1. [Home](https://www.toolcomb.com/) 2. [Security Tools](https://www.toolcomb.com/security-tools) 3. HTTP Status Codes # HTTP Status Code Reference - Searchable 1xx–5xx Guide Searchable HTTP status code reference with names, meanings, and when to use each code. Filter 2xx, 4xx, 5xx client-side - no network, free for API design and debugging. ### Search status codes _404, unauthorized, gateway…_ All 1xx 2xx 3xx 4xx 5xx | Code | Name | Meaning | When to use | | --- | --- | --- | --- | | 100 | Continue | Initial part of request received; client may continue. | Expect: 100-continue handshakes. | | 101 | Switching Protocols | Server agrees to upgrade protocol. | WebSocket upgrade from HTTP. | | 102 | Processing | Request accepted; still processing (WebDAV). | Long WebDAV operations. | | 103 | Early Hints | Preload hints while final response prepares. | Link rel=preload before full 200. | | 200 | OK | Success; body contains requested resource. | Standard successful GET/POST/PATCH. | | 201 | Created | Resource created; Location may point to it. | POST that creates a new entity. | | 202 | Accepted | Accepted for processing but not completed. | Async job queued. | | 204 | No Content | Success with empty body. | DELETE success, PUT with no return body. | | 206 | Partial Content | Partial resource for range request. | Video streaming, resume downloads. | | 301 | Moved Permanently | Resource permanently at new URI. | SEO redirects, canonical URL changes. | | 302 | Found | Temporary redirect. | Post-login redirect (historical misuse). | | 304 | Not Modified | Cached copy still valid. | Conditional GET with If-None-Match. | | 307 | Temporary Redirect | Temporary redirect preserving method. | Maintenance page without changing POST to GET. | | 308 | Permanent Redirect | Permanent redirect preserving method. | API path migration with POST. | | 400 | Bad Request | Malformed syntax or invalid parameters. | Validation errors, bad JSON. | | 401 | Unauthorized | Authentication required or failed. | Missing/invalid Bearer token. | | 403 | Forbidden | Authenticated but not allowed. | RBAC denial, wrong tenant. | | 404 | Not Found | Resource does not exist at URI. | Unknown ID, typo in path. | | 405 | Method Not Allowed | HTTP method not supported on route. | POST on read-only endpoint. | | 408 | Request Timeout | Server timed out waiting for request. | Slow client upload. | | 409 | Conflict | Request conflicts with current state. | Duplicate unique key, version mismatch. | | 410 | Gone | Resource permanently removed. | Retired API versions. | | 413 | Payload Too Large | Request body exceeds limit. | Upload size caps. | | 415 | Unsupported Media Type | Content-Type not accepted. | POST XML to JSON-only API. | | 418 | I'm a teapot | April Fools RFC 2324 joke status. | Easter eggs, humor APIs. | | 422 | Unprocessable Entity | Semantic validation failed. | Well-formed JSON but business rules fail. | | 429 | Too Many Requests | Rate limit exceeded. | API throttling, Retry-After header. | | 451 | Unavailable For Legal Reasons | Blocked for legal compliance. | Geo/legal content blocks. | | 500 | Internal Server Error | Unexpected server failure. | Uncaught exceptions, DB down. | | 501 | Not Implemented | Feature not supported. | Unimplemented HTTP method on server. | | 502 | Bad Gateway | Invalid response from upstream. | Proxy cannot reach app server. | | 503 | Service Unavailable | Server temporarily overloaded or down. | Maintenance, circuit breaker open. | | 504 | Gateway Timeout | Upstream did not respond in time. | Slow microservice behind gateway. | | 507 | Insufficient Storage | Cannot store representation (WebDAV). | Quota exceeded on WebDAV. | ## What is an HTTP status code reference? HTTP status codes are three-digit numbers returned in the first line of an HTTP response. They tell clients whether a request succeeded, was redirected, failed due to client error, or failed due to server or gateway problems. REST APIs, browsers, crawlers, and CDNs all interpret these codes to decide whether to retry, cache, follow a Location header, or surface an error page to humans. The first digit defines the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. The remaining digits refine meaning - 404 Not Found is more specific than generic 400 Bad Request. Well-designed APIs pair status codes with structured problem bodies (RFC 7807 application/problem+json) so machines read the code and humans read the message. Developers