What do the 5 HTTP status code classes mean?

1xx indicates provisional informational messages; 2xx indicates the request was received and processed successfully; 3xx indicates further action/redirection is required; 4xx indicates an error caused by the client's request; 5xx indicates the server encountered an error while processing a valid request.

What is the difference between 401 Unauthorized and 403 Forbidden?

401 Unauthorized means authentication credentials are missing or invalid (the user is not logged in). 403 Forbidden means the server recognizes the authenticated user's identity, but their account role or permissions are insufficient to access the resource.

What is the difference between 301 and 302 redirects?

301 Moved Permanently tells search engines and browsers that the URL has moved permanently, transferring SEO ranking signals. 302 Found indicates a temporary move where search engines keep the original URL indexed.

What is the difference between 302 and 307 redirects?

302 allows clients to historically rewrite POST requests into GET requests. 307 Temporary Redirect strictly guarantees that the HTTP request method and body are preserved across the redirect.

What is the difference between 307 and 308 redirects?

Both preserve the original HTTP request method (POST stays POST). 307 is a temporary redirect, whereas 308 is a permanent redirect that instructs clients and search engines to update their permanent records.

What is the difference between 400 Bad Request and 422 Unprocessable Content?

400 Bad Request indicates malformed request syntax (such as invalid JSON formatting or missing headers). 422 Unprocessable Content indicates that the JSON syntax is valid, but the data fails business validation rules (e.g. password too short, invalid date range).

What is the difference between 404 Not Found and 410 Gone?

404 Not Found indicates that the resource was not found, but it may return in the future. 410 Gone explicitly tells clients and search crawlers that the resource was permanently purged and should be de-indexed immediately.

What is the difference between 500, 502, 503, and 504?

500 is an unhandled runtime error on the origin server; 502 Bad Gateway means a reverse proxy received an invalid response from an upstream backend; 503 Service Unavailable means the server is temporarily overloaded or in maintenance; 504 Gateway Timeout means the proxy timed out waiting for the upstream backend to reply.

Which HTTP status code should I use for input validation errors in REST APIs?

Use 422 Unprocessable Content when the JSON payload is syntactically valid but fails field validation. If the JSON syntax is broken or unparseable, use 400 Bad Request.

Which HTTP status code should I use when creating a new resource?

Use 201 Created for POST requests that successfully create a new database entity, and include a 'Location: /items/123' header.

Which HTTP status code should I use for rate limiting?

Use 429 Too Many Requests, and include a 'Retry-After: ' header indicating when the client may retry.

Can 5xx errors be retried safely?

Idempotent requests (GET, HEAD, PUT, DELETE) can generally be retried with exponential backoff. Non-idempotent write requests (POST) should be retried with caution or using idempotency keys to avoid duplicate operations.

What do the 5 HTTP status code classes mean?

1xx indicates provisional informational messages; 2xx indicates the request was received and processed successfully; 3xx indicates further action/redirection is required; 4xx indicates an error caused by the client's request; 5xx indicates the server encountered an error while processing a valid request.

What is the difference between 401 Unauthorized and 403 Forbidden?

401 Unauthorized means authentication credentials are missing or invalid (the user is not logged in). 403 Forbidden means the server recognizes the authenticated user's identity, but their account role or permissions are insufficient to access the resource.

What is the difference between 301 and 302 redirects?

301 Moved Permanently tells search engines and browsers that the URL has moved permanently, transferring SEO ranking signals. 302 Found indicates a temporary move where search engines keep the original URL indexed.

What is the difference between 302 and 307 redirects?

302 allows clients to historically rewrite POST requests into GET requests. 307 Temporary Redirect strictly guarantees that the HTTP request method and body are preserved across the redirect.

What is the difference between 307 and 308 redirects?

Both preserve the original HTTP request method (POST stays POST). 307 is a temporary redirect, whereas 308 is a permanent redirect that instructs clients and search engines to update their permanent records.

What is the difference between 400 Bad Request and 422 Unprocessable Content?

400 Bad Request indicates malformed request syntax (such as invalid JSON formatting or missing headers). 422 Unprocessable Content indicates that the JSON syntax is valid, but the data fails business validation rules (e.g. password too short, invalid date range).

What is the difference between 404 Not Found and 410 Gone?

404 Not Found indicates that the resource was not found, but it may return in the future. 410 Gone explicitly tells clients and search crawlers that the resource was permanently purged and should be de-indexed immediately.

What is the difference between 500, 502, 503, and 504?

