undergoing maintenance. The server itself is not ready, not that it received a bad answer from elsewhere. 503 should ideally include a Retry-After header.
Why does HTTP 418 "I'm a Teapot" exist?
HTTP 418 was introduced as an April Fools' joke in RFC 2324 (1998), which defined the "Hyper Text Coffee Pot Control Protocol". The status means the server refuses to brew coffee because it is a teapot. While it is not meant for real use, it has become a beloved Easter egg in the developer community, and some services use it humorously to indicate requests they intentionally will not process.
Should I return 404 or 403 when a resource exists but the user cannot access it?
It depends on whether you want to reveal the resource's existence. Returning 403 Forbidden confirms that the resource exists but the user is not allowed to see it. Returning 404 Not Found hides the resource entirely — users will not know if the resource exists at all. For sensitive data, 404 is often preferred for security reasons (information hiding).