Glossary
HTTP Status Codes
Three-digit codes returned by HTTP servers to indicate the outcome of a client request. The first digit defines the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. Status codes are defined in RFC 9110.
HTTP status codes are three-digit integers returned in every HTTP response to indicate the outcome of the request. The first digit defines the response class; the remaining two provide more specificity. Defined in RFC 9110 (HTTP Semantics), status codes are the primary mechanism for communicating success, failure, or redirection between HTTP clients and servers.
Five Classes
| Range | Class | Description |
|---|---|---|
| 1xx | Informational | Request received, processing continues |
| 2xx | Success | Request received, understood, and accepted |
| 3xx | Redirection | Further action needed to complete request |
| 4xx | Client Error | Request contains bad syntax or cannot be fulfilled |
| 5xx | Server Error | Server failed to fulfill a valid request |
Most Common Codes
| Code | Name | When Used |
|---|---|---|
| 200 | OK | Successful GET, PUT, PATCH |
| 201 | Created | Resource created via POST |
| 204 | No Content | Successful DELETE or PUT with no response body |
| 301 | Moved Permanently | Permanent redirect (preserves SEO equity) |
| 304 | Not Modified | Cached response is still valid (ETag match) |
| 400 | Bad Request | Invalid request syntax or parameters |
| 401 | Unauthorized | Authentication required or failed |
| 403 | Forbidden | Authenticated but lacking permission |
| 404 | Not Found | Resource does not exist |
| 409 | Conflict | State conflict (duplicate resource, version mismatch) |
| 422 | Unprocessable Entity | Valid syntax but failed business logic validation |
| 429 | Too Many Requests | Rate limit exceeded |
| 500 | Internal Server Error | Unhandled server exception |
| 502 | Bad Gateway | Upstream server returned invalid response |
| 503 | Service Unavailable | Server overloaded or under maintenance |
| 504 | Gateway Timeout | Upstream server timed out |
401 vs 403
- 401 Unauthorized: the client is not authenticated. The response should include a
WWW-Authenticateheader. - 403 Forbidden: the client is authenticated but lacks permission to access the resource.
REST API Best Practices
POST /users → 201 Created (with Location header)
GET /users/123 → 200 OK
GET /users/999 → 404 Not Found
DELETE /users/123 → 204 No Content
PUT /users/123 (validation fails) → 422 Unprocessable Entity
POST /auth/login (wrong password) → 401 Unauthorized
GET /admin (user is not admin) → 403 Forbidden
Look up any HTTP status code with the HTTP Status Code Reference Tool.