constantly look up whether to return 401 vs 403, 409 vs 422, or 502 vs 504 during API design and incident response. Misused codes confuse monitoring (alerting on 404 spikes that are actually auth failures labeled wrong) and break caches (301 vs 302 SEO implications). A searchable offline reference speeds design reviews without opening multiple MDN tabs. Browsers hide most codes from users except memorable ones like 404 and 500. JavaScript fetch only rejects on network errors, not 404 - you must check response.ok or status manually. This reference helps front-end engineers map backend contracts to UI states: show login on 401, permission denied on 403, retry button on 503 with Retry-After. Proxies and load balancers inject their own codes: 502 Bad Gateway when the origin is unreachable, 504 Gateway Timeout when the origin is slow. Distinguishing them from 500 Internal Server Error narrows blame between infrastructure and application code during outages. Rate limiting standardized on 429 Too Many Requests with optional Retry-After. Idempotent GET should not change server state; POST that creates resources fits 201 Created with Location. Conditional requests use 304 Not Modified to save bandwidth - all patterns this table summarizes with practical when-to-use guidance. ToolComb’s HTTP status code reference is a client-side filter over a curated list of common codes from 1xx through 5xx. No network fetch, no account - suitable for airplane debugging and interview prep. For the complete IANA registry including unused codes, consult official documentation; for daily API work, this page covers the codes you will actually ship. GraphQL and gRPC often tunnel errors over HTTP 200 with error payloads - a pattern this HTTP-centric table does not cover. REST-first teams still rely on status codes at the transport edge even when bodies carry rich error JSON, so the reference remains relevant for API gateways terminating HTTP/1.1 or HTTP/2. Edge workers and serverless functions should return minimal bodies on 5xx to reduce cost and avoid leaking stack traces. Pair 503 with Retry-After during deployments so clients exponential-backoff instead of hammering cold starts. HTTP/3 (QUIC) carries the same semantic status codes; only the wire format changes. Your application logic mapping status to user messaging stays stable when migrating from nginx to QUIC-enabled CDNs. Caching intermediaries transform 200 responses with Cache-Control, while 404 may be cached accidentally if misconfigured - status choice affects CDN behavior as much as browser fetch. When in doubt, explicit 404 with short Cache-Control prevents poisoning shared caches with soft 404 HTML pages. Legal and compliance teams recognize 451 Unavailable For Legal Reasons for geo-blocking documentation. Engineers implement 451 sparingly with clear, non-inflammatory bodies explaining regional restriction rather than masking as generic 404 when transparency is required. Load testing tools aggregate status histograms. Naming conventions in runbooks (SLO: 99.9% 2xx excluding 404 on optional assets) start with shared vocabulary from references like this page so SRE and product mean the same thing in incident channels. Webhooks from Stripe, GitHub, and Shopify document expected status responses your endpoint must return (often 200 within timeout). Confusing 204 with 200 rarely breaks integrations, but returning 500 on validation errors triggers aggressive retries - map business validation to 400-class codes intentionally. BFF (backend-for-frontend) layers sometimes translate upstream 404 into 200 with empty arrays for nicer mobile UX while raw microservices stay REST-pure. Document those translations so operators searching this reference during incidents know the mobile app deliberately masks 404. Health check endpoints should return 200 only when dependencies are usable; returning 200 with {"status":"degraded"} confuses kube probes. Use 503 when the instance should stop receiving traffic, aligning probe behavior with load balancer removal. CORS preflight OPTIONS requests return 204 No Content on many frameworks - not listed as prominently as GET/POST statuses but visible in DevTools when debugging cross-origin API failures mistaken for auth problems. ## How to use this HTTP status code list Search by numeric code, name, or keywords like rate limit or redirect. Filter by class with category chips. 