500 is an unhandled runtime error on the origin server; 502 Bad Gateway means a reverse proxy received an invalid response from an upstream backend; 503 Service Unavailable means the server is temporarily overloaded or in maintenance; 504 Gateway Timeout means the proxy timed out waiting for the upstream backend to reply.

Which HTTP status code should I use for input validation errors in REST APIs?

Use 422 Unprocessable Content when the JSON payload is syntactically valid but fails field validation. If the JSON syntax is broken or unparseable, use 400 Bad Request.

Which HTTP status code should I use when creating a new resource?

Use 201 Created for POST requests that successfully create a new database entity, and include a 'Location: /items/123' header.

Which HTTP status code should I use for rate limiting?

Use 429 Too Many Requests, and include a 'Retry-After: ' header indicating when the client may retry.

Can 5xx errors be retried safely?

Idempotent requests (GET, HEAD, PUT, DELETE) can generally be retried with exponential backoff. Non-idempotent write requests (POST) should be retried with caution or using idempotency keys to avoid duplicate operations.

HTTP Status Code Reference & Lookup

Name: HTTP Status Code Reference & Lookup | ToolMono
Author: ToolMono Engineering Team

Look up HTTP status codes by number or meaning. Understand 1xx–5xx responses, common causes, API usage, retry guidance, examples, RFC references and related codes.

Category: NetworkAuthor: ToolMono Engineering TeamLast Updated: July 29, 2026Reading Time: ~5 min readStatus: stable

39 Indexed Status Codes•1xx (3)•2xx (8)•3xx (6)•4xx (12)•5xx (10)

Quick Access:

Matching Codes (39)

4044xx Client Error

Not Found

Plain-English Meaning

The server cannot find the requested resource.

The origin server did not find a current representation for the target resource or is not willing to disclose that one exists. A 404 status does not indicate whether this condition is temporary or permanent.

When to Use

When a client requests a URL route, endpoint, or resource ID that does not exist in the system.
When hiding the existence of a sensitive resource from unprivileged users.

When NOT to Use

Do not use when a resource was permanently deleted and you wish to inform search engines it is gone forever (use 410 Gone).
Do not return 404 when an internal database query fails due to a server error (use 500 Internal Server Error).

Common Causes

Mistyped URL, deleted entity, broken link, changed API route.

Troubleshooting Steps

Check spelling of the URL path and query parameters.
Verify routing configuration in API gateways and reverse proxies.

Retryability

Usually not retryable

Do not retry unless the resource is expected to be created soon.

Cacheability

Heuristically cacheable

Can be heuristically cached if Cache-Control headers allow.

Common Methods

GET, POST, PUT, DELETE, PATCH, HEAD

Applicable request methods

Illustrative Example Response

HTTP/1.1 404 Not Found
Content-Type: application/json

{
  "error": "not_found",
  "message": "User with ID 9999 was not found"
}

Related:Confused with:

RFC 9110 §15.5.5 MDN Docs

Complementary Workflows:

URL Parser•URL Encoder•HAR Sanitizer•JWT Decoder

How to Use

Use the search bar to search by status code number (e.g. 404, 502), name (e.g. 'Not Found'), or problem keyword (e.g. 'rate limit', 'gateway timeout').

Click any quick-access button (e.g. 200, 201, 301, 401, 403, 404, 429, 500, 502, 504) to immediately open its detailed specification card.

Filter by status class tabs (1xx Informational, 2xx Success, 3xx Redirection, 4xx Client Error, 5xx Server Error).

Switch to the 'Which Status Code Should I Use?' tab to select your developer scenario (e.g. 'Resource created', 'Validation failed', 'Rate limited') and obtain recommended status codes.

Open the 'Compare Codes' tab to view side-by-side diffs (e.g. 401 vs 403, 301 vs 302, 502 vs 504) comparing usage, causes, and RFC definitions.

Export structured status documentation to JSON or download the full reference dataset as a CSV spreadsheet.

What Are HTTP Status Codes?

HTTP response status codes are standardized three-digit integers issued by an origin web server or intermediary proxy to summarize the outcome of an HTTP request. Standardized by the Internet Engineering Task Force (IETF) in RFC 9110 (HTTP Semantics) and maintained in the IANA HTTP Status Code Registry, status codes inform client browsers, mobile applications, search crawlers, and API consumers whether a request succeeded, requires redirection, encountered client errors, or failed on the server.

Standard vs. Non-Standard Status Codes: The first digit of a status code establishes its general response class (1xx–5xx). Official standards are strictly governed by RFC specifications. Proprietary vendor extensions (such as Cloudflare 520–524 errors) provide edge telemetry but are not standardized RFC status codes.

