What is an HTTP status code?

An HTTP status code is a three-digit number that a web server returns in response to an HTTP request. It indicates the outcome of the request — whether it was successful, redirected, encountered a client error, or failed due to a server error. Status codes are defined in RFC 9110 (HTTP Semantics) and are grouped into five categories: 1xx (Informational), 2xx (Success), 3xx (Redirection), 4xx (Client Error), and 5xx (Server Error).

What is the difference between 401 Unauthorized and 403 Forbidden?

Despite its name, 401 Unauthorized actually means "unauthenticated" — the client has not provided valid authentication credentials. The server does not know who the client is. 403 Forbidden means the server knows who the client is (they are authenticated), but they do not have permission to access the requested resource. In short: 401 = "who are you?" and 403 = "I know who you are, but you cannot access this."

What are the five categories of HTTP status codes?

HTTP status codes are grouped into five categories based on the first digit: 1xx (Informational) — provisional responses indicating the request was received; 2xx (Success) — the request was successfully processed; 3xx (Redirection) — further action is needed, typically a redirect; 4xx (Client Error) — the request is malformed or unauthorized; 5xx (Server Error) — the server failed to fulfill a valid request.

Which HTTP status code should I use for creating a resource in a REST API?

Use 201 Created when a new resource is successfully created via a POST or PUT request. The response should include a Location header pointing to the newly created resource’s URL. If the creation is accepted but not yet completed (asynchronous processing), use 202 Accepted. For updates to existing resources, use 200 OK or 204 No Content if no body is returned.

What is the difference between 301 and 302 redirects?

301 Moved Permanently indicates that the resource has a new permanent URL — search engines and browsers update their links to the new URL. 302 Found indicates a temporary redirect — the resource is temporarily at a different URL, but future requests should still use the original URL. For SEO purposes, 301 passes link equity to the new URL, while 302 does not. Use 307 Temporary Redirect and 308 Permanent Redirect when you need to preserve the HTTP method across the redirect.

What does 429 Too Many Requests mean and how should clients handle it?

429 Too Many Requests is a rate-limiting response. It means the client has sent too many requests in a given time period. The response should include a Retry-After header indicating how many seconds the client should wait before making another request. Clients should implement exponential backoff and respect the Retry-After header to avoid being permanently blocked.

When should I use 204 No Content instead of 200 OK?

Use 204 No Content when the request was successful but there is no content to return in the response body. Common scenarios include DELETE operations (resource deleted, nothing to return), PUT/PATCH updates where the client already has the updated representation, and OPTIONS preflight requests. Use 200 OK when the response includes a body with the requested resource or a representation of the result.

What are REST API best practices for HTTP status codes?

Always return the most specific status code that accurately describes the outcome. Use 200 for successful GET, 201 for resource creation, 204 for successful operations with no body, 400 for malformed requests, 401 for missing/invalid authentication, 403 for insufficient permissions, 404 for non-existent resources, 422 for validation errors, 429 for rate limiting, and 5xx for server-side failures. Avoid returning 200 for errors (even if the body contains an error message) — this breaks HTTP semantics and confuses client libraries that rely on status codes for error handling.

🛠️DevToolsHub

HTTP Status Code Lookup

Search and reference HTTP status codes with descriptions and use cases.

What are HTTP Status Codes?

HTTP status codes are three-digit numbers returned by a server in response to a client’s HTTP request. They are a fundamental part of the HTTP protocol, defined in RFC 9110, and they tell the client whether a request was successful, whether it needs to take further action, or whether something went wrong. Every HTTP response — whether from a web page load, a REST API call, or a fetch request in JavaScript — includes one of these status codes.

Status codes are grouped into five categories based on their first digit. The 1xx range provides informational responses, 2xx indicates success, 3xx handles redirections, 4xx signals client errors, and 5xx indicates server errors. Understanding these codes is essential for web developers, API designers, DevOps engineers, and anyone working with HTTP-based systems.

