← Back to Toolbox
HTTP Status Codes
Updated October 2026 · Run into a weird status code while debugging an API? Check the table first
The first digit tells you the category: 1xx informational, 2xx success, 3xx redirection, 4xx the client's fault, 5xx the server's fault. When debugging, look at the group first, then the specific code.
1xx Informational
| Status code | Name | Description |
|---|
100 | Continue | The request headers have been received and the client may go ahead and send the body. Shows up on large uploads with Expect: 100-continue. |
101 | Switching Protocols | The protocol switch succeeded — most commonly an HTTP upgrade to WebSocket. |
103 | Early Hints | The main response isn't ready yet, but the server tells the browser which CSS/JS to preload, speeding up first paint. |
2xx Success
| Status code | Name | Description |
|---|
200 | OK | The request succeeded — the most common status code. Note: 200 only means success at the HTTP layer; check the body's code field for business-level errors. |
201 | Created | A new resource was created — the standard response for POST endpoints that create something. |
202 | Accepted | Accepted but not yet processed — common for async jobs (exports, transcoding). |
204 | No Content | Succeeded with no response body — common for DELETE endpoints. Returning 204 with a body is non-standard. |
206 | Partial Content | A range request succeeded — resumable downloads and video seek bars rely on it. |
3xx Redirection
| Status code | Name | Description |
|---|
301 | Moved Permanently | Permanent redirect — browsers cache it and search engines transfer ranking. Use it for domain changes and HTTP→HTTPS. |
302 | Found | Temporary redirect. Watch out: most browsers rewrite the redirected POST into a GET. |
304 | Not Modified | The cache is still fresh, so the server sent no body. When an API "doesn't update" while debugging, suspect this first — clear the cache or hard-refresh to verify. |
307 | Temporary Redirect | Temporary redirect that does not change the request method or body — a POST stays a POST. |
308 | Permanent Redirect | Permanent redirect that likewise preserves the method — the strict version of 301. |
4xx Client Errors
| Status code | Name | Description |
|---|
400 | Bad Request | The request itself is broken: missing parameters, malformed JSON, etc. First reaction: check the parameters you sent. |
401 | Unauthorized | Not authenticated: not logged in, token missing or expired. Despite the name, it really means "identity not yet verified". |
403 | Forbidden | Authenticated but not allowed. The difference from 401: 401 asks "who are you?", 403 says "we know who you are — and no". |
404 | Not Found | The resource doesn't exist: wrong path, nonexistent id, or an unregistered route. Check the URL spelling and environment domain first. |
405 | Method Not Allowed | The path is right but the method is wrong — e.g. POSTing to a read-only endpoint. |
408 | Request Timeout | The client sent the request too slowly and the server timed out waiting. Common on large uploads over weak networks. |
409 | Conflict | State conflict: creating a unique resource twice, or a version clash (optimistic-lock failure). |
410 | Gone | The resource existed and has been permanently deleted — more explicit than 404, and used a lot in SEO. |
413 | Payload Too Large | The request body is too big. For uploads, check Nginx's client_max_body_size and gateway limits first. |
422 | Unprocessable Entity | Well-formed but semantically wrong — form validation failures often use it to return field-level errors. |
429 | Too Many Requests | You're being rate-limited. Check the Retry-After response header and retry with backoff — don't hammer the endpoint. |
5xx Server Errors
| Status code | Name | Description |
|---|
500 | Internal Server Error | The server code threw an exception. Front end: stop guessing and go read the server-side log stack trace. |
501 | Not Implemented | The feature isn't implemented — e.g. you used a method the server doesn't support. |
502 | Bad Gateway | The gateway/reverse proxy got no sane response from upstream: the upstream is down, the port is wrong, or the process crashed. Check whether the backend process is alive first. |
503 | Service Unavailable | Temporarily unavailable: restarting, shedding load, or under maintenance. Usually transient — retry in a bit. |
504 | Gateway Timeout | The gateway waited too long for upstream: it's up, just slow. Versus 502: 502 means "answered wrong / not at all", 504 means "took too long". |
Debugging Rules of Thumb
For 4xx, check yourself first: parameters, token, URL, method — it's the front end or the caller nine times out of ten.
For 5xx, check the chain: 502 → the upstream process, 504 → slow endpoints / slow SQL, 500 → the application logs.
If an API is "flaky", think 429 (rate limiting) and 503 (instances being drained / a deploy in progress) first.