How to Use the HTTP Status Code Reference & Lookup

Step 01

Use the search bar to search by status code number (e.g. 404, 502), name (e.g. 'Not Found'), or problem keyword (e.g. 'rate limit', 'gateway timeout').

Step 02

Click any quick-access button (e.g. 200, 201, 301, 401, 403, 404, 429, 500, 502, 504) to immediately open its detailed specification card.

Step 03

Filter by status class tabs (1xx Informational, 2xx Success, 3xx Redirection, 4xx Client Error, 5xx Server Error).

Step 04

Switch to the 'Which Status Code Should I Use?' tab to select your developer scenario (e.g. 'Resource created', 'Validation failed', 'Rate limited') and obtain recommended status codes.

Step 05

Open the 'Compare Codes' tab to view side-by-side diffs (e.g. 401 vs 403, 301 vs 302, 502 vs 504) comparing usage, causes, and RFC definitions.

Step 06

Export structured status documentation to JSON or download the full reference dataset as a CSV spreadsheet.

HTTP Status Code Classes (1xx–5xx)

1xxInformational

Provisional responses indicating that the request was received and processing continues. 1xx responses never contain a message body (e.g. 100 Continue, 101 Switching Protocols, 103 Early Hints).

2xxSuccess

Indicates that the client's request was successfully received, understood, and accepted (e.g. 200 OK, 201 Created, 204 No Content, 206 Partial Content).

3xxRedirection

Indicates that further action needs to be taken by the user agent to complete the request (e.g. 301 Moved Permanently, 304 Not Modified, 307 Temporary Redirect, 308 Permanent Redirect).

4xxClient Error

Indicates that the client seems to have erred (e.g. malformed syntax, missing authorization, forbidden permissions, or rate limits: 400, 401, 403, 404, 422, 429).

5xxServer Error

Indicates that the origin server or intermediate proxy failed to fulfill an apparently valid request due to an internal crash, upstream gateway issue, or maintenance outage (e.g. 500, 502, 503, 504).

Quick HTTP Status Code Cheat Sheet

Code	Status Name	Class	Plain-English Meaning	Specification
200	OK	2xx	Standard success for GET and action requests.	RFC 9110 §15.3.1
201	Created	2xx	New resource successfully created (POST/PUT).	RFC 9110 §15.3.2
204	No Content	2xx	Request succeeded; no body returned (DELETE).	RFC 9110 §15.3.5
301	Moved Permanently	3xx	Permanent URL change; transfers SEO signals.	RFC 9110 §15.4.2
304	Not Modified	3xx	Cached representation is still fresh (ETag match).	RFC 9110 §15.4.5
307	Temporary Redirect	3xx	Temporary redirect strictly preserving HTTP method.	RFC 9110 §15.4.8
308	Permanent Redirect	3xx	Permanent redirect strictly preserving HTTP method.	RFC 9110 §15.4.9
400	Bad Request	4xx	Malformed syntax, invalid JSON, or bad headers.	RFC 9110 §15.5.1
401	Unauthorized	4xx	Missing or invalid authentication credentials.	RFC 9110 §15.5.2
403	Forbidden	4xx	Authenticated identity lacks required permissions.	RFC 9110 §15.5.4
404	Not Found	4xx	Requested resource ID or URL does not exist.	RFC 9110 §15.5.5
409	Conflict	4xx	Resource state conflict (e.g. duplicate email).	RFC 9110 §15.5.10
410	Gone	4xx	Resource permanently purged; de-index immediately.	RFC 9110 §15.5.11
422	Unprocessable Content	4xx	Valid JSON syntax but fails field validation rules.	RFC 9110 §15.5.21
429	Too Many Requests	4xx	Client exceeded rate limits (check Retry-After).	RFC 6585 §4
500	Internal Server Error	5xx	Unhandled server exception or runtime crash.	RFC 9110 §15.6.1
502	Bad Gateway	5xx	Reverse proxy received invalid upstream response.	RFC 9110 §15.6.3
503	Service Unavailable	5xx	Temporary server overload or scheduled maintenance.	RFC 9110 §15.6.4
504	Gateway Timeout	5xx	Reverse proxy timed out waiting for upstream backend.	RFC 9110 §15.6.5

HTTP Status Codes for REST APIs

Designing clean, predictable REST APIs requires using the right status code for every endpoint scenario. Adhering to standards ensures API SDKs, API gateways, and frontend interceptors handle responses correctly.