1. **Scan or search** Leave search empty to browse the full table, or type 404, unauthorized, gateway, etc. 2. **Filter by class** Click 2xx, 4xx, or 5xx to focus success, client errors, or server errors during API reviews. 3. **Read meaning and when to use** Each row includes a short definition and practical guidance for APIs and web apps. 4. **Apply in your API spec** Document chosen codes in OpenAPI responses blocks so clients and QA share expectations. 5. **Align monitoring** Configure alerts on 5xx rate and 429 spikes; treat expected 404 on optional resources differently from accidental 404 on core routes. ## Example: 401 vs 403 ### Before Your mobile app receives HTTP 403 when the access token expired. ### After Use 401 Unauthorized when valid credentials are missing or invalid. A 403 Forbidden response means the server refuses the request; insufficient permission is one possible reason. Consistent semantics help clients show the correct UX and reduce false security escalations. ## When to use an HTTP status code cheat sheet ### 1. REST API design Pick 201 + Location for creates, 204 for deletes, 409 for version conflicts. ### 2. Frontend error handling Map status to toast messages, retry logic, and login redirects. ### 3. Incident response Tell 502/504 gateway issues from application 500 stack traces. ### 4. SEO and redirects Choose 301 vs 308 for permanent URL moves with method preservation. ### 5. Caching Use 304 with ETag/Last-Modified to validate CDN caches. ### 6. Technical interviews Quickly recall names and classes for system design discussions. ### 7. Webhook retry policy design Document which 4xx responses stop retries versus which 5xx responses trigger exponential backoff so integrators do not hammer your API after a permanent 400 validation failure mislabeled as 500. ### 8. CDN cache purge playbooks Operators distinguish 404 after purge from origin 502 during purge propagation, choosing whether to re-fetch or wait for edge TTL when customers report missing assets. ### 9. Mobile offline UX copy Frontend writers map 401/403/503 to distinct user strings; reference table aligns copywriters with engineers on when to show login versus try again later. ## Status code vs response body vs headers Codes summarize outcome; bodies carry details; headers carry metadata. | Layer | Carries | Example | | --- | --- | --- | | Status line | Outcome class | 404 Not Found | | Headers | Metadata | Retry-After: 60 | | Body | Details | application/problem+json | | Client logic | Behavior | Retry on 503 if idempotent | Always document both status code and response body schema in OpenAPI or protobuf comments. Clients should branch on code first for control flow, then parse body for human messages and machine-readable error codes. Headers like Retry-After, Location, and WWW-Authenticate carry equally critical semantics that status numbers alone do not express. ## Limits - Curated subset of common codes - not the complete IANA HTTP Status Code Registry including deprecated or unused values. - WebDAV, CalDAV, and other extensions use additional codes (207 Multi-Status, 422 Unprocessable Entity overlap) documented only where commonly seen. - Humor and cultural codes like 418 I'm a teapot appear for completeness, not as production API guidance. - Does not explain HTTP/2 RST_STREAM or QUIC application error codes - only semantic HTTP status as used in response lines. - GraphQL errors-in-200-body pattern is out of scope though mentioned in prose. - Search matches substring in name and meaning fields; typos like 40four won't fuzzy-match 404. ## Privacy The status code table ships embedded in the page bundle; filtering and search run locally without sending queries to ToolComb. No record exists of which codes you searched for - suitable for offline airplane review of API design notes. Screen sharing the reference reveals only public HTTP knowledge, not your proprietary API URLs or keys. ## Frequently Asked Questions ### What are HTTP status codes? HTTP status codes are three-digit integers in the response status line (for example HTTP/1.1 404 Not Found). The first digit defines the class: informational 1xx, success 2xx, redirection 3xx, client error 4xx, server error 5xx. They let clients decide caching, retries, and user messaging without parsing the body first. ### What is the difference between 401 and 403? 401 Unauthorized indicates that valid authentication credentials are missing or invalid. 