HTTP Status Codes

The server received the request headers and the client may send the body.

The server accepts the client's request to change protocol, usually to WebSocket.

Sends preliminary headers so the browser can preload resources before the final response.

The request succeeded and the response contains the result.

A new resource was created. Include its URL in the Location header.

The request was accepted for processing but is not finished yet.

The request succeeded and there is no body to return, common for DELETE.

Returns part of a resource, used for range requests and media streaming.

A WebDAV response carrying separate statuses for multiple operations.

The server applied delta encoding to the representation, per RFC 3229.

Several representations exist; the client or user must choose one.

The resource has a new permanent URL. Search engines transfer signals to it.

Temporary redirect. Keep the original URL for future requests.

Redirect the client to another URL with a GET, often after a POST.

The cached copy is still valid, so the client reuses it.

Like 302, but the HTTP method must not change.

Like 301, but the method and body are preserved.

The request is malformed or fails validation. Explain the error in the body.

Authentication is missing or invalid — the server does not know who you are.

Reserved for paid access. Rare, but useful for API quotas and billing walls.

The server knows the client but refuses access. Re-authenticating will not help.

No resource matches the URL. Also used to hide private resources.

The URL exists but does not support this HTTP method. Send an Allow header.

No representation matches the client's Accept headers.

The client must authenticate with the proxy before proceeding.

The server timed out waiting for the request. The client may retry.

The request conflicts with current state, such as a duplicate or stale version.

The resource existed but was permanently removed. Stronger than 404.

The request must include a Content-Length header.

A conditional header such as If-Match evaluated to false.

The request body exceeds the server's limit. Raise it or stream the upload.

The URL is longer than the server accepts. Move data to the body.

The payload format is not supported. Check the Content-Type header.

The requested byte range cannot be served. Send Content-Range.

The server cannot meet the Expect request header.

An April Fools' RFC. Some APIs use it as a playful custom error.

The request reached a server that cannot answer for this host.

The syntax is valid but the content fails semantic validation.

The resource is locked by another operation, common in WebDAV.

The request failed because an earlier dependent request failed.

The server refuses to process a request that may be replayed (TLS early data).

The client must switch to a different protocol, such as TLS or HTTP/2.

The server requires a conditional request to avoid lost updates.

Rate limit exceeded. Send Retry-After and document the quota.

Request headers exceed the server limit. Cookies are a common cause.

Blocked for legal reasons, such as censorship or a court order.

An unexpected server failure. Log it, but do not leak details to clients.

The server does not support the requested functionality or method.

A proxy received an invalid response from an upstream server.

The server is overloaded or in maintenance. Send Retry-After.

A proxy did not receive a timely response from an upstream server.

The server does not support the HTTP version used in the request.

The server cannot store the representation. Common in WebDAV.

The server detected an infinite loop while processing the request.

The request needs further extensions for the server to fulfil it.

The client must authenticate to get network access, as in a captive portal.