API Scenario	Recommended Code	Standard Name	API Design Rationale
Resource successfully created via POST	201	Created	Signals new entity creation. Include Location: /items/123 header.
Long-running async job queued	202	Accepted	Signals request was queued. Return job status polling URL.
Resource deleted via DELETE	204	No Content	Confirm deletion without sending unnecessary payload bytes.
Malformed JSON syntax or missing headers	400	Bad Request	Request syntax cannot be parsed by the server.
Missing or invalid Bearer token / API key	401	Unauthorized	User must authenticate. Include WWW-Authenticate header.
User logged in but lacks RBAC permissions	403	Forbidden	Authenticated user is not authorized to perform action.
Item ID not found in database	404	Not Found	Target entity does not exist.
Duplicate unique key (e.g. email exists)	409	Conflict	Request conflicts with existing resource state.
Input field validation failed (valid JSON)	422	Unprocessable Content	Standard for semantic validation error responses.
Client exceeded API rate limit threshold	429	Too Many Requests	Rate limit exceeded. Include Retry-After: <seconds> header.

In-Depth Status Code Comparisons

401 Unauthorized vs. 403 ForbiddenAuth vs. Permissions

401 Unauthorized means authentication is missing or invalid (the user is anonymous or has an expired token). 403 Forbidden means the server knows who the user is, but their account role is not permitted to access the resource.

301 vs. 308 (Permanent Redirects)Method Preservation

Both signal permanent migrations. However, 301 Moved Permanently historically permitted clients to rewrite POST requests into GET requests. 308 Permanent Redirect strictly guarantees that the HTTP request method and body are preserved.

302 vs. 307 (Temporary Redirects)Temporary Routing

302 Found is standard for browser web forms where switching POST to GET (Post/Redirect/Get) is desired. 307 Temporary Redirect strictly prohibits changing the HTTP method when redirecting.

400 Bad Request vs. 422 Unprocessable ContentSyntax vs. Semantics

400 Bad Request applies when the request syntax is malformed (unparseable JSON, bad headers). 422 Unprocessable Content applies when JSON syntax is valid, but the values fail semantic validation rules.

404 Not Found vs. 410 GoneTemporary vs. Permanent

404 Not Found indicates no representation is available right now. 410 Gone indicates the resource was intentionally purged and will never return, prompting search engines to de-index immediately.

502 Bad Gateway vs. 504 Gateway TimeoutInvalid Response vs. Timeout

502 Bad Gateway occurs when a reverse proxy receives a malformed or early terminated response from an upstream backend. 504 Gateway Timeout occurs when the upstream backend takes too long to reply.

HTTP Caching Rules & Status Codes

HTTP caches (browser caches, CDNs, and forward proxies) store responses based on status code rules defined in RFC 9111:

Heuristically Cacheable

200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501 may be cached by default without explicit Cache-Control headers under heuristic freshness algorithms.

Cache Validation (304)

304 Not Modified instructs the client that its cached representation is still fresh, updating expiration headers without re-downloading response payload bytes.

Never Cached by Default

1xx, 201, 202, 302, 303, 307, 400, 401, 403, 409, 422, 429, 500, 502, 503, 504 are not stored in HTTP caches unless explicit Cache-Control headers instruct otherwise.

HTTP Retry Logic, Idempotency & Retry-After Headers

Automated client retry policies must account for HTTP method idempotency. Idempotent methods (GET, HEAD, PUT, DELETE) can safely be repeated without unintended side-effects. Non-idempotent methods (POST, PATCH) should not be retried automatically without idempotency keys (e.g. Idempotency-Key header).

Rate Limit Backoff (429):

Always inspect the Retry-After: <seconds> header before re-attempting requests.

Server Overload (503):

Implement exponential backoff with randomized jitter to prevent thundering herd problems.

SEO Implications of HTTP Status Codes

301 / 308 (Permanent)

Transfers search ranking signals (PageRank) to the target URL permanently. Search engines update their index to the new address.

302 / 307 (Temporary)

Search engines keep the original URL in the index while temporarily following the destination for user traffic.

404 vs. 410

404s require multiple crawler visits before removal. 410 Gone prompts search crawlers to remove the URL from index immediately.

503 Service Unavailable

Signals temporary downtime. Search crawlers will pause and return later without dropping indexed rankings.

Step-by-Step API Status Scenarios

Scenario A: Creating a New User Record

HTTP/1.1 201 Created
Location: /api/v1/users/42
Content-Type: application/json

{
  "id": 42,
  "username": "johndoe",
  "createdAt": "2026-08-30T12:00:00Z"
}

Why 201: Clearly communicates entity creation and provides the resource identifier in the Location header.

