HTTP Response Status Codes: A Practical Reference

About 1292 wordsAbout 4 min

...

2024-10-06

An HTTP response status code tells a client how the server handled a request. The first digit groups the response into one of five classes: informational, successful, redirection, client error, or server error.

Standards note

The summaries below follow the current HTTP specifications and widely used extensions. Not every code is generated by every server, and some older codes are deprecated. See the MDN status-code reference and the IANA HTTP Status Code Registry for the normative references.

1xx: Informational Responses

100 Continue: The server has received the request headers; the client may continue sending the request body.
101 Switching Protocols: The server agrees to switch protocols as requested through the Upgrade header.
102 Processing: A WebDAV response indicating that processing is still underway and no final response is available yet.
103 Early Hints: Lets the server send preliminary headers, commonly preload links, before the final response.

2xx: Successful Responses

200 OK: The request succeeded. The meaning and response body depend on the request method.
201 Created: The request succeeded and created a new resource.
202 Accepted: The request was accepted for processing, but processing has not necessarily completed.
203 Non-Authoritative Information: The returned metadata was modified by an intermediary rather than copied directly from the origin.
204 No Content: The request succeeded and there is no response body.
205 Reset Content: The request succeeded and the client should reset the view or form that initiated it.
206 Partial Content: The server is returning one or more byte ranges in response to a range request.
207 Multi-Status: A WebDAV response carrying status information for multiple resources or operations.
208 Already Reported: A WebDAV response used to avoid repeatedly listing members of the same binding.
226 IM Used: The response represents the result of one or more instance manipulations applied to the resource.

3xx: Redirection Responses

300 Multiple Choices: The resource has more than one possible representation or destination.
301 Moved Permanently: The resource has a new permanent URI. Clients and search engines may update stored links.
302 Found: The resource is temporarily available at another URI. In common browser behavior, a subsequent request may use GET.
303 See Other: Retrieve the result from another URI using GET.
304 Not Modified: The cached representation is still valid; the server does not send a new body.
305 Use Proxy: Deprecated because of security concerns; clients should not rely on it.
307 Temporary Redirect: A temporary redirect that preserves the original request method and body.
308 Permanent Redirect: A permanent redirect that preserves the original request method and body.

4xx: Client-Error Responses

400 Bad Request: The server cannot process the request because it is malformed or invalid.
401 Unauthorized: Authentication is required or the supplied credentials are invalid. Despite the name, this code concerns authentication.
402 Payment Required: Reserved for future use; some services assign it nonstandard payment-related meanings.
403 Forbidden: The server understood the request but refuses to authorize it.
404 Not Found: The server cannot find the requested resource, or chooses not to disclose whether it exists.
405 Method Not Allowed: The resource exists, but the request method is not allowed for it.
406 Not Acceptable: The server cannot produce a representation matching the client's content-negotiation headers.
407 Proxy Authentication Required: The client must authenticate with an intermediary proxy.
408 Request Timeout: The server timed out while waiting for the request.
409 Conflict: The request conflicts with the current state of the target resource.
410 Gone: The resource is no longer available and the removal is expected to be permanent.
411 Length Required: The server requires a valid Content-Length header.
412 Precondition Failed: One or more conditions in the request headers evaluated to false.
413 Content Too Large: The request content exceeds a limit the server is willing or able to process.
414 URI Too Long: The request target is longer than the server is willing to interpret.
415 Unsupported Media Type: The request body's media format is not supported for this resource or method.
416 Range Not Satisfiable: The requested byte range cannot be served.
417 Expectation Failed: The server cannot meet the expectation given in the Expect header.
418 I'm a teapot: An April Fools' status defined by RFC 2324; some systems use it humorously.
421 Misdirected Request: The request reached a server that cannot produce an authoritative response for the target.
422 Unprocessable Content: The syntax is valid, but the server cannot process the contained instructions.
423 Locked: The target WebDAV resource is locked.
424 Failed Dependency: The operation failed because another operation it depended on failed.
425 Too Early: The server declines to risk processing a request that might be replayed.
426 Upgrade Required: The server refuses the current protocol but may accept the request after the client switches to a protocol named in the response's Upgrade header. It does not specifically mean “upgrade to TLS 1.0.”
428 Precondition Required: The origin requires the request to be conditional, often to prevent lost updates.
429 Too Many Requests: The client exceeded a rate limit. A Retry-After header may indicate when to retry.
431 Request Header Fields Too Large: The request headers, collectively or individually, are too large.
451 Unavailable For Legal Reasons: Access is denied because of a legal demand.

5xx: Server-Error Responses

500 Internal Server Error: An unexpected server condition prevented completion of the request.
501 Not Implemented: The server does not support the functionality required to fulfill the request.
502 Bad Gateway: A gateway or proxy received an invalid response from an upstream server.
503 Service Unavailable: The server is temporarily unable to handle the request, commonly because of overload or maintenance.
504 Gateway Timeout: A gateway or proxy did not receive a timely response from an upstream server.
505 HTTP Version Not Supported: The server does not support the HTTP version used in the request.
506 Variant Also Negotiates: A server configuration error caused recursive content negotiation.
507 Insufficient Storage: A WebDAV server cannot store the representation needed to complete the request.
508 Loop Detected: A WebDAV server detected an infinite loop while processing the request.
510 Not Extended: The request does not satisfy the extension policy needed to access the resource.
511 Network Authentication Required: The client must authenticate to gain network access, as with some captive portals.

What Status Codes Are Used For

Communicating the result

Codes such as 200 OK, 404 Not Found, and 500 Internal Server Error give clients a machine-readable summary of the outcome.

Debugging

A status code narrows the investigation but rarely identifies the entire cause. A 400 points toward the request, while a 500 points toward server-side handling; logs, headers, and the response body provide the remaining evidence.

Caching

Conditional requests and 304 Not Modified allow a client to reuse a cached representation, reducing transfer size and latency.

Redirecting

Codes such as 301, 302, 307, and 308 direct the client elsewhere. Choose carefully: permanence and whether the request method is preserved affect clients and search engines.

Authentication and authorization

401 Unauthorized challenges the client to authenticate. 403 Forbidden means the server refuses the request even though it understood it.

Rate limiting and resilience

429 Too Many Requests and 503 Service Unavailable let a service tell clients to back off. Well-behaved clients apply bounded retries, respect Retry-After when present, and avoid retry storms.