Every standard HTTP status code, what it means and when a server sends it. Search by number or reason phrase to jump straight to the code you saw in a log or a browser. The list covers codes defined by RFC 9110 and related specifications, including WebDAV and newer additions such as 103 and 425.
62 codes
| Code | Reason phrase | What it means |
|---|---|---|
| 100 | Continue | The server received the request headers and the client should send the body. |
| 101 | Switching Protocols | The client asked to switch protocols and the server agreed, for example to WebSocket. |
| 102 | Processing | WebDAV: the server accepted the request but has not finished it yet. |
| 103 | Early Hints | A preload hint sent before the final response, usually to start fetching assets. |
| 200 | OK | The standard success response. The body contains the requested representation. |
| 201 | Created | A new resource was created. The Location header usually points to it. |
| 202 | Accepted | The request was accepted for processing, but processing is not finished. |
| 203 | Non-Authoritative Information | The response came from a transforming proxy and is not the origin's exact payload. |
| 204 | No Content | Success with no response body, common for PUT and DELETE. |
| 205 | Reset Content | The client should reset the document view that sent the request. |
| 206 | Partial Content | A range request was fulfilled and the body contains only the requested bytes. |
| 207 | Multi-Status | WebDAV: the body contains several independent status codes. |
| 208 | Already Reported | WebDAV: members of a binding were already listed in an earlier response. |
| 226 | IM Used | The server applied delta encoding to the response. |
| 300 | Multiple Choices | Several representations are available and the client should choose one. |
| 301 | Moved Permanently | The resource moved permanently. Clients should update bookmarks and cached links. |
| 302 | Found | A temporary redirect. Many clients change the method to GET on the second request. |
| 303 | See Other | The result can be fetched with a GET request at the URI in the Location header. |
| 304 | Not Modified | The cached copy is still valid, so the client should reuse it. |
| 305 | Use Proxy | Deprecated: the client must use the proxy given in Location. |
| 307 | Temporary Redirect | A temporary redirect that preserves the original method and body. |
| 308 | Permanent Redirect | A permanent redirect that preserves the original method and body. |
| 400 | Bad Request | The server cannot process the request because the syntax or parameters are invalid. |
| 401 | Unauthorized | Authentication is required or the supplied credentials are invalid. |
| 402 | Payment Required | Reserved for future use; some APIs return it when an account is out of credit. |
| 403 | Forbidden | The server understood the request but refuses to authorize it. |
| 404 | Not Found | No resource matches the request URI, or the server hides whether one exists. |
| 405 | Method Not Allowed | The resource exists but does not support the request method. |
| 406 | Not Acceptable | The server cannot produce a response matching the client's Accept headers. |
| 407 | Proxy Authentication Required | The client must authenticate with the proxy first. |
| 408 | Request Timeout | The client did not finish sending the request in the time the server allowed. |
| 409 | Conflict | The request conflicts with the current state of the resource, such as a concurrent edit. |
| 410 | Gone | The resource existed but has been permanently removed and will not return. |
| 411 | Length Required | The request must include a Content-Length header. |
| 412 | Precondition Failed | A conditional header such as If-Match evaluated to false. |
| 413 | Content Too Large | The request body is larger than the server is willing to accept. |
| 414 | URI Too Long | The request target is longer than the server can handle. |
| 415 | Unsupported Media Type | The body format is not supported by the resource. |
| 416 | Range Not Satisfiable | The requested byte range cannot be served, often past the end of the file. |
| 417 | Expectation Failed | The server cannot meet the expectation in the Expect header. |
| 418 | I'm a teapot | A joke status code from RFC 2324. Some sites use it to reject bots or unwanted requests. |
| 421 | Misdirected Request | The server cannot answer for the authority in the request's URI. |
| 422 | Unprocessable Content | The request is syntactically valid but cannot be processed because of semantic errors. |
| 423 | Locked | WebDAV: the resource is locked by another user or process. |
| 424 | Failed Dependency | The request failed because an earlier request in the same batch failed. |