Scenario B: Rate Limiting an API Consumer

HTTP/1.1 429 Too Many Requests
Retry-After: 30
Content-Type: application/json

{
"error": "rate_limit_exceeded",
"message": "Rate limit of 100 req/min exceeded. Retry in 30 seconds."
}

Why 429: Informs the client of throttling and provides actionable guidance on when to resume via Retry-After.

Top Status Code Selection Mistakes

Returning 200 OK for validation failures and API errors

Returning 200 OK prevents HTTP client libraries, CDNs, and API gateways from detecting failures. Return 400 or 422 for client errors.

Using 401 when the user is logged in but lacks administrative permissions

401 means authentication is missing or invalid. If the user is authenticated but not allowed to access the resource, return 403 Forbidden.

Using 500 Internal Server Error when an upstream reverse proxy fails

If an intermediary gateway (Nginx, Cloudflare) received an invalid response from a backend, return 502 Bad Gateway. If it timed out, return 504 Gateway Timeout.

Using 302 Found when redirecting API POST requests

Many HTTP clients historically change POST to GET upon encountering 302. Use 307 Temporary Redirect or 308 Permanent Redirect to guarantee method preservation.

Frequently Asked Questions

Authoritative Standards & RFC References

IETF RFC 9110

HTTP Semantics core standard defining status code specifications.

IANA Registry

Official IANA Hypertext Transfer Protocol (HTTP) Status Code Registry.

MDN Web Docs

Mozilla Developer Network documentation and response code guides.

Browse all tools

HTTP Headers Analyzer

Analyze HTTP response headers online, audit security headers (CSP, HSTS, CORS), inspect cookies, detect information disclosure, and review caching policies.

User-Agent Parser

Parse and analyze User-Agent strings online. Identify browser, version, operating system, device, rendering engine, CPU hints, bots, and Client Hints with batch parsing and JSON/CSV export.

CORS Tester

Test CORS configuration online, diagnose browser cross-origin errors, inspect CORS headers, test preflight OPTIONS requests, and get actionable server fix recommendations.

HAR File Analyzer

Analyze HTTP Archive (HAR) files online to inspect network requests, response times, status codes, payload sizes, redirects, headers, and performance waterfalls directly in your browser.

Robots.txt Validator

Validate and test robots.txt files online. Check syntax, Allow/Disallow rules, Googlebot access, URL crawlability, sitemaps, AI crawlers, and SEO issues with exact winning-rule explanations.

OpenAPI Validator

Validate, lint, and audit OpenAPI 3.2, 3.1, 3.0 and Swagger 2.0 specifications in JSON or YAML. Detect syntax errors, broken $ref pointers, path issues, security vulnerabilities, and API design warnings in your browser.

JSON Formatter

Free online JSON formatter, beautifier, and validator. Format, indent, minify, and inspect JSON with real-time syntax error detection in your browser. 100% client-side.

HTTP Status Code Reference & Lookup

Look up HTTP status codes by number or meaning. Understand 1xx–5xx responses, common causes, API usage, retry guidance, examples, RFC references and related codes.

Category: NetworkAuthor: ToolMono Engineering TeamLast Updated: July 29, 2026Reading Time: ~5 min readStatus: stable

39 Indexed Status Codes•1xx (3)•2xx (8)•3xx (6)•4xx (12)•5xx (10)

Quick Access:

Matching Codes (39)

4044xx Client Error

Not Found

Plain-English Meaning

The server cannot find the requested resource.

When to Use

When a client requests a URL route, endpoint, or resource ID that does not exist in the system.
When hiding the existence of a sensitive resource from unprivileged users.

When NOT to Use

Do not use when a resource was permanently deleted and you wish to inform search engines it is gone forever (use 410 Gone).
Do not return 404 when an internal database query fails due to a server error (use 500 Internal Server Error).

Common Causes

Mistyped URL, deleted entity, broken link, changed API route.

Troubleshooting Steps

Check spelling of the URL path and query parameters.
Verify routing configuration in API gateways and reverse proxies.

Retryability

Usually not retryable

Do not retry unless the resource is expected to be created soon.

Cacheability

Heuristically cacheable

Can be heuristically cached if Cache-Control headers allow.

Common Methods

GET, POST, PUT, DELETE, PATCH, HEAD

Applicable request methods

Illustrative Example Response

HTTP/1.1 404 Not Found
Content-Type: application/json

{
  "error": "not_found",
  "message": "User with ID 9999 was not found"
}

Related:Confused with:

RFC 9110 §15.5.5 MDN Docs

Complementary Workflows:

URL Parser•URL Encoder•HAR Sanitizer•JWT Decoder

How to Use

Use the search bar to search by status code number (e.g. 404, 502), name (e.g. 'Not Found'), or problem keyword (e.g. 'rate limit', 'gateway timeout').

