2xx Success
200 OK
The request succeeded. The body holds the result.
201 Created
A new resource was created. The Location header should point to it.
Use for a successful POST that creates something.
202 Accepted
The request was accepted for processing, but the work is not finished.
Common for queued jobs. Return a way to check status.
203 Non-Authoritative Information
The response was modified by a proxy and is not exactly what the origin sent.
204 No Content
The request succeeded and there is no body.
Typical for DELETE, or a PUT that does not return the resource.
205 Reset Content
The request succeeded and the client should reset the view, such as clearing a form.
206 Partial Content
The body is the byte range asked for in the Range header.
Used for resumable downloads and video seeking.
207 Multi-Status
WebDAV: the body holds separate status codes for several operations.
208 Already Reported
WebDAV: members of a binding were already listed earlier in the response.
226 IM Used
The response is the result of instance manipulations applied to the current resource.
3xx Redirection
300 Multiple Choices
There are several representations and the client should choose one.
301 Moved Permanently
The resource has a new permanent URL, given in Location.
Browsers may change a POST to GET when following it. Use 308 to keep the method.
302 Found
The resource is temporarily at the URL in Location.
Clients often change POST to GET. Use 307 to keep the method.
303 See Other
Fetch the result from the URL in Location with GET.
The standard redirect after a form POST, so a refresh does not resubmit.
304 Not Modified
The cached copy is still current. There is no body.
Returned for conditional requests with If-None-Match or If-Modified-Since.
307 Temporary Redirect
Repeat the same request, with the same method and body, at the URL in Location.
308 Permanent Redirect
The resource has moved permanently. Repeat the same method and body at the new URL.
4xx Client error
400 Bad Request
The server cannot process the request because it is malformed.
For valid syntax with invalid values, many APIs use 422 instead.
401 Unauthorized
Authentication is missing or invalid.
Despite the name, this means unauthenticated. The response must include WWW-Authenticate.
402 Payment Required
Reserved. Some APIs use it when a plan limit or payment is required.
403 Forbidden
The server understood who you are and refuses the request.
Logging in again will not help, unlike 401.
404 Not Found
There is nothing at this URL.
Also used to hide a resource the client is not allowed to know exists.
405 Method Not Allowed
The URL exists but does not accept this method.
The response must include an Allow header listing the methods it does accept.
406 Not Acceptable
The server cannot produce a format that matches the Accept headers.
407 Proxy Authentication Required
Authenticate with the proxy first.
408 Request Timeout
The client took too long to send the request.
409 Conflict
The request conflicts with the current state of the resource.
Examples: an edit conflict, or creating something that already exists.
410 Gone
The resource existed and has been removed on purpose, with no forwarding address.
Search engines drop a 410 faster than a 404.
411 Length Required
The server requires a Content-Length header.
412 Precondition Failed
A condition in If-Match or If-Unmodified-Since was false.
Used for optimistic locking: someone else changed the resource first.
413 Content Too Large
The request body is larger than the server will accept.
414 URI Too Long
The URL is longer than the server will process.
415 Unsupported Media Type
The server does not accept the Content-Type of the body.
Often a missing Content-Type: application/json.
416 Range Not Satisfiable
The Range header asks for bytes outside the resource.
417 Expectation Failed
The server cannot meet the Expect header.
418 I'm a teapot
An April Fools joke from RFC 2324, kept as reserved. Some servers use it for requests they refuse to handle.
421 Misdirected Request
The request went to a server that cannot answer for this host.
Seen with HTTP/2 connection reuse across certificates.
422 Unprocessable Content
The syntax is valid but the content fails validation.
The usual code for form or JSON validation errors.
423 Locked
WebDAV: the resource is locked.
424 Failed Dependency
WebDAV: the request failed because an earlier request failed.
425 Too Early
The server will not process a request that might be replayed (TLS early data).
426 Upgrade Required
Switch to the protocol in the Upgrade header and try again.
428 Precondition Required
The request must be conditional, such as with If-Match, to avoid lost updates.
429 Too Many Requests
The client is rate limited.
Check Retry-After for how long to wait.
431 Request Header Fields Too Large
The headers, often cookies, are too large.
451 Unavailable For Legal Reasons
The resource cannot be served because of a legal demand.
5xx Server error
500 Internal Server Error
The server hit an error it did not handle.
A bug on the server side. The details belong in server logs, not the response.
501 Not Implemented
The server does not support the method or feature.
502 Bad Gateway
A proxy or gateway got an invalid response from the upstream server.
Usually the app behind the load balancer crashed or refused the connection.
503 Service Unavailable
The server is overloaded or down for maintenance.
Send Retry-After if you know when it will be back.
504 Gateway Timeout
A proxy or gateway did not get a response from upstream in time.
505 HTTP Version Not Supported
The server does not support the HTTP version used.
506 Variant Also Negotiates
A content-negotiation configuration error on the server.
507 Insufficient Storage
WebDAV: the server cannot store what is needed to complete the request.
508 Loop Detected
WebDAV: the server found an infinite loop while processing.
510 Not Extended
Further extensions to the request are required.
511 Network Authentication Required
Log in to the network first, as on a captive Wi-Fi portal.