HTTP Status Codes Explained: The Complete Reference Guide
Every HTTP response starts with a three-digit number that tells you whether the request succeeded, was redirected, or failed. Knowing these codes makes debugging APIs and web applications significantly faster.
The Five Categories
Status codes are grouped by their first digit. Each group represents a fundamentally different type of response:
Informational
The server received the request and is still processing it. Rarely seen directly in application code.
Success
The request was received, understood, and accepted. This is what you want to see.
Redirection
The resource moved or the client needs to take additional action. Browsers handle most of these automatically.
Client Error
The request was malformed or unauthorized. The problem is on the client's side.
Server Error
The server failed to process a valid request. The problem is on the server's side.
The Most Common Status Codes
You'll encounter these codes daily when building and debugging web applications:
- 200 OK: The standard success response. For GET requests, the body contains the requested resource.
- 201 Created: A new resource was created successfully. Typically returned by POST endpoints.
- 204 No Content: Success, but there's nothing to return. Common for DELETE operations.
- 301 Moved Permanently: The URL has changed permanently. Search engines transfer ranking to the new URL.
- 302 Found: Temporary redirect. The original URL should continue to be used for future requests.
- 400 Bad Request: The request body or parameters are invalid. Check your JSON syntax, required fields, and data types.
- 401 Unauthorized: Authentication is required but missing or invalid. You need to log in or provide a valid API key.
- 403 Forbidden: You're authenticated but don't have permission. Different from 401 — your identity is known, but access is denied.
- 404 Not Found: The resource doesn't exist. Check the URL for typos or verify the resource ID.
- 429 Too Many Requests: Rate limit exceeded. Slow down and check the
Retry-Afterheader. - 500 Internal Server Error: Something crashed on the server. Not your fault as a client — report it to the API provider.
- 502 Bad Gateway: A proxy or load balancer couldn't reach the upstream server. Often transient — try again.
- 503 Service Unavailable: The server is overloaded or down for maintenance. Check status pages and retry later.
Status Codes in REST APIs
Well-designed REST APIs use status codes consistently. A good rule of thumb for API design:
- GET success → 200
- POST creating a new resource → 201 with a Location header
- PUT/PATCH updating → 200 (with body) or 204 (without)
- DELETE → 204
- Validation errors → 422 Unprocessable Entity (with error details in body)
- Not authenticated → 401
- Not authorized → 403
Look up any HTTP status code
Searchable reference with descriptions, common causes, and what to do for each code.
Open HTTP Status Code Reference