Click any quick-access button (e.g. 200, 201, 301, 401, 403, 404, 429, 500, 502, 504) to immediately open its detailed specification card.

Filter by status class tabs (1xx Informational, 2xx Success, 3xx Redirection, 4xx Client Error, 5xx Server Error).

Switch to the 'Which Status Code Should I Use?' tab to select your developer scenario (e.g. 'Resource created', 'Validation failed', 'Rate limited') and obtain recommended status codes.

Open the 'Compare Codes' tab to view side-by-side diffs (e.g. 401 vs 403, 301 vs 302, 502 vs 504) comparing usage, causes, and RFC definitions.

Export structured status documentation to JSON or download the full reference dataset as a CSV spreadsheet.

What Are HTTP Status Codes?

How to Use the HTTP Status Code Reference & Lookup

Step 01

Use the search bar to search by status code number (e.g. 404, 502), name (e.g. 'Not Found'), or problem keyword (e.g. 'rate limit', 'gateway timeout').

Step 02

Click any quick-access button (e.g. 200, 201, 301, 401, 403, 404, 429, 500, 502, 504) to immediately open its detailed specification card.

Step 03

Filter by status class tabs (1xx Informational, 2xx Success, 3xx Redirection, 4xx Client Error, 5xx Server Error).

Step 04

Switch to the 'Which Status Code Should I Use?' tab to select your developer scenario (e.g. 'Resource created', 'Validation failed', 'Rate limited') and obtain recommended status codes.

Step 05

Open the 'Compare Codes' tab to view side-by-side diffs (e.g. 401 vs 403, 301 vs 302, 502 vs 504) comparing usage, causes, and RFC definitions.

Step 06

Export structured status documentation to JSON or download the full reference dataset as a CSV spreadsheet.

HTTP Status Code Classes (1xx–5xx)

1xxInformational

Provisional responses indicating that the request was received and processing continues. 1xx responses never contain a message body (e.g. 100 Continue, 101 Switching Protocols, 103 Early Hints).

2xxSuccess

Indicates that the client's request was successfully received, understood, and accepted (e.g. 200 OK, 201 Created, 204 No Content, 206 Partial Content).

3xxRedirection

Indicates that further action needs to be taken by the user agent to complete the request (e.g. 301 Moved Permanently, 304 Not Modified, 307 Temporary Redirect, 308 Permanent Redirect).

4xxClient Error

Indicates that the client seems to have erred (e.g. malformed syntax, missing authorization, forbidden permissions, or rate limits: 400, 401, 403, 404, 422, 429).

5xxServer Error

Indicates that the origin server or intermediate proxy failed to fulfill an apparently valid request due to an internal crash, upstream gateway issue, or maintenance outage (e.g. 500, 502, 503, 504).

Quick HTTP Status Code Cheat Sheet

Code	Status Name	Class	Plain-English Meaning	Specification
200	OK	2xx	Standard success for GET and action requests.	RFC 9110 §15.3.1
201	Created	2xx	New resource successfully created (POST/PUT).	RFC 9110 §15.3.2
204	No Content	2xx	Request succeeded; no body returned (DELETE).	RFC 9110 §15.3.5
301	Moved Permanently	3xx	Permanent URL change; transfers SEO signals.	RFC 9110 §15.4.2
304	Not Modified	3xx	Cached representation is still fresh (ETag match).	RFC 9110 §15.4.5
307	Temporary Redirect	3xx	Temporary redirect strictly preserving HTTP method.	RFC 9110 §15.4.8
308	Permanent Redirect	3xx	Permanent redirect strictly preserving HTTP method.	RFC 9110 §15.4.9
400	Bad Request	4xx	Malformed syntax, invalid JSON, or bad headers.	RFC 9110 §15.5.1
401	Unauthorized	4xx	Missing or invalid authentication credentials.	RFC 9110 §15.5.2
403	Forbidden	4xx	Authenticated identity lacks required permissions.	RFC 9110 §15.5.4
404	Not Found	4xx	Requested resource ID or URL does not exist.	RFC 9110 §15.5.5
409	Conflict	4xx	Resource state conflict (e.g. duplicate email).	RFC 9110 §15.5.10
410	Gone	4xx	Resource permanently purged; de-index immediately.	RFC 9110 §15.5.11
422	Unprocessable Content	4xx	Valid JSON syntax but fails field validation rules.	RFC 9110 §15.5.21
429	Too Many Requests	4xx	Client exceeded rate limits (check Retry-After).	RFC 6585 §4
500	Internal Server Error	5xx	Unhandled server exception or runtime crash.	RFC 9110 §15.6.1
502	Bad Gateway	5xx	Reverse proxy received invalid upstream response.	RFC 9110 §15.6.3
503	Service Unavailable	5xx	Temporary server overload or scheduled maintenance.	RFC 9110 §15.6.4
504	Gateway Timeout	5xx	Reverse proxy timed out waiting for upstream backend.	RFC 9110 §15.6.5

