HTTP Status Codes Explained, from 100 to 511
Every HTTP response starts with a three-digit number that tells the client how the request went. This searchable list of HTTP status codes covers the 61 registered codes you are likely to meet, from 100 Continue to 511 Network Authentication Required, each with a short note on when a server actually sends it. Type a number, part of a name such as "gateway", or a class like 4xx, and the list narrows as you type.
What are HTTP status codes?
A status code is the server's one-word verdict on your request. The first digit sets the class, so even an unfamiliar code tells you where to look:
| Class | Meaning | Typical examples |
|---|---|---|
| 1xx | Informational, the request is still in progress | 100 Continue, 101 Switching Protocols, 103 Early Hints |
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirection, look elsewhere | 301, 302, 304 Not Modified, 308 |
| 4xx | Client error, fix the request | 400, 401, 403, 404, 429 |
| 5xx | Server error, the request may be fine | 500, 502, 503, 504 |
The reason phrase ("Not Found") is only a hint for humans. Clients must act on the number, and HTTP/2 and HTTP/3 do not send the phrase at all, so never match on the text in your code.
Example search
Searching for 429 returns a single entry with its class and meaning:
429 Too Many Requests [Client error]
Rate limit exceeded. Retry-After says how long to wait.Keyword searches match the explanations too, so redirect or cache finds codes whose names do not contain the word. Clicking a code copies it with its name, which is handy for bug reports, test assertions and API documentation.
Status codes that are easy to confuse
- 401 vs 403. 401 Unauthorized really means "unauthenticated": the client should send credentials, and the response should carry a
WWW-Authenticateheader. 403 Forbidden means the server knows who you are and still refuses, so logging in again will not help. - 301/302 vs 308/307. Older clients may turn a POST into a GET when following 301 or 302. 307 (temporary) and 308 (permanent) require the method and body to be kept, which is what you want for API redirects.
- 302 vs 303. 303 See Other tells the browser to fetch the new URL with GET. It is the standard answer after a form POST (the Post/Redirect/Get pattern).
- 400 vs 422. Use 400 when the request cannot be parsed, such as malformed JSON. Use 422 when the syntax is fine but a value fails validation.
- 404 vs 410. 410 Gone says the resource was removed on purpose and will not return, which search engines treat as a stronger signal than 404.
- 502 vs 503 vs 504. These usually come from a proxy or load balancer. 502 means the upstream sent an invalid response or refused the connection, 503 means the service is overloaded or in maintenance, and 504 means the upstream did not answer in time.
Choosing status codes for a REST API
Keep the set small and predictable. Return 200 for a successful read, 201 Created with a Location header when a POST creates something, and 204 No Content when a DELETE or PUT has nothing to return. Use 409 Conflict for duplicate keys or version clashes, and 429 with Retry-After for rate limits.
Pair every 4xx and 5xx with a machine-readable body. The application/problem+json format from RFC 9457 is a good default; you can confirm its media type in the MIME type lookup. To see which codes your endpoints really return, send requests from the API tester, and use the URL parser to inspect the Location URLs your redirects point to.
Unusual codes you may run into
103 Early Hints lets a server send Link preload headers before the final response. 421 Misdirected Request appears when an HTTP/2 connection is reused for a host it cannot serve. 425 Too Early protects against replayed TLS early data, and 451 Unavailable For Legal Reasons signals a legal block. 418 I'm a teapot started as an April Fools' joke and is reserved so it is never assigned a real meaning.
Vendor-specific codes such as nginx's 499 or Cloudflare's 520 to 527 are not in the list because they are not registered HTTP status codes. If you see one, check that vendor's documentation. The deprecated 305 Use Proxy and the reserved, unused 306 are left out as well.
Privacy
The status code table is part of the page itself, and searching runs in your browser. Nothing you type is sent to a server.