HTTP 423 Locked – Free, Online, Private

What HTTP 423 means

423 says the source or destination resource is locked. WebDAV defined it. The method did not happen. The body may include the lock discovery information so the client can see who holds the lock. Ordinary JSON APIs that mean 'a row is locked in a database' sometimes borrow 423. If you borrow it, document it. A database lock that will clear in milliseconds is a poor 423. The client will not know when to retry.

423 Locked belongs to the 4xx client error class. Clients that only look at the class will group it with its neighbors. Clients that care about the exact code should use the narrower rule on this page, because the class is only the first digit.

When you see HTTP 423

When you see HTTP 423 Locked, stop on that exact status line. 423 Locked means the WebDAV resource is locked and the method was not applied. The trace that usually produces it: A LOCK is held by another principal and PUT was rejected. The 4xx client error class only tells you the first digit. A neighbor in that class is a different fault, and the fix on this page does not transfer to it.

Return 423 for a WebDAV method blocked by a lock. Include lock details if you can. For a short database lock, prefer to wait or return 409 or 503 with Retry-After. Do not use 423 as a synonym for 401. The caller may be allowed and still blocked by someone else's lock.

How to fix HTTP 423

To fix HTTP 423, change the condition that made the server choose Locked. Do not spin. If you know the lock timeout, wait. If you can take the lock yourself through the API's lock method, do that. Otherwise tell the user the resource is busy. After the lock expires or is released, not immediately in a loop. If the log line is a different code, leave this page. The mix-up people make with 423 is this one: 409 is a version conflict. 403 is a refusal that is not a lock. 401 is authentication. 423 is specifically a lock.

• The lock expired on the server and the client still received 423 because of clock skew.
• A non-WebDAV API returned 423 with no owner and no timeout.
• The client retried immediately and hammered the lock.

An access log that only stores 423 is not enough to tell these apart. Keep the method, the path, and a request id. Do not keep the Authorization header or a request body that might be a token. The status explains the outcome. It is not a place to echo secrets back to the client either.

Example response

HTTP 423 LockedHTTP/1.1 423 Locked
Content-Type: application/xml

WebDAV puts a lockdiscovery body here. The client can show who holds the lock. Without that body, 423 is only 'no'. If you are not speaking WebDAV, say in JSON when the lock expires. A client cannot make a good decision from the number alone.

What the client should do

Do not spin. If you know the lock timeout, wait. If you can take the lock yourself through the API's lock method, do that. Otherwise tell the user the resource is busy.

Do not cache 423. The lock will change.

After the lock expires or is released, not immediately in a loop.

Codes people confuse with HTTP 423

409 is a version conflict. 403 is a refusal that is not a lock. 401 is authentication. 423 is specifically a lock.