For developers building or consuming REST APIs, HTTP status codes are the primary means of communicating the outcome of a request. Returning the correct status code is a best practice that helps clients handle responses appropriately — whether that means displaying a success message, retrying a failed request, authenticating the user, or showing a meaningful error. Using the wrong status code can lead to confused clients, broken retry logic, and poor developer experience.

How to Use the HTTP Status Code Lookup

Type a search queryin the search box. You can search by status code number (e.g., “404”), by name (e.g., “Not Found”), or by keyword in the description (e.g., “rate limiting”).
Filter by category using the colored buttons above the results. Click a category (1xx through 5xx) to see all status codes in that range. Click it again to clear the filter.
Click any result to expand its details, including the full description and a list of common use cases where that status code is typically used.
Copy the status code and its description using the copy button in the expanded view. This is handy for documentation, bug reports, or sharing with your team.
Try the example queries — click any of the suggested search terms to quickly see relevant status codes.

Status Code Categories

The five categories of HTTP status codes each serve a distinct purpose. Knowing what each category represents helps you quickly diagnose issues when debugging API responses or web applications:

1xx — Informational: Provisional responses that indicate the server has received the request and is continuing to process it. These are rarely seen in everyday web browsing but are important for large uploads (100 Continue), protocol upgrades (101 Switching Protocols), and early hints for resource preloading (103 Early Hints).
2xx — Success: The request was successfully received, understood, and accepted. The most common is 200 OK, but other codes like 201 Created (resource created), 204 No Content (success with no body), and 206 Partial Content (range requests) are essential for REST API design.
3xx — Redirection: The client must take additional action to complete the request. This includes permanent redirects (301), temporary redirects (302, 307), cache validation (304 Not Modified), and protocol-preserving permanent redirects (308). Proper use of redirect codes is critical for SEO, URL migration, and caching strategies.
4xx — Client Error: The request contains bad syntax or cannot be fulfilled. These are the codes developers encounter most frequently: 400 Bad Request (malformed input), 401 Unauthorized (not authenticated), 403 Forbidden (not authorized), 404 Not Found(resource doesn’t exist), 422 Unprocessable Content (validation error), and 429 Too Many Requests (rate limited).
5xx — Server Error: The server failed to fulfill a valid request. Common codes include 500 Internal Server Error (unhandled exception), 502 Bad Gateway(upstream failure), 503 Service Unavailable(maintenance or overload), and 504 Gateway Timeout(upstream timeout). These codes indicate problems on the server side that the client cannot fix.

Common Status Codes

Some HTTP status codes are encountered far more frequently than others. Here are the most commonly seen status codes in everyday web development and API design:

200 OK — The standard success response. Used for successful GET requests where the resource is returned in the body.
201 Created — Returned after a successful POST or PUT request that creates a new resource. The response typically includes a Location header pointing to the new resource.
204 No Content — Success with an empty response body. Common for DELETE operations or PUT updates where no content needs to be returned.
301 Moved Permanently — The resource has a new permanent URL. Browsers and search engines update their links accordingly. Essential for URL migrations.
304 Not Modified — The cached version is still valid. Triggered by conditional request headers like If-Modified-Since or If-None-Match (ETag). Saves bandwidth and improves performance.
400 Bad Request — The server cannot process the request due to malformed syntax, invalid JSON, or missing required parameters.
401 Unauthorized — Authentication is required. The response typically includes a WWW-Authenticate header describing how to authenticate.
403 Forbidden — The client is authenticated but does not have permission to access the requested resource. Different from 401, which means the client is not authenticated at all.
404 Not Found — The requested resource does not exist on the server. The most recognizable error code on the web.
429 Too Many Requests — The client has exceeded the rate limit. The response should include a Retry-After header indicating when to try again.
500 Internal Server Error — A generic server-side error. The server encountered an unexpected condition that prevented it from fulfilling the request.
503 Service Unavailable — The server is temporarily unable to handle the request, typically due to maintenance or overload. Often paired with a Retry-After header.

