HTTP Status Code Lookup

The first part of the request was accepted; send the rest.

Sent automatically in response to an Expect: 100-continue header, so a large upload is not sent before the server has agreed to take it.

Cacheable by default: no

The server is changing protocol as the client asked.

The handshake response that turns an HTTP connection into a WebSocket.

Cacheable by default: no

Preliminary headers sent before the real response.

Lets a browser start fetching CSS and fonts named in Link headers while the server is still generating the page.

Cacheable by default: no

The request succeeded and the body is the result.

The default success response for GET, POST that returns a body, PUT and PATCH.

Cacheable by default: yes

A new resource was created as a result of the request.

The right answer to a POST that creates something. Include a Location header pointing at the new resource.

Cacheable by default: yes

The request was accepted but has not been acted on yet.

Queued or asynchronous work. Return a URL the client can poll rather than leaving it guessing.

Cacheable by default: no

Success, and there is deliberately no body.

A DELETE that worked, or a PUT whose result the client already has. A 204 must not carry a body — some clients hang if it does.

Cacheable by default: yes

Only the requested byte range is being returned.

Resumable downloads and video seeking, in response to a Range header.

Cacheable by default: yes

The resource has a new URL, permanently.

Domain moves, HTTP to HTTPS, and consolidating duplicate URLs. Search engines transfer ranking signals to the target and update the index.

Cacheable by default: yes

The resource is temporarily somewhere else.

Short-lived redirects. Note that browsers historically change the method to GET on a 302 — use 307 if the method must survive.

Cacheable by default: no

Fetch the result from a different URL, with GET.

The POST-redirect-GET pattern, so refreshing the results page does not resubmit the form.

Cacheable by default: no

The cached copy is still current, so no body is sent.

The response to a conditional request carrying If-None-Match or If-Modified-Since. The saved bandwidth is the entire point.

Cacheable by default: yes

Temporarily elsewhere, and keep the method and body.

A 302 that cannot be silently downgraded to GET. The right choice when redirecting a POST.

Cacheable by default: no

Permanently elsewhere, and keep the method and body.

A 301 that preserves the method. The modern default for a permanent move where non-GET requests matter.

Cacheable by default: yes

The server cannot parse or will not process the request as sent.

Malformed JSON, a missing required field, a parameter of the wrong type. Say which field failed — a bare 400 is a support ticket.

Cacheable by default: no

Authentication is required and has failed or not been supplied.

Missing, expired or invalid credentials. Despite the name it means unauthenticated — the answer is to log in. Must include a WWW-Authenticate header.

Cacheable by default: no

The server understood the request and refuses to authorise it.

The caller is authenticated but not allowed. Logging in again will not help, which is the whole difference from 401.

Cacheable by default: yes

There is no resource at this URL.

The correct answer for a URL that has never existed or no longer does. Also used deliberately to hide the existence of a resource from someone not allowed to know about it.

Cacheable by default: yes

The URL exists but does not support this method.

A POST to a read-only endpoint. The response must list what is supported in an Allow header.

Cacheable by default: yes

No representation matches the client's Accept headers.

The client asked for XML and the endpoint only speaks JSON. Rare in practice — most servers send their default instead.

Cacheable by default: yes

The client took too long to send the request.

An idle connection the server closed. Distinct from 504, which is a timeout between two servers.

Cacheable by default: no

The request conflicts with the current state of the resource.

A duplicate signup email, or an edit based on a version that has since changed. Say what conflicts so the client can resolve it.

Cacheable by default: no

The resource existed and has been permanently removed.

A stronger 404 for content you deliberately deleted. Google drops a 410 from the index faster than a 404.

Cacheable by default: yes

The request body exceeds the server's limit.

Upload size limits. Named Payload Too Large before RFC 9110 renamed it.

Cacheable by default: no

The body is in a format the endpoint does not accept.

Almost always a missing or wrong Content-Type header on a POST — form encoding sent to a JSON endpoint.

Cacheable by default: yes

The syntax is valid but the content fails the server's rules.

Well-formed JSON that breaks a business rule — an end date before a start date. Many APIs use it for validation errors and reserve 400 for unparseable input.

Cacheable by default: no

The client has sent too many requests in a given period.

Rate limiting. Always send Retry-After, and clients should back off exponentially rather than retrying immediately.

Cacheable by default: no

Access is denied because of a legal demand.

Court-ordered blocks and takedowns. The number is a deliberate nod to Fahrenheit 451.

Cacheable by default: yes

Something went wrong that the server has no better description for.

An unhandled exception. Log the detail server-side; never return a stack trace to the client.

Cacheable by default: no

The server does not support the functionality required.

A method the server does not recognise at all. Distinct from 405, which means this URL specifically does not allow it.

Cacheable by default: yes

A proxy got an invalid response from the server behind it.

The application crashed or is not listening, and the reverse proxy or load balancer in front of it is reporting that. Check the upstream, not the proxy.

Cacheable by default: no

The server is temporarily unable to handle the request.

Maintenance windows and overload. Send Retry-After — and use 503 rather than a redirect during a deploy, so search engines come back instead of reindexing the holding page.

Cacheable by default: no

A proxy did not get a response from upstream in time.

A slow query or a hung external call behind a proxy with a shorter timeout than the work takes.

Cacheable by default: no

The HTTP version used in the request is not supported.

Rare outside protocol testing and misconfigured clients.

Cacheable by default: yes