HTTP Status Codes
All registered HTTP status codes in one searchable list, each with a plain explanation and a note on when to use it in your API or site.
Runs in your browser — nothing is uploaded.
No code matches your search.
100 Continue #100
The server got the request headers; the client may send the body. Used with Expect: 100-continue before a large upload.
101 Switching Protocols #101
The server agrees to switch protocol, for example to WebSocket after an Upgrade request.
102 Processing #102
WebDAV: the server is still working on a long request and has no response yet.
103 Early Hints #103
Sends Link headers before the final response so the browser can preload CSS or scripts while the server is still working.
200 OK #200
The request worked. GET returns the resource, POST returns the result of the action. The default success code.
201 Created #201
A new resource was created, usually after POST or PUT. Send its address in the Location header.
202 Accepted #202
The request was accepted but is processed later (a queued job). Say where to check the result.
203 Non-Authoritative Information #203
The response comes from a proxy that changed the origin's answer. Rarely used.
204 No Content #204
Success with no body: a DELETE, or a PUT/PATCH where there is nothing to return. Do not send a body.
205 Reset Content #205
Success; the client should reset the form or view that sent the request. Rare.
206 Partial Content #206
Returns only the byte range asked for with the Range header. Used for video seeking and resumable downloads.
207 Multi-Status #207
WebDAV: the body holds several status codes, one per sub-request.
208 Already Reported #208
WebDAV: members of a binding were already listed earlier in the response.
226 IM Used #226
The response is the result of one or more instance manipulations (delta encoding). Very rare.
300 Multiple Choices #300
Several representations of the resource exist and the client should choose. Rarely used in practice.
301 Moved Permanently #301
The URL changed for good. Browsers and search engines update links. A POST may be re-sent as GET; use 308 to keep the method.
302 Found #302
Temporary redirect. Browsers may change POST to GET. Prefer 303 or 307 to be explicit.
303 See Other #303
After a POST, redirect the client to a GET page (the Post/Redirect/Get pattern).
304 Not Modified #304
The cached copy is still valid (answer to If-None-Match or If-Modified-Since). No body.
305 Use Proxy #305
Deprecated: the resource must be reached through a proxy. Do not use.
307 Temporary Redirect #307
Temporary redirect that keeps the method and body (a POST stays a POST).
308 Permanent Redirect #308
Like 301 but the method and body must not change. Use it to move an API endpoint for good.
400 Bad Request #400
The request is malformed: invalid syntax, bad JSON, missing parameter. Say what is wrong in the body.
401 Unauthorized #401
The client is not authenticated (no or invalid credentials). Despite the name it is about identity. Send WWW-Authenticate.
402 Payment Required #402
Reserved for payment schemes. Some APIs use it when a plan limit or unpaid invoice blocks the request.
403 Forbidden #403
The client is known but not allowed to do this. Authenticating again will not help.
404 Not Found #404
There is nothing at this URL. Also used to hide that a resource exists.
405 Method Not Allowed #405
The URL exists but not for this method (POST on a read-only endpoint). Send an Allow header.
406 Not Acceptable #406
The server cannot produce a response matching the Accept headers (type, language, encoding).
407 Proxy Authentication Required #407
Like 401, but the client must authenticate with the proxy first.
408 Request Timeout #408
The server gave up waiting for the client to finish sending the request.
409 Conflict #409
The request clashes with the current state: duplicate unique value, edit conflict, wrong version.
410 Gone #410
The resource existed and was removed on purpose, for good. Tells search engines to drop it faster than 404.
411 Length Required #411
The server needs a Content-Length header and the request has none.
412 Precondition Failed #412
A condition in If-Match or If-Unmodified-Since was false. Used for optimistic locking.
413 Content Too Large #413
The request body is bigger than the server allows (an upload limit). Called Payload Too Large in older specs.
414 URI Too Long #414
The URL is longer than the server accepts. Move the data to a POST body.
415 Unsupported Media Type #415
The Content-Type of the body is not supported, for example XML sent to a JSON-only API.
416 Range Not Satisfiable #416
The Range asked for is outside the size of the resource.
417 Expectation Failed #417
The server cannot meet the Expect header (for example Expect: 100-continue).
418 I'm a teapot #418
An April Fools’ joke from RFC 2324. Some services use it on purpose to refuse bots.
421 Misdirected Request #421
The request reached a server that cannot answer for this host (HTTP/2 connection reuse).
422 Unprocessable Content #422
The syntax is right but the data fails validation. The usual code for form and API validation errors.
423 Locked #423
WebDAV: the resource is locked.
424 Failed Dependency #424
WebDAV: the request failed because an earlier request it depends on failed.
425 Too Early #425
The server will not risk processing a request that could be replayed (TLS early data).
426 Upgrade Required #426
The client must switch to another protocol (see the Upgrade header), for example to TLS.
428 Precondition Required #428
The server requires a conditional request (If-Match) to avoid lost updates.
429 Too Many Requests #429
Rate limit reached. Add Retry-After so clients know when to try again.
431 Request Header Fields Too Large #431
One header, or all of them together, are too big (often too many cookies).
451 Unavailable For Legal Reasons #451
Access is blocked by law or court order. Name the authority in a Link header.
500 Internal Server Error #500
A generic server fault: unhandled exception or bug. Log it, never show the stack trace to users.
501 Not Implemented #501
The server does not support the method or feature at all.
502 Bad Gateway #502
A gateway or proxy (nginx, a load balancer) got an invalid answer from the upstream server (PHP-FPM, app).
503 Service Unavailable #503
The server is overloaded or down for maintenance. Add Retry-After. The right code for a planned maintenance page.
504 Gateway Timeout #504
A gateway or proxy waited too long for the upstream server.
505 HTTP Version Not Supported #505
The server does not support the HTTP version used in the request.
506 Variant Also Negotiates #506
Configuration error in transparent content negotiation. Very rare.
507 Insufficient Storage #507
WebDAV: the server has no space left to store the resource.
508 Loop Detected #508
WebDAV: the server found an infinite loop while processing the request.
510 Not Extended #510
The request needs further extensions the server does not support. Rare.
511 Network Authentication Required #511
The client must log in to the network first, as on a hotel or airport Wi-Fi captive portal.
How to use it
- Type a code, a name or a word (“redirect”, “rate limit”) in the search box.
- Use the class buttons to show only 2xx, 3xx, 4xx or 5xx codes.
- Every code has its own link (for example #404): share it or bookmark it.
Frequently asked questions
What do the first digits mean?
1xx: informational. 2xx: success. 3xx: redirection. 4xx: the client made a mistake. 5xx: the server failed.
401 or 403?
Use 401 when the client is not logged in or the credentials are wrong; use 403 when it is logged in but not allowed to do this.
301, 302, 307 or 308?
301 and 308 are permanent; 302 and 307 are temporary. 307 and 308 keep the request method and body; 301 and 302 let browsers turn a POST into a GET.
400 or 422?
Use 400 when the request cannot be parsed at all, and 422 when it is well formed but the values fail validation. Many APIs use 422 for validation errors; Laravel does.
Which code should a maintenance page return?
503 with a Retry-After header, so search engines know the outage is temporary and do not drop your pages.