HTTP Status Codes Explained: The Ones You Actually Need
Developer · October 4, 2026 · 2 min read
Every web response starts with a three-digit status code. The first digit gives the family and the other two say what happened. There are dozens of codes, but you'll meet the same dozen or so most of the time.
The five families
- 1xx: informational, the request is still being worked on.
- 2xx: success.
- 3xx: redirection, the client needs to go somewhere else.
- 4xx: the client made a mistake.
- 5xx: the server made a mistake.
Success
- 200 OK: it worked, and here is the result.
- 201 Created: a new resource was created, usually after a POST.
- 204 No Content: it worked, and there is nothing to send back. Common for DELETE.
Redirects
- 301 Moved Permanently: the address has changed for good. Search engines move their ranking to the new address.
- 302 Found: a temporary redirect, so keep using the original address.
- 304 Not Modified: your cached copy is still good.
Client errors
- 400 Bad Request: the request is malformed.
- 401 Unauthorized: you aren't logged in, or your credentials are wrong.
- 403 Forbidden: the server knows who you are, but you aren't allowed to do this.
- 404 Not Found: nothing exists at this address.
- 409 Conflict: the request clashes with the current state, such as creating something that already exists.
- 422 Unprocessable Content: the request is well formed, but the data fails validation.
- 429 Too Many Requests: you have hit a rate limit. Wait and retry.
Server errors
- 500 Internal Server Error: something unexpected broke on the server.
- 502 Bad Gateway: a proxy got a bad answer from the server behind it.
- 503 Service Unavailable: the server is overloaded or down for maintenance.
- 504 Gateway Timeout: a proxy waited too long for the server behind it.
401 or 403?
Use 401 when the visitor hasn't proven who they are, and 403 when they have, but aren't permitted. Showing a login page after a 401 makes sense. Showing one after a 403 doesn't, because logging in again won't help.
Picking codes for your API
Return the most specific code that is true. Use 201 after creating something, 204 after a delete, 422 for validation problems and 429 for rate limits. Always send a short error message in the body as well, so developers can see what to fix.
Look up any code in the HTTP Status Codes list, which you can search by number or by word.