HTTP Status Codes for REST APIs

API Scenario	Recommended Code	Standard Name	API Design Rationale
Resource successfully created via POST	201	Created	Signals new entity creation. Include Location: /items/123 header.
Long-running async job queued	202	Accepted	Signals request was queued. Return job status polling URL.
Resource deleted via DELETE	204	No Content	Confirm deletion without sending unnecessary payload bytes.
Malformed JSON syntax or missing headers	400	Bad Request	Request syntax cannot be parsed by the server.
Missing or invalid Bearer token / API key	401	Unauthorized	User must authenticate. Include WWW-Authenticate header.
User logged in but lacks RBAC permissions	403	Forbidden	Authenticated user is not authorized to perform action.
Item ID not found in database	404	Not Found	Target entity does not exist.
Duplicate unique key (e.g. email exists)	409	Conflict	Request conflicts with existing resource state.
Input field validation failed (valid JSON)	422	Unprocessable Content	Standard for semantic validation error responses.
Client exceeded API rate limit threshold	429	Too Many Requests	Rate limit exceeded. Include Retry-After: <seconds> header.

In-Depth Status Code Comparisons

401 Unauthorized vs. 403 ForbiddenAuth vs. Permissions

301 vs. 308 (Permanent Redirects)Method Preservation

302 vs. 307 (Temporary Redirects)Temporary Routing

302 Found is standard for browser web forms where switching POST to GET (Post/Redirect/Get) is desired. 307 Temporary Redirect strictly prohibits changing the HTTP method when redirecting.

400 Bad Request vs. 422 Unprocessable ContentSyntax vs. Semantics

404 Not Found vs. 410 GoneTemporary vs. Permanent

502 Bad Gateway vs. 504 Gateway TimeoutInvalid Response vs. Timeout

HTTP Caching Rules & Status Codes

HTTP caches (browser caches, CDNs, and forward proxies) store responses based on status code rules defined in RFC 9111:

Heuristically Cacheable

200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501 may be cached by default without explicit Cache-Control headers under heuristic freshness algorithms.

Cache Validation (304)

304 Not Modified instructs the client that its cached representation is still fresh, updating expiration headers without re-downloading response payload bytes.

Never Cached by Default

1xx, 201, 202, 302, 303, 307, 400, 401, 403, 409, 422, 429, 500, 502, 503, 504 are not stored in HTTP caches unless explicit Cache-Control headers instruct otherwise.

HTTP Retry Logic, Idempotency & Retry-After Headers

Rate Limit Backoff (429):

Always inspect the Retry-After: <seconds> header before re-attempting requests.

Server Overload (503):

Implement exponential backoff with randomized jitter to prevent thundering herd problems.

SEO Implications of HTTP Status Codes

301 / 308 (Permanent)

Transfers search ranking signals (PageRank) to the target URL permanently. Search engines update their index to the new address.

302 / 307 (Temporary)

Search engines keep the original URL in the index while temporarily following the destination for user traffic.

404 vs. 410

404s require multiple crawler visits before removal. 410 Gone prompts search crawlers to remove the URL from index immediately.

503 Service Unavailable

Signals temporary downtime. Search crawlers will pause and return later without dropping indexed rankings.

Step-by-Step API Status Scenarios

Scenario A: Creating a New User Record

HTTP/1.1 201 Created
Location: /api/v1/users/42
Content-Type: application/json

{
  "id": 42,
  "username": "johndoe",
  "createdAt": "2026-08-30T12:00:00Z"
}

Why 201: Clearly communicates entity creation and provides the resource identifier in the Location header.

Scenario B: Rate Limiting an API Consumer

HTTP/1.1 429 Too Many Requests
Retry-After: 30
Content-Type: application/json

{
"error": "rate_limit_exceeded",
"message": "Rate limit of 100 req/min exceeded. Retry in 30 seconds."
}

Why 429: Informs the client of throttling and provides actionable guidance on when to resume via Retry-After.

Top Status Code Selection Mistakes

Returning 200 OK for validation failures and API errors

Returning 200 OK prevents HTTP client libraries, CDNs, and API gateways from detecting failures. Return 400 or 422 for client errors.