Frequently Asked Questions

HTTP Status Code Lookup

Search and reference HTTP status codes with descriptions and use cases.

What are HTTP Status Codes?

How to Use the HTTP Status Code Lookup

Type a search queryin the search box. You can search by status code number (e.g., “404”), by name (e.g., “Not Found”), or by keyword in the description (e.g., “rate limiting”).
Filter by category using the colored buttons above the results. Click a category (1xx through 5xx) to see all status codes in that range. Click it again to clear the filter.
Click any result to expand its details, including the full description and a list of common use cases where that status code is typically used.
Copy the status code and its description using the copy button in the expanded view. This is handy for documentation, bug reports, or sharing with your team.
Try the example queries — click any of the suggested search terms to quickly see relevant status codes.

Status Code Categories

The five categories of HTTP status codes each serve a distinct purpose. Knowing what each category represents helps you quickly diagnose issues when debugging API responses or web applications:

1xx — Informational: Provisional responses that indicate the server has received the request and is continuing to process it. These are rarely seen in everyday web browsing but are important for large uploads (100 Continue), protocol upgrades (101 Switching Protocols), and early hints for resource preloading (103 Early Hints).
2xx — Success: The request was successfully received, understood, and accepted. The most common is 200 OK, but other codes like 201 Created (resource created), 204 No Content (success with no body), and 206 Partial Content (range requests) are essential for REST API design.
3xx — Redirection: The client must take additional action to complete the request. This includes permanent redirects (301), temporary redirects (302, 307), cache validation (304 Not Modified), and protocol-preserving permanent redirects (308). Proper use of redirect codes is critical for SEO, URL migration, and caching strategies.
4xx — Client Error: The request contains bad syntax or cannot be fulfilled. These are the codes developers encounter most frequently: 400 Bad Request (malformed input), 401 Unauthorized (not authenticated), 403 Forbidden (not authorized), 404 Not Found(resource doesn’t exist), 422 Unprocessable Content (validation error), and 429 Too Many Requests (rate limited).
5xx — Server Error: The server failed to fulfill a valid request. Common codes include 500 Internal Server Error (unhandled exception), 502 Bad Gateway(upstream failure), 503 Service Unavailable(maintenance or overload), and 504 Gateway Timeout(upstream timeout). These codes indicate problems on the server side that the client cannot fix.

Common Status Codes

Some HTTP status codes are encountered far more frequently than others. Here are the most commonly seen status codes in everyday web development and API design:

200 OK — The standard success response. Used for successful GET requests where the resource is returned in the body.
201 Created — Returned after a successful POST or PUT request that creates a new resource. The response typically includes a Location header pointing to the new resource.
204 No Content — Success with an empty response body. Common for DELETE operations or PUT updates where no content needs to be returned.
301 Moved Permanently — The resource has a new permanent URL. Browsers and search engines update their links accordingly. Essential for URL migrations.
304 Not Modified — The cached version is still valid. Triggered by conditional request headers like If-Modified-Since or If-None-Match (ETag). Saves bandwidth and improves performance.
400 Bad Request — The server cannot process the request due to malformed syntax, invalid JSON, or missing required parameters.
401 Unauthorized — Authentication is required. The response typically includes a WWW-Authenticate header describing how to authenticate.
403 Forbidden — The client is authenticated but does not have permission to access the requested resource. Different from 401, which means the client is not authenticated at all.
404 Not Found — The requested resource does not exist on the server. The most recognizable error code on the web.
429 Too Many Requests — The client has exceeded the rate limit. The response should include a Retry-After header indicating when to try again.
500 Internal Server Error — A generic server-side error. The server encountered an unexpected condition that prevented it from fulfilling the request.
503 Service Unavailable — The server is temporarily unable to handle the request, typically due to maintenance or overload. Often paired with a Retry-After header.