HTTP Status Codes – Free, Online, Private

How to read a status

The first digit is the class. 1xx is informational and the request is not finished. 2xx means the server did what you asked, with the caveats written on the specific code. 3xx means the client has to look somewhere else or reuse a stored response. 4xx means the request is at fault and sending the same bytes again will fail the same way. 5xx means the server, or a proxy in front of it, failed and a later retry might work.

The exact code is the contract. A client that treats every 4xx as 'show the JSON message' will mishandle 401, which needs a WWW-Authenticate challenge, and 301, which is not an error at all. These pages stay on the codes in the HTTP and WebDAV specifications that servers still emit. Vendor codes such as 499 or 520 are left out on purpose, because they are not the same code on every proxy.

Nothing on these pages sends your request to Utilo. The examples are static. The filter on this hub only hides rows in the browser. If you are choosing a code for an API, pick the one whose 'when to send it' section matches the outcome, and link the client at the specific page rather than at a blog post that repeats the table.

The codes

HTTP 100 Continue: 100 Continue tells the client to send the request body it has been holding. HTTP 101 Switching Protocols: 101 Switching Protocols accepts an Upgrade and changes the protocol on this connection. HTTP 102 Processing: 102 Processing is a WebDAV interim status meaning the server is still working on a slow request. HTTP 103 Early Hints: 103 Early Hints lets the server send Link headers before the final response is ready. HTTP 200 OK: 200 OK means the request succeeded and the response represents the result. HTTP 201 Created: 201 Created means a new resource exists, and Location should point at it. HTTP 202 Accepted: 202 Accepted means the request was queued, not that the work finished. HTTP 203 Non-Authoritative Information: 203 means a transforming proxy changed the representation the origin sent. HTTP 204 No Content: 204 No Content means success and a deliberate absence of a body. HTTP 205 Reset Content: 205 Reset Content means success, and the client should reset the view that sent the request. HTTP 206 Partial Content: 206 Partial Content returns a byte range of the resource, not the whole file. HTTP 207 Multi-Status: 207 Multi-Status is a WebDAV response whose body lists a status per resource. HTTP 208 Already Reported: 208 Already Reported tells a WebDAV client this binding was already listed in the same multi-status. HTTP 226 IM Used: 226 IM Used means the response applied an instance manipulation such as a delta. HTTP 300 Multiple Choices: 300 Multiple Choices means more than one representation exists and the client must pick. HTTP 301 Moved Permanently: 301 Moved Permanently means the resource has a new URL and clients should remember it. HTTP 302 Found: 302 Found is a temporary redirect. Clients should keep using the original URL later. HTTP 303 See Other: 303 See Other tells the client to GET a different URI for the result of this request. HTTP 304 Not Modified: 304 Not Modified means the client's cached copy is still fresh. HTTP 305 Use Proxy: 305 Use Proxy is a deprecated status that told clients to repeat the request through a proxy. HTTP 307 Temporary Redirect: 307 Temporary Redirect sends the client to another URI and keeps the method and body. HTTP 308 Permanent Redirect: 308 Permanent Redirect is a permanent move that keeps the method and body. HTTP 400 Bad Request: 400 Bad Request means the server could not understand the request, or it was malformed. HTTP 401 Unauthorized: 401 Unauthorized means the request lacks valid authentication, despite the name. HTTP 402 Payment Required: 402 Payment Required is reserved for payment, and it is rarely given a standard body. HTTP 403 Forbidden: 403 Forbidden means the server understood the request and refuses to authorize it. HTTP 404 Not Found: 404 Not Found means the server found no current representation for the target. HTTP 405 Method Not Allowed: 405 Method Not Allowed means the URL exists and this method is not accepted. HTTP 406 Not Acceptable: 406 Not Acceptable means the server cannot produce a representation matching Accept. HTTP 407 Proxy Authentication Required: 407 Proxy Authentication Required means a proxy wants credentials before