APIs
HTTP Status Code Reference
Every HTTP status code a web developer meets, with what it means, when to send it and the usual cause when you receive it.
Free · No sign-up · Your inputs stay in your browser
Reference
Look up an HTTP status code
| Code | Name | What it means |
|---|---|---|
| 100 | Continue | The server got the request headers; the client may send the body. Seen with Expect: 100-continue on large uploads. |
| 101 | Switching Protocols | The server agreed to the Upgrade header, most often to switch the connection to WebSocket. |
| 103 | Early Hints | Preload and preconnect hints sent before the final response, so the browser can start fetching assets early (RFC 8297). |
| 200 | OK | Success. The body holds the result. |
| 201 | Created | A resource was created. The Location header should point at it. The right answer to a successful POST that creates something. |
| 202 | Accepted | Accepted for processing, not finished. Typical when a request queues a job. |
| 204 | No Content | Success with no body. Common for DELETE and for PUT that returns nothing. |
| 206 | Partial Content | The body is the byte range the client asked for with a Range header: video seeking and resumable downloads. |
| 301 | Moved Permanently | Permanent redirect. Clients may change a POST to GET when following it; use 308 to forbid that. |
| 302 | Found | Temporary redirect. Clients may change a POST to GET; use 307 to forbid that. |
| 303 | See Other | Fetch another URL with GET. The redirect to send after a form POST succeeds. |
| 304 | Not Modified | The cached copy is still valid (If-None-Match or If-Modified-Since matched). No body is sent. |
| 307 | Temporary Redirect | Temporary redirect that keeps the method and body. |
| 308 | Permanent Redirect | Permanent redirect that keeps the method and body. |
| 400 | Bad Request | The request is malformed: invalid JSON, a bad header, a parameter the server cannot parse. |
| 401 | Unauthorized | Not authenticated. Despite the name, it means "who are you?". The response must carry a WWW-Authenticate header. |
| 403 | Forbidden | Authenticated, or not required, but not allowed. Logging in again will not help. |
| 404 | Not Found | Nothing at this URL. Also used to hide a resource the client may not know exists. |
| 405 | Method Not Allowed | The URL exists but not for this method. The response must list the allowed ones in an Allow header. |
| 406 | Not Acceptable | The server cannot produce a format the Accept headers ask for. |
| 408 | Request Timeout | The client took too long to send the request. |
| 409 | Conflict | The request conflicts with the current state: a duplicate unique key, or an edit to a stale version. |
| 410 | Gone | The resource existed and was removed on purpose, permanently. Search engines drop it faster than a 404. |
| 411 | Length Required | The server needs a Content-Length header. |
| 412 | Precondition Failed | An If-Match or If-Unmodified-Since condition was false. The basis of optimistic locking over HTTP. |
| 413 | Content Too Large | The body is bigger than the server accepts. In Nginx, raise client_max_body_size; in PHP, post_max_size and upload_max_filesize. |
| 414 | URI Too Long | The URL is longer than the server will parse. Move the data into a POST body. |
| 415 | Unsupported Media Type | The Content-Type of the body is not one the endpoint accepts. |
| 416 | Range Not Satisfiable | The requested byte range lies outside the resource. |
| 418 | I'm a teapot | An April Fools' joke from RFC 2324. Not a real error; RFC 9110 reserves the code so nothing else takes it. |
| 422 | Unprocessable Content | Well-formed but semantically invalid. What Laravel returns for a failed validation. |
| 425 | Too Early | The server will not process a request that might be replayed (TLS 1.3 early data, RFC 8470). |
| 426 | Upgrade Required | The client must switch to another protocol, named in the Upgrade header. |
| 428 | Precondition Required | The server requires a conditional request, to prevent lost updates (RFC 6585). |
| 429 | Too Many Requests | Rate limited. A Retry-After header says how long to wait (RFC 6585). |
| 431 | Request Header Fields Too Large | Headers are too big, often because of oversized cookies (RFC 6585). |
| 451 | Unavailable For Legal Reasons | Blocked for a legal reason such as a court order (RFC 7725). |
| 500 | Internal Server Error | An unhandled exception on the server. Check the application log, not the web server's. |
| 501 | Not Implemented | The server does not support the method at all. |
| 502 | Bad Gateway | A proxy got an invalid response from upstream. With Nginx, usually PHP-FPM or Node is down or crashed mid-request. |
| 503 | Service Unavailable | Temporarily overloaded or in maintenance. Retry-After may say when to come back. |
| 504 | Gateway Timeout | A proxy gave up waiting for upstream. With Nginx, the app took longer than proxy_read_timeout or fastcgi_read_timeout. |
| 505 | HTTP Version Not Supported | The server refuses the HTTP version the request used. |
Names and meanings follow RFC 9110 unless another RFC is named.
About this tool
Method, assumptions, practical next steps, and limits.
The five classes
1xx is informational, 2xx success, 3xx redirection, 4xx a problem with the request and 5xx a problem on the server. A client that does not recognise a code treats it as the x00 of its class.
Codes that are often confused
401 means "not authenticated" and 403 means "authenticated but not allowed". 301 and 302 let clients turn a POST into a GET; 308 and 307 forbid it. 502 means the upstream answered badly, 504 that it did not answer in time.
The source
Names and meanings follow RFC 9110 section 15, which replaced the older RFC 7231 in 2022, plus the RFCs named next to the codes they define.
Share
Frequently asked questions
Should a validation error be 400 or 422?
Either is defensible. 400 suits a request that cannot be parsed; 422 suits well-formed input that breaks a rule, and is what Laravel returns.
What causes a 502 Bad Gateway with Nginx?
Nginx could not get a valid response from the upstream: PHP-FPM or the Node process is stopped, crashed mid-request, or is listening on a different socket or port than the config says.
Share