| 425 | Too Early | The server is not willing to risk a replay attack; retry later. |
| 426 | Upgrade Required | The client must switch to a different protocol before the server will proceed. |
| 428 | Precondition Required | The server requires the request to be conditional, usually to prevent lost updates. |
| 429 | Too Many Requests | The client exceeded a rate limit and should retry after the period in Retry-After. |
| 431 | Request Header Fields Too Large | The header block is larger than the server allows. |
| 451 | Unavailable For Legal Reasons | The resource is blocked for legal or regulatory reasons. |
| 500 | Internal Server Error | The server hit an unexpected condition and could not complete the request. |
| 501 | Not Implemented | The server does not support the request method or the functionality required. |
| 502 | Bad Gateway | A gateway or proxy received an invalid response from an upstream server. |
| 503 | Service Unavailable | The server is overloaded or under maintenance and cannot handle the request right now. |
| 504 | Gateway Timeout | A gateway or proxy did not receive a response from the upstream server in time. |
| 505 | HTTP Version Not Supported | The server does not support the HTTP version used in the request. |
| 506 | Variant Also Negotiates | Content negotiation is misconfigured and the chosen variant refers back to itself. |
| 507 | Insufficient Storage | WebDAV: the server cannot store the representation because it is out of space. |
| 508 | Loop Detected | WebDAV: the server detected an infinite loop while processing the request. |
| 510 | Not Extended | The server needs further extensions to the request before it can fulfill it. |
| 511 | Network Authentication Required | The client must authenticate with the network, as captive portals do. |
No code matches that filter.
Status code classes
- 1xx informational: the request was received and processing continues. These are rare in application logs because most servers send only the final response.
- 2xx success: the request was received, understood and accepted. 200 and 204 do most of the work in normal traffic.
- 3xx redirection: the client must take another action, usually a request to a different URI. This is where caching behaviour and method preservation (301 versus 307) matter.
- 4xx client error: the request itself is wrong: bad syntax, missing credentials, a missing resource, a rate limit or a rejected payload.
- 5xx server error: the request looked valid but the server, or an upstream it depends on, failed to complete it.
Status codes that are easy to confuse
401 vs 403: authentication or authorization?
401 means the request lacks valid authentication credentials, so the client should authenticate and retry. 403 means the server knows who the client is and still refuses, either because the account lacks permission or because the resource is deliberately hidden. A 401 usually comes with a WWW-Authenticate header; a 403 does not.
301, 302, 307 and 308: which redirect preserves the method?
301 and 302 are the old redirects, and many clients change a POST into a GET when following them. 307 and 308 were defined to keep the original method and body. Use 308 when the move is permanent and 307 when it is temporary; only 301 and 308 tell caches and search engines that the new URL is the canonical one.
502 vs 503 vs 504: which server failed?
502 means a proxy or load balancer received an invalid response from an upstream server. 503 means the server itself is overloaded or in maintenance and is refusing work. 504 means the proxy waited for an upstream and gave up. The distinction tells you whether to look at the application, the upstream pool or a timeout budget.
400 vs 422: what is the difference?
400 means the request could not be parsed or was structurally invalid, such as malformed JSON. 422 means the request parsed correctly but failed validation, for example a field that must be positive received a negative number. Many JSON APIs return 400 for both, so check the response body for details.
429 and Retry-After
429 means the client exceeded a rate limit. A well-behaved server includes a Retry-After header giving the number of seconds or an HTTP date before the next attempt. Clients should honour it instead of retrying immediately, which only extends the limit window.
Non-standard and vendor codes
Some servers return codes outside the standard set, such as Cloudflare's 520-526 range or Microsoft IIS codes. Those are not part of the HTTP specification and mean whatever that vendor documents. When you see an unfamiliar code in the 5xx range, identify the proxy or CDN in front of the application before assuming the origin is at fault.
Definitions follow RFC 9110 and the WebDAV specifications. Vendor-specific codes are not included.