Every HTTP response carries a three-digit status code that tells the client what happened with its request. This reference lists the status codes you'll actually encounter, grouped by class, with a plain-English meaning, a typical use case, and a quick memory hook for each.
Quick rule of thumb: the first digit tells you the category.
| Prefix | Class | Meaning |
|---|---|---|
| 1xx | Informational | Wait |
| 2xx | Success | It worked |
| 3xx | Redirection | Look elsewhere |
| 4xx | Client Error | You messed up |
| 5xx | Server Error | We messed up |
1xx — Informational Responses (100–199)
The server has received the request and the process is continuing.
| Code | Name | When It's Used | Memory Hook |
|---|---|---|---|
| 100 | Continue | Client should continue sending request body | Keep going |
| 101 | Switching Protocols | Protocol upgrade (e.g., HTTP → WebSocket) | Switching lanes |
| 102 | Processing | Request received, still processing (WebDAV) | Working on it |
| 103 | Early Hints | Preload resources before final response | Heads up |
2xx — Success Responses (200–299)
The request was successfully received, understood, and accepted.
| Code | Name | Typical Use | Memory Hook |
|---|---|---|---|
| 200 | OK | Standard successful response | All good |
| 201 | Created | Resource created (POST) | Born |
| 202 | Accepted | Accepted but not yet completed | In progress |
| 204 | No Content | Success with no response body | Empty but fine |
| 206 | Partial Content | Range requests (file streaming) | Just a slice |
Which success code should your API return?
| Operation | Recommended Code |
|---|---|
| GET | 200 |
| POST (create) | 201 |
| PUT / PATCH | 200 or 204 |
| DELETE | 204 |
3xx — Redirection Responses (300–399)
The client must take an additional action to complete the request.
| Code | Name | When to Use | Memory Hook |
|---|---|---|---|
| 301 | Moved Permanently | Permanent redirect | Forever moved |
| 302 | Found | Temporary redirect | Moved for now |
| 303 | See Other | Redirect after POST | Look elsewhere |
| 304 | Not Modified | Cached version still valid | Use your copy |
| 307 | Temporary Redirect | Temporary, method preserved | Same method, temp |
| 308 | Permanent Redirect | Permanent, method preserved | Same method, forever |
301 vs 308: both are permanent, but 308 guarantees the HTTP method (e.g., POST) isn't changed to GET on the redirect. Use 308 for non-GET requests.
4xx — Client Error Responses (400–499)
The request contains bad syntax or cannot be fulfilled by the server.
| Code | Name | Typical Cause | Memory Hook |
|---|---|---|---|
| 400 | Bad Request | Malformed syntax / invalid JSON | You messed up |
| 401 | Unauthorized | Missing or invalid authentication | Who are you |
| 403 | Forbidden | Authenticated but no permission | Not allowed |
| 404 | Not Found | Resource does not exist | Gone missing |
| 405 | Method Not Allowed | Incorrect HTTP method | Wrong verb |
| 406 | Not Acceptable | Cannot produce requested format | Wrong format |
| 408 | Request Timeout | Client took too long | Too slow |
| 409 | Conflict | Resource state conflict | Version clash |
| 410 | Gone | Permanently removed resource | Really gone |
| 413 | Payload Too Large | Request body too large | Too heavy |
| 415 | Unsupported Media Type | Invalid Content-Type | Wrong type |
| 422 | Unprocessable Entity | Validation failed | Data invalid |
| 429 | Too Many Requests | Rate limiting triggered | Slow down |
401 vs 403: authentication quick reference
| Scenario | Code |
|---|---|
| No token provided | 401 |
| Invalid or expired token | 401 |
| Valid token, no permission | 403 |
5xx — Server Error Responses (500–599)
The server failed to fulfill an otherwise valid request.
| Code | Name | Meaning | Memory Hook |
|---|---|---|---|
| 500 | Internal Server Error | Generic server failure | Something broke |
| 501 | Not Implemented | Feature not supported | Not built |
| 502 | Bad Gateway | Invalid upstream response | Bad middleman |
| 503 | Service Unavailable | Server overloaded or down | Come back later |
| 504 | Gateway Timeout | Upstream service timeout | Upstream too slow |
Rare but Useful HTTP Status Codes
| Code | Meaning |
|---|---|
| 418 | I'm a Teapot (RFC 2324 joke) |
| 425 | Too Early (retry unsafe request) |
| 451 | Unavailable for Legal Reasons |
Frequently Asked Questions
What are the 5 categories of HTTP status codes? Codes are grouped by their first digit: 1xx (informational), 2xx (success), 3xx (redirection), 4xx (client errors), and 5xx (server errors).
What is the difference between 401 and 403? A 401 means you aren't authenticated (unknown or invalid credentials). A 403 means you're authenticated but not authorized to access the resource.
What status code should a successful POST return? Use 201 Created when the request creates a new resource, and include the new resource's location. Use 200 OK for a POST that doesn't create anything.
What does a 429 status code mean? 429 Too Many Requests means you've hit a rate limit. Check the Retry-After header to see when you can try again.
Is 418 a real HTTP status code? 418 I'm a Teapot is a real, registered code originating from an April Fools' RFC. It isn't used in production APIs but is widely recognized.