HTTP Status Code Reference
The HTTP status codes you actually run into in web development, organised by class — for API design, debugging and error handling.
What an HTTP status code is
An HTTP status code is the three-digit number a server returns to describe the outcome of a request from a client (a browser or an API client). The first digit sets the category, giving five classes from 1xx to 5xx. Returning the right code matters a great deal in RESTful API design.
1xx — Informational
The request was received and processing continues. Browsers handle these automatically, so developers rarely deal with them directly.
| Code | Name | Meaning |
|---|---|---|
100 | Continue | The first part of the request was received; the client may continue |
101 | Switching Protocols | Protocol switch accepted; used when establishing a WebSocket connection |
103 | Early Hints | A hint that lets the client start preloading resources before the final response |
2xx — Success
The request was accepted and processed. This is the class you use most in API development.
| Code | Name | Meaning | Typical use |
|---|---|---|---|
200 | OK | Request succeeded | A successful GET, PUT or PATCH |
201 | Created | Request succeeded and a new resource was created | A POST that created a resource |
202 | Accepted | Request accepted but not yet processed | Accepting an asynchronous job |
204 | No Content | Request succeeded with no content to return | A successful DELETE, or a PUT that only updates |
206 | Partial Content | Partial response to a range request | Resuming a large file download |
3xx — Redirection
Further action is needed to complete the request, usually following a redirect. These matter most for SEO and URL migrations.
| Code | Name | Meaning | Typical use |
|---|---|---|---|
301 | Moved Permanently | The resource moved permanently | URL changes and domain migrations; passes on SEO signals |
302 | Found | Temporarily redirected to another URL | A temporary move during maintenance |
303 | See Other | Fetch a different URL with GET | Redirect after a POST (the PRG pattern) |
304 | Not Modified | The resource has not changed | Uses the browser cache and saves bandwidth |
307 | Temporary Redirect | Temporary redirect that preserves the method | A temporary HTTP to HTTPS move |
308 | Permanent Redirect | Permanent redirect that preserves the method | Permanently moving an API endpoint |
4xx — Client error
The problem is on the client side — usually the request body or the credentials.
| Code | Name | Meaning | Typical use |
|---|---|---|---|
400 | Bad Request | The request syntax is invalid | Validation errors, malformed JSON |
401 | Unauthorized | Authentication required | Not signed in, or an expired token |
403 | Forbidden | No permission to access | Authenticated but not allowed to reach the resource |
404 | Not Found | The resource was not found | A URL that does not exist, or a deleted resource |
405 | Method Not Allowed | HTTP method not allowed | POSTing to a GET-only endpoint |
408 | Request Timeout | The request timed out | When the client sends data too slowly |
409 | Conflict | Resource conflict | Duplicate records, optimistic-lock collisions |
413 | Payload Too Large | The request body is too large | Exceeding the upload size limit |
415 | Unsupported Media Type | Unsupported media type | An incorrect Content-Type |
422 | Unprocessable Entity | Syntactically valid but semantically unprocessable | Validation errors (with detail) |
429 | Too Many Requests | Rate limit exceeded | API call quotas |
5xx — Server error
Processing failed on the server — usually a configuration mistake or an application bug.
| Code | Name | Meaning | Typical use |
|---|---|---|---|
500 | Internal Server Error | Internal server error | Unhandled exceptions, application bugs |
501 | Not Implemented | The server does not support the feature | An API endpoint that is not implemented yet |
502 | Bad Gateway | The gateway received an invalid response | The upstream server behind a reverse proxy is unreachable |
503 | Service Unavailable | Service unavailable | Under maintenance or overloaded |
504 | Gateway Timeout | Gateway timeout | The upstream server did not answer in time |
Frequently asked questions
What is the difference between 401 and 403?
401 Unauthorized means authentication is required and prompts the client to sign in or present a token. 403 Forbidden means the client is authenticated but lacks permission for the resource. A regular user hitting an admin-only page should get a 403.
What is the difference between 301 and 308?
Both are permanent redirects, but with 301 the HTTP method may be rewritten to GET along the way. 308 forwards the request with its method intact. Use 308 when a POST must stay a POST at the redirect target.
What should I do about a 413?
When an upload returns 413 Payload Too Large, check the limits at every layer: the web server (Nginx client_max_body_size, Apache LimitRequestBody) and PHP (upload_max_filesize, post_max_size). DevLab's threshold test files let you confirm the effective limit.