403 Forbidden means the server understood the request but refuses to fulfill it; authentication may be valid but insufficient, though a refusal does not always establish that the user is authenticated. ### When should I use 404 vs 410? 404 Not Found suggests the URI is unknown or the resource may exist elsewhere; caches may treat it cautiously. 410 Gone signals deliberate permanent removal - useful for retired API versions and deleted content that should drop out of indexes. SEO and clients interpret 410 as stronger permanence than 404. ### What does 500 Internal Server Error mean? The server encountered an unexpected failure executing the request. Log stack traces server-side; return generic messages to clients. Repeated 500 spikes warrant alerts distinct from 404 noise. Do not use 500 for validation errors clients can fix - that belongs in 400-class responses. ### What is the difference between 502 and 504? 502 Bad Gateway means an intermediary received an invalid or empty response from upstream. 504 Gateway Timeout means upstream did not respond within the proxy timeout. Both implicate infrastructure or downstream service health more often than a single line of application code throwing an exception. ### Should POST return 200 or 201? 201 Created is preferred when a new resource is created and you can provide Location or id in the body. 200 OK fits operations that succeed without creating a new URI, such as RPC-style actions. Document the choice in OpenAPI so clients know whether to expect Location headers. ### What is 429 Too Many Requests? 429 signals rate limiting or quota exhaustion. Clients should honor Retry-After when present and apply exponential backoff. APIs use 429 instead of 403 when authenticated users exceed fair use, distinguishing quota from permission denial. ### Does fetch throw on 404? No. fetch in browsers resolves the promise for 404 and 500 unless the network fails. Check response.ok or response.status explicitly. Axios throws on status >= 400 by default - know your HTTP client library semantics. ### Is this HTTP status list complete? No. It focuses on commonly deployed production codes. IANA registers additional and historical values; WebDAV adds others. Use RFC 9110 and your platform docs for exhaustive legal definitions. ### Is data loaded from the internet? No. The table is static JavaScript data filtered in your browser. Search works offline after the page loads. ### How do status codes interact with REST idempotency? PUT and DELETE should be idempotent - repeating them returns the same logical state and typically 200/204. POST creating resources returns 201 first time; repeating without idempotency keys may create duplicates regardless of status code choice. Status documents outcome, not idempotency by itself. ### When is 204 preferred over 200 with an empty body? 204 No Content explicitly disallows a response body per HTTP semantics. Some clients and caches handle 204 cleaner than 200 with Content-Length zero. DELETE and PUT updates that need no returned entity commonly use 204. ## Related tools - [URL Parser](https://www.toolcomb.com/url-parser) - Inspect paths that return 404. - [JWT Decoder](https://www.toolcomb.com/jwt-decoder) - Debug 401 responses with token claims. - [MIME Type Lookup](https://www.toolcomb.com/mime-type-lookup) - Fix 415 Unsupported Media Type. - [Hash Generator](https://www.toolcomb.com/hash-generator) - ETag generation patterns. ## Related Tools Discover more free tools that might help with your next task. [Base64 Encoder Encode and decode Base64 data Use Tool](https://www.toolcomb.com/base64-encoder) [URL Decoder Decode URL-encoded strings Use Tool](https://www.toolcomb.com/url-decoder) [HTML Encoder Encode and decode HTML entities Use Tool](https://www.toolcomb.com/html-encoder) [Hash Generator Generate MD5, SHA1, SHA256 hashes Use Tool](https://www.toolcomb.com/hash-generator) [UUID Generator Generate v1, v3, v4, and v5 UUIDs Use Tool](https://www.toolcomb.com/uuid-generator) [Password Generator Generate secure random passwords Use Tool](https://www.toolcomb.com/password-generator) ### Related guides Read the how-to, then come back to this tool when you are ready to run it locally. - [MIME Types and HTTP Status Codes - Quick Browser Reference Look up Content-Type suffixes, decode 4xx vs 5xx in logs, and parse URLs and user agents locally when debugging APIs without tab-hopping.](https://www.toolcomb.com/blog/mime-types-and-http-status-codes-quick-reference) [View All Tools](https://www.toolcomb.com/tools)