Using 401 when the user is logged in but lacks administrative permissions

401 means authentication is missing or invalid. If the user is authenticated but not allowed to access the resource, return 403 Forbidden.

Using 500 Internal Server Error when an upstream reverse proxy fails

If an intermediary gateway (Nginx, Cloudflare) received an invalid response from a backend, return 502 Bad Gateway. If it timed out, return 504 Gateway Timeout.

Using 302 Found when redirecting API POST requests

Many HTTP clients historically change POST to GET upon encountering 302. Use 307 Temporary Redirect or 308 Permanent Redirect to guarantee method preservation.

Frequently Asked Questions

Authoritative Standards & RFC References

IETF RFC 9110

HTTP Semantics core standard defining status code specifications.

IANA Registry

Official IANA Hypertext Transfer Protocol (HTTP) Status Code Registry.

MDN Web Docs

Mozilla Developer Network documentation and response code guides.

Browse all tools

HTTP Headers Analyzer

Analyze HTTP response headers online, audit security headers (CSP, HSTS, CORS), inspect cookies, detect information disclosure, and review caching policies.

User-Agent Parser

Parse and analyze User-Agent strings online. Identify browser, version, operating system, device, rendering engine, CPU hints, bots, and Client Hints with batch parsing and JSON/CSV export.

CORS Tester

Test CORS configuration online, diagnose browser cross-origin errors, inspect CORS headers, test preflight OPTIONS requests, and get actionable server fix recommendations.

HAR File Analyzer

Analyze HTTP Archive (HAR) files online to inspect network requests, response times, status codes, payload sizes, redirects, headers, and performance waterfalls directly in your browser.

Robots.txt Validator

Validate and test robots.txt files online. Check syntax, Allow/Disallow rules, Googlebot access, URL crawlability, sitemaps, AI crawlers, and SEO issues with exact winning-rule explanations.

OpenAPI Validator

JSON Formatter

Free online JSON formatter, beautifier, and validator. Format, indent, minify, and inspect JSON with real-time syntax error detection in your browser. 100% client-side.

Not Found

How to Use

What Are HTTP Status Codes?

How to Use the HTTP Status Code Reference & Lookup

HTTP Status Code Classes (1xx–5xx)

Quick HTTP Status Code Cheat Sheet

HTTP Status Codes for REST APIs

In-Depth Status Code Comparisons

401 Unauthorized vs. 403 ForbiddenAuth vs. Permissions

301 vs. 308 (Permanent Redirects)Method Preservation

302 vs. 307 (Temporary Redirects)Temporary Routing

400 Bad Request vs. 422 Unprocessable ContentSyntax vs. Semantics

404 Not Found vs. 410 GoneTemporary vs. Permanent

502 Bad Gateway vs. 504 Gateway TimeoutInvalid Response vs. Timeout

HTTP Caching Rules & Status Codes

HTTP Retry Logic, Idempotency & Retry-After Headers

SEO Implications of HTTP Status Codes

Step-by-Step API Status Scenarios

Top Status Code Selection Mistakes

Frequently Asked Questions

Authoritative Standards & RFC References

Related ToolMono Developer Tools

Related Tools

User-Agent Parser & Analyzer

Robots.txt Validator & Tester

HAR File Analyzer

CORS Tester & Debugger

HTTP Headers Analyzer

OpenAPI Validator Online

Related Tools

Not Found

How to Use

What Are HTTP Status Codes?

How to Use the HTTP Status Code Reference & Lookup

HTTP Status Code Classes (1xx–5xx)

Quick HTTP Status Code Cheat Sheet

HTTP Status Codes for REST APIs

In-Depth Status Code Comparisons

401 Unauthorized vs. 403 ForbiddenAuth vs. Permissions

301 vs. 308 (Permanent Redirects)Method Preservation

302 vs. 307 (Temporary Redirects)Temporary Routing

400 Bad Request vs. 422 Unprocessable ContentSyntax vs. Semantics

404 Not Found vs. 410 GoneTemporary vs. Permanent

502 Bad Gateway vs. 504 Gateway TimeoutInvalid Response vs. Timeout

HTTP Caching Rules & Status Codes

HTTP Retry Logic, Idempotency & Retry-After Headers

SEO Implications of HTTP Status Codes

Step-by-Step API Status Scenarios

Top Status Code Selection Mistakes

Frequently Asked Questions

Authoritative Standards & RFC References

Related ToolMono Developer Tools

Related Tools

User-Agent Parser & Analyzer

Robots.txt Validator & Tester

HAR File Analyzer

CORS Tester & Debugger

HTTP Headers Analyzer

OpenAPI Validator Online

Related Tools