Every HTTP response starts with a three-digit status code that tells the client what happened. Learning the five classes gives you most of the picture, and a couple of dozen specific codes cover nearly everything you'll see.
The five classes
- 1xx Informational: the request was received and processing continues (rarely seen directly).
- 2xx Success: the request worked.
- 3xx Redirection: the client needs to take another step, usually going to a different URL.
- 4xx Client error: something is wrong with the request.
- 5xx Server error: the server failed to handle a valid request.
Success codes
- 200 OK: standard success.
- 201 Created: a new resource was created (typical for POST).
- 202 Accepted: the request was accepted but processing isn't finished.
- 204 No Content: success with no body, common for DELETE and some PUTs.
Redirects
- 301 Moved Permanently: the resource has a new permanent URL; search engines transfer ranking.
- 302 Found: a temporary redirect.
- 307 Temporary Redirect and 308 Permanent Redirect: like 302 and 301, but the request method and body are preserved.
- 304 Not Modified: the cached copy is still valid.
Client errors
- 400 Bad Request: malformed or invalid request.
- 401 Unauthorized: authentication is missing or invalid (despite the name, it means unauthenticated).
- 403 Forbidden: you are identified but not allowed.
- 404 Not Found: nothing exists at that URL.
- 405 Method Not Allowed: the path exists but not for that method.
- 409 Conflict: the request conflicts with the current state, such as a duplicate.
- 410 Gone: the resource was intentionally removed permanently.
- 422 Unprocessable Content: the request was well-formed but failed validation.
- 429 Too Many Requests: you're being rate limited; check the Retry-After header.
Server errors
- 500 Internal Server Error: an unexpected failure on the server.
- 502 Bad Gateway: a proxy or gateway received an invalid response from upstream.
- 503 Service Unavailable: temporarily overloaded or down for maintenance.
- 504 Gateway Timeout: an upstream server didn't respond in time.
401 vs 403
Use 401 when the caller hasn't proven who they are (log in or send a valid token). Use 403 when they are known but don't have permission for that resource.
Frequently asked questions
What is the difference between 301 and 302?
301 is a permanent redirect and passes SEO value to the new URL. 302 is temporary, so search engines keep the original URL.
What does a 500 error mean?
The server hit an unexpected problem. It is a server-side issue, not something the client did wrong.
What is the difference between 401 and 403?
401 means authentication is missing or invalid. 403 means you're authenticated but not permitted.
What should I do when I get a 429?
Slow down and retry after the delay in the Retry-After header, using exponential backoff.
Try it: HTTP Status Code Lookup — free, runs in your browser, nothing is uploaded.
Originally published at ilovekit.app.
Top comments (0)