it will forward the request. HTTP 408 Request Timeout: 408 Request Timeout means the server timed out waiting for the client to finish the request. HTTP 409 Conflict: 409 Conflict means the request collided with the current state of the resource. HTTP 410 Gone: 410 Gone means the resource used to exist and is gone on purpose. HTTP 411 Length Required: 411 Length Required means the server refuses the request without a Content-Length. HTTP 412 Precondition Failed: 412 Precondition Failed means a conditional header such as If-Match did not hold. HTTP 413 Content Too Large: 413 Content Too Large means the request body is bigger than the server will accept. HTTP 414 URI Too Long: 414 URI Too Long means the request target is longer than the server will parse. HTTP 415 Unsupported Media Type: 415 Unsupported Media Type means the request body's Content-Type is not accepted. HTTP 416 Range Not Satisfiable: 416 Range Not Satisfiable means the Range header asked for bytes the resource does not have. HTTP 417 Expectation Failed: 417 Expectation Failed means the server cannot meet the Expect header. HTTP 418 I'm a teapot: 418 I'm a teapot is the HTCPCP joke status. It is not an API error code. HTTP 421 Misdirected Request: 421 Misdirected Request means the request arrived at a server that cannot produce this authority. HTTP 422 Unprocessable Content: 422 Unprocessable Content means the syntax was fine and the instructions could not be followed. HTTP 423 Locked: 423 Locked means the WebDAV resource is locked and the method was not applied. HTTP 424 Failed Dependency: 424 Failed Dependency means this action was refused because another action it depended on failed. HTTP 425 Too Early: 425 Too Early means the server refused a request that might be replayed before the handshake finishes. HTTP 426 Upgrade Required: 426 Upgrade Required means the server refuses the current protocol and names the one it wants. HTTP 428 Precondition Required: 428 Precondition Required means the server will not accept the write without a precondition. HTTP 429 Too Many Requests: 429 Too Many Requests means the client has sent too much traffic in a given time. HTTP 431 Request Header Fields Too Large: 431 Request Header Fields Too Large means a header or the header block is too big. HTTP 451 Unavailable For Legal Reasons: 451 Unavailable For Legal Reasons means the server refuses to provide the resource because of a legal demand. HTTP 500 Internal Server Error: 500 Internal Server Error means the server hit an unexpected condition and could not finish. HTTP 501 Not Implemented: 501 Not Implemented means the server does not support the functionality required. HTTP 502 Bad Gateway: 502 Bad Gateway means a proxy got an invalid response from the upstream. HTTP 503 Service Unavailable: 503 Service Unavailable means the server cannot handle the request right now. HTTP 504 Gateway Timeout: 504 Gateway Timeout means a proxy timed out waiting for the upstream. HTTP 505 HTTP Version Not Supported: 505 HTTP Version Not Supported means the server refuses the HTTP major version in the request. HTTP 506 Variant Also Negotiates: 506 Variant Also Negotiates means a transparent content negotiation choice was itself a negotiable resource. HTTP 507 Insufficient Storage: 507 Insufficient Storage means the server cannot store what it needs to complete the request. HTTP 508 Loop Detected: 508 Loop Detected means the server stopped because it found an infinite loop in the operation. HTTP 510 Not Extended: 510 Not Extended means the server requires a request extension the client did not send. HTTP 511 Network Authentication Required: 511 Network Authentication Required means a captive portal wants the client to authenticate to the network.

Retries and caches

Retry a GET, HEAD, PUT, DELETE, or OPTIONS when the failure is a timeout or a 5xx and you can tolerate a duplicate. Do not retry POST unless you have an idempotency key. 301 and 308 may be cached. 302 and 307 should not be cached unless the headers say so. 206 is a slice, not the resource. 204 has no body. Those four mistakes account for a large share of client bugs, and each has its own page.

If you are documenting an API, publish the exact codes you return. A table that says '4xx on bad input' forces every caller to guess. The related links on each page are the six neighbors that are